Identity and Access Management

Automating Account Management

Securely manage the lifecycle and privileges of all accounts, roles, and groups, using automation.

Adopting Passwordless Methods

Use secure passwordless methods for user authentication and authorization when feasible, otherwise enforce strong passwords with MFA for authentication.

Ensuring Least Privilege

Persistently ensure that identity and access management employs measures to ensure each user or device can only access the resources they need.

Authorizing Just-in-Time

Use a least-privileged, role and attribute-based, and just-in-time security authorization model for all user and non-user accounts and services.

Enforcing Phishing-Resistant MFA

Enforce multi-factor authentication (MFA) using methods that are difficult to intercept or impersonate (phishing-resistant MFA) for all user authentication.

Securing Non-User Authentication

Enforce appropriately secure authentication methods for non-user accounts and services.

Responding to Suspicious Activity

Automatically disable or otherwise secure accounts with privileged access in response to suspicious activity.