Client Identity and Access Hardening Engagement (10-18 days)
A fixed-scope engagement that inventories every human and non-human identity touching a client's stack, closes the credential and access-review gaps that show up in security questionnaires, and hands the client a repeatable quarterly access review they can run without the agency. Time: 10-18 days.
By InnovaAI ResearchPublished
How do you implement it?
Client Identity and Access Hardening Engagement (10-18 days)
A fixed-scope engagement that inventories every human and non-human identity touching a client's stack, closes the credential and access-review gaps that show up in security questionnaires, and hands the client a repeatable quarterly access review they can run without the agency.
- Written client sign-off on read-only discovery access to identity providers, SSO tenants, and password vaults before day one A named client-side owner for identity (IT lead, ops director, or fractional CISO) with authority to revoke accounts Inventory of client compliance obligations (SOC 2, ISO 27001, HIPAA, or contractual security schedules) so scope maps to an actual audit clause Agreed definition of in-scope systems: SaaS apps, cloud consoles, source control, and any AI or automation tooling holding credentials
- 1.Kickoff with the client identity owner and confirm escalation path
- 2.Collect read-only credentials for each identity provider and vault in scope
- 3.Agree the in-scope system list and freeze it for the engagement
- 1.Export the full user roster from every directory and SSO tenant
- 2.Pull app assignments and group memberships per user
- 3.Flag accounts with no login activity in 90 days
- 1.Inventory non-human identities: API keys, service accounts, CI tokens, agent credentials
- 2.Map each machine identity to an owning human and a business purpose
- 3.Record where secrets are stored versus where they are pasted
- 1.Score every account on privilege level and data sensitivity
- 2.Identify admin and super-admin holders across each platform
- 3.Draft the orphaned and over-privileged account list
- 1.Review MFA enrollment coverage per system and per role
- 2.Test whether legacy or break-glass accounts bypass MFA
- 3.Document recovery-code storage and who can reach it
- 1.Run the first access review with the client owner on the highest-risk 20 accounts
- 2.Capture revocations, downgrades, and ownership transfers as decisions
- 3.Log every decision with a name and a date
- 1.Configure the chosen platform's policy baseline: password rules, session length, device trust
- 2.Enable alerting on new admin grants and dormant-account reactivation
- 3.Set up the access review cycle the client will own
- 1.Migrate shared and team credentials into the vault with per-person access
- 2.Rotate any secret that was stored in plaintext, chat, or documents
- 3.Retire duplicate vaults and stale shared folders
- 1.Draft the offboarding and role-change runbook
- 2.Write the joiner checklist covering app provisioning order
- 3.Define the 24-hour revocation SLA for departures
- 1.Walk the client owner through the runbook live and record gaps
- 2.Re-test MFA and admin grants after remediation
- 3.Confirm the review cadence lands on the client calendar
- 1.Assemble the evidence pack: before-and-after account counts, revocations, policy screenshots
- 2.Write the residual risk register with owners and target dates
- 3.Prepare the executive summary for the client's security contact
- 1.Present findings to the client sponsor and their auditor or compliance lead if applicable
- 2.Hand over admin rights on the review workflow
- 3.Close with the next review date booked
Identity work is priced against breach and audit exposure, not hours, so a 12-day engagement that clears a client's SOC 2 access-review findings supports a five-figure fee against a single failed audit cycle. The recurring review retainer is the real margin: it is low-effort once the workflow exists, and it keeps the agency inside the client's security conversation every quarter. Agencies that bundle this into a broader managed-IT or compliance retainer defend the account against replacement by a generalist MSP.
- Identity inventory workbook covering human and non-human accounts with privilege scores and owners
- Remediation log of every revocation, downgrade, and secret rotation with dates and approvers
- Configured policy baseline and alerting rules in the client's chosen identity platform
- Joiner, mover, and leaver runbooks with a 24-hour revocation SLA
- Quarterly access-review workflow plus a residual risk register with named owners
The client's identity owner signs off that every in-scope account has a named human owner, MFA is enforced on all admin roles, and the first access review is complete with a scheduled next cycle.