Identity and access management

The identity provider covers the applications that were connected to it. What is usually left is the inventory of everything that was not, the lifecycle process around it, the exceptions, and the review cadence that turns the design into evidence. In our experience the gap is rarely the tool.

The frameworks are written for organizations of every size, but the examples assume large ones. A company with a two-person IT team does not need an enterprise ticketing workflow for provisioning. It does need to show that access is granted on a process, removed on departure and reviewed on a cadence. The minimum viable formalization is usually what you already do, written down and made demonstrable.

Two things: that you are secure, and that your product lets them stay secure. The second is where deals stall. SSO so they do not manage local accounts, role-based access that maps to their directory groups, security logs they can send to their SIEM, stale-account detection and session controls. In SOC 2 terms these map to the complementary user entity controls sophisticated reviewers read first.

We are independent of every vendor. Where you have an identity provider, we design around it and the vendor's engineers execute the product work. Our role is the inventory, the design, the exceptions and the evidence.

SOC 2 CC6.1, CC6.2 and CC6.3 cover logical access restriction, provisioning and removal, and review. ISO 27001 Annex A covers identity management, access rights and authentication. The engagement produces the inventory, lifecycle records and review evidence those controls are tested against.