Identity and Access Management
Purpose
Identity Access Management is the process of creating, provisioning, using, and terminating accounts and credentials in the enterprise. This policy provides the processes for governing accounts and credentials.
Responsibility
- The IT business unit is responsible for all account and credential management functions. This information is relayed to other business units within the enterprise such as finance, accounting, and cyber security as required or needed. IT is responsible for informing all users of their responsibilities in the use of any accounts and credentials assigned to them.
- IT is responsible for reviewing Human Resources’ documented requests (through the IT Help Desk system) for employees who are joining, leaving, or changing departments within HCC.
- Users are responsible for using their accounts in a manner consistent with enterprise policy.
Exceptions
Exceptions to this policy are likely to occur. Requests for exception must be made in writing and must contain:
- The reason for the request,
- Risk to the enterprise of not following the written policy,
- Specific mitigations that will not be implemented,
- Technical and other difficulties, and
- Date of review.
Policy
Onboarding
1. IT must maintain procedures for modifying access, permissions, and roles to user accounts.
a. Newly created accounts must be represented within this process.
b. Changing user roles must be included in this process.
c. The permissions granting process must enforce the principle of least privilege.
d. Unnecessary default or generic accounts must be changed before a new system is deployed into the enterprise.
Account Creation
- IT must develop procedures for creating accounts and assigning privileges.
- Administrator privileges must only be provided to administrative accounts.
a. Administrator and privileged accounts must only be used for appropriate installation and maintenance tasks; not for daily use.
b. Administrator accounts must be unique and assigned to a specific individual, unless technically constrained by a system or application. - It is the responsibility of IT to maintain an account inventory.
- At a minimum the account inventory must contain the following data for each account:
a. Person’s name
b. Account name
c. Date of employment start and stop
d. Business unit
e. Account status (i.e., enabled, disabled) - All enabled accounts within the inventory must be regularly validated once a quarter, or more frequently.
Credential Creation and Issuance
- All passwords must be unique.
a. Passwords created by users must not also be used for personal accounts.
b. Passwords must not be shared by users.
c. Passwords must contain at least one capital letter, one special character, one number and meet the length requirements specified in items 2 and 3 below. - Passwords created for use with multifactor authentication must be a minimum 8 characters long.
- Passwords created for use without multifactor authentication must be at a minimum 14 characters long.
Account and Credential Usage
- All users must use multifactor authentication to access externally facing applications.
- All users must use multifactor authentication to access applications hosted by a third-party service provider, where supported.
- All remote users must use multifactor authentication to access internal systems and applications.
- Multifactor authentication is required for all administrative accounts on all enterprise assets, whether managed on site or through a third-party provider.
- All default user passwords must be changed at the first login.
Modify Access
- All users that have not accessed their account within 45 days of creation must be disabled.
- Accounts of individuals on extended leave, as defined by human resources, or any leave defined by human resources that exceeds 45 days, must be disabled.
- Student accounts that have not been accessed for 52 consecutive weeks must be disabled.
- The Account Creation and Account Termination procedures must include the ability to change a user’s role.
Account Termination
- IT, in consultation with human resources, must develop procedures for revoking account access.
a. Termination of employees must be included in this process. - All user credentials must be revoked immediately upon employee separation.
a. Password self-service mechanisms for users must not allow them to re-enable their own account.
Appendix A: Acronyms and Abbreviations
| Acronym | Definition |
|---|---|
| CIS | Center for Internet Security |
| CIS Controls | Center for Internet Security Critical Security Controls |
| COTS | Commercial-off-the-shelf |
| IaaS | Infrastructure as a Service (IaaS) |
| IG | Implementation Group |
| IoT | Internet of Things |
| IT | Information Technology |
| PIN | Personal Identification Number |
| PROD | Planning, Research and Organizational Development |
| SLTT | State, Local, Tribal, and Territorial |
| SMS | Short Message Service |
Appendix B: Glossary
|
Term |
Definition |
|---|---|
|
Asset |
Anything that has value to an organization, including, but not limited to, another organization, person, computing device, information technology (IT) system, IT network, IT circuit, software (both an installed instance and a physical instance), virtual computing platform (common in cloud and virtualized computing), and related hardware (e.g., locks, cabinets, keyboards). Source: Asset(s) - Glossary I CSRC (nist.gov) |
|
Asset inventory |
An asset inventory is a register, repository or comprehensive list of an enterprise's assets and specific information about those assets. Source: Asset Inventory I FIA (dot.gov\ |
|
Asset owner |
The department, business unit, or individual responsible for an enterprise asset. Source: CIS |
|
Cloud environment |
A virtualized environment that provides convenient, on-demand network access to a shared pool of configurable resources such as network, computing, storage, applications, and services. There are five essential characteristics to a cloud environment: on-demand selfservice, broad network access, resource pooling, rapid elasticity, and measured service. Some services offered through cloud environments include Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (laaS). |
|
Enterprise assets |
Assets with the potential to store or process data. For the purpose of this document, enterprise assets include end-user devices, network devices, non-computing/Internet of Things (loT) devices, and servers in virtual, cloud-based, and physical environments. Source: CIS Controls v8 |
|
End-user devices |
Information technology (IT) assets used among members of an enterprise during work, off hours, or any other purpose. End-user devices include mobile and portable devices such as laptops, smartphones, and tablets as well as desktops and workstations. For the purpose of this document, end-user devices are a subset of enterprise assets. Source: CIS Controls v8 |
|
Enterprise asset identifier |
Often a sticker or tag with a unique number or alphanumeric string that can be tracked within an enterprise asset inventory. Source: CIS |
|
Mobile end-user devices |
Small, enterprise-issued end-user devices with intrinsic wireless capability, such as smartphones and tablets. Mobile end-user devices are a subset of portable end-user devices, including laptops, which may require external hardware for connectivity. For the purpose of this document, mobile end-user devices are a subset of end-user devices. Source: CIS Controls v8 |
|
Network devices |
Electronic devices required for communication and interaction between devices on a computer network. Network devices include wireless access points, firewalls, physical/virtual gateways, routers, and switches. These devices consist of physical hardware as well as virtual and cloud-based devices. For the purpose of this document, network devices are a subset of enterprise assets. Source: CIS Controls v8 |
|
Non-computing/ Internet of Things (IoT) devices |
Devices embedded with sensors, software, and other technologies for the purpose of connecting, storing, and exchanging data with other devices and systems over the internet. While these devices are not used for computational processes, they support an enterprise's ability to conduct business processes. Examples of these devices include printers, smart screens, physical security sensors, industrial control systems, and information technology sensors. For the purpose of this document, non-computing/loT devices are a subset of enterprise assets. Source: CIS Controls v8 |
|
Physical environment |
Physical hardware parts that make up a network, including cables and routers. The hardware is required for communication and interaction between devices on a network. Source: CIS Controls v8 |
|
Portable end-user devices |
Transportable, end-user devices that have the capability to wirelessly connect to a network. For the purpose of this document, portable end-user devices can include laptops and mobile devices such as smartphones and tablets, all of which are a subset of enterprise assets. Source: CIS Controls v8 |
|
Remote devices |
Any enterprise asset capable of connecting to a network remotely, usually from public internet. This can include enterprise assets such as end-user devices, network devices, non-computing/Internet of Things (loT) devices, and servers. Source: CIS Controls v8 |
|
Servers |
A device or system that provides resources, data, services, or programs to other devices on either a local area network or wide area network. Servers can provide resources and use them from another system at the same time. Examples include web servers, application servers, mail servers, and file servers. Source: CIS Controls v8 |
|
User |
Employees (both on-site and remote), third-party vendors, contractors, service providers, consultants, or any other user that operates an enterprise asset. Source: CIS |
|
Virtual environment |
Simulates hardware to allow a software environment to run without the need to use a lot of actual hardware. Virtualized environments are used to make a small number of resources act as many with plenty of processing, memory, storage, and network capacity. Virtualization is a fundamental technology that allows cloud computing to work. Source: CIS Controls v8 |
Appendix C: Implementation Groups
As a part of our most recent version of the CIS Controls, v8, we created Implementation Groups (IGs) to provide granularity and some explicit structure to the different realities faced by enterprises of varied sizes.
IG1
An IG1 enterprise is small- to medium-sized with limited IT and cybersecurity expertise to dedicate towards protecting IT assets and personnel. The principal concern of these enterprises is to keep the business operational, as they have a limited tolerance for downtime. The sensitivity of the data that they are trying to protect is low and principally surrounds employee and financial information. Safeguards selected for IG1 should be implementable with limited cybersecurity expertise and aimed to thwart general, non-targeted attacks. These Safeguards will also typically be designed to work in conjunction with small or home office commercial off-the-shelf (COTS) hardware and software.
IG2
An IG2 enterprise employs individuals responsible for managing and protecting IT infrastructure. These enterprises support multiple departments with differing risk profiles based on job function and mission. Small enterprise units may have regulatory compliance burdens. IG2 enterprises often store and process sensitive client or enterprise information, and they can withstand short interruptions of service. A major concern is loss of public confidence if a breach occurs. Safeguards selected for IG2 help security teams cope with increased operational complexity. Some Safeguards will depend on enterprise-grade technology and specialized expertise to properly install and configure.
|
Safeguard Description |
Number of Safeguards |
|---|---|
|
|
153 TOTAL SAFEGUARDS |
|
IG3 assists enterprises with IT security experts to secure sensitive and confidential data. IG3 aims to prevent and/or lessen the impact of sophisticated attacks. |
23 SAFEGUARDS |
|
IG2 assists enterprises managing IT infrastructure of multiple departments with differing risk profiles. IG2 aims to help enterprises cope with increased operational complexity. |
74 SAFEGUARDS |
|
IG1 is the definition of essential cyber hygiene and represents a minimum standard of information security for all enterprises. IG1 assists enterprises with limited cybersecurity expertise thwart general, no-target attacks. |
56 SAFEGUARDS |
The number of Safeguards an enterprise is expected to implement increases based on which group the enterprise falls into.IG3
An IG3 enterprise employs security experts that specialize in the different facets of cybersecurity (e.g., risk management, penetration testing, application security). IG3 assets and data contain sensitive information or functions that are subject to regulatory and compliance oversight. An IG3 enterprise must address availability of services and the confidentiality and integrity of sensitive data. Successful attacks can cause significant harm to the public welfare. Safeguards selected for IG3 must abate targeted attacks from a sophisticated adversary and reduce the impact of zero-day attacks.
If you would like to know more about the Implementation Groups and how they pertain to enterprises of all sizes, there are many resources that explore the Implementation Groups and the CIS Controls in general on our website at https://www.cisecurity.org/controls/cis-eentrols-list/.
Appendix D: CIS Safeguards Mapping
CIS Controls & Safeguards Covered by this Policy
This policy helps to bolster IG1 Safeguards in CIS Control 5: Account Management and CIS Control 6: Access Control Management. Table 1 shows which IG1 CIS Safeguards are covered by this policy as written.
Table 1 - Safeguards covered by IG1
|
CIS Control |
Policy Statement |
CIS Safeguard |
CIS Safeguard Description |
|---|---|---|---|
|
5.1 |
Account Creation 3, 4, 5 |
Establish and Maintain an Inventory of Accounts |
Establish and maintain an inventory of all accounts managed in the enterprise. The inventory must include both user and administrator accounts. The inventory, at a minimum, should contain the person’s name, username, start/stop dates, and department. Validate that all active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently. |
|
5.2 |
Credential Creation and Issuance 1, 1a, 1b, 2, 3 |
Use Unique Passwords |
Use unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-character password for accounts using MFA and a 14-character password for accounts not using MFA. |
|
5.3 |
Modify Access 6, 7 Account usage 5 |
Disable Dormant Accounts |
Delete or disable any dormant accounts after a period of 45 days of inactivity, where supported. |
|
5.4 |
Account Creation 2, 2a, 2b |
Restrict Administrator Privileges to Dedicated Administrator Accounts |
Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account. |
|
6.1 |
Onboarding 1a, 1b, 1c, 1d Account Creation 1 Modify Access 8 |
Establish an Access Granting Process |
Establish and follow a process, preferably automated, for granting access to enterprise assets upon new hire, rights grant, or role change of a user. |
|
6.2 |
Account Termination 1, 1a, 2, 2a Modify Access 8 |
Establish an Access Revoking Process |
Establish and follow a process, preferably automated, for revoking access to enterprise assets, through disabling accounts immediately upon termination, rights revocation, or role change of a user. Disabling accounts, instead of deleting accounts, may be necessary to preserve audit trails. |
|
6.3 |
Account Usage 1, 2 |
Require MFA for Externally-Exposed Applications |
Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. Enforcing MFA through a directory service or SSO provider is a satisfactory implementation of this Safeguard. |
|
6.4 |
Account Usage 3 |
Require MFA for Remote Network Access |
Require MFA for remote network access. |
|
6.5 |
Account Usage 4 |
Require MFA for Administrative Access |
Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether managed on-site or through a third-party provider. |
Appendix E: References and Resources
Center for Internet Security®
https://www.cisecurity.org/
CIS Critical Security Controls®
https://www.cisecurity.org/controls/
Date: June 11, 2026
Approved By: Senior Leadership Team