Identity readiness · about 5 to 7 minutes

Identity & privileged access

Trace authority from approval through revocation. Rate 12 original prompts as Operating, Partial, Planned, Not in place or Not sure, see your readiness by area, and get a remediation template for every gap. Everything stays in your browser.

12 prompts4 areas100% privateFree

Start this assessment See all 15

Scope. 12 original identity-governance prompts. Not an identity-provider scan, zero-trust certification or complete NIST digital-identity assessment. Reference: NIST digital identity guidance (context only, not an endorsement).

What this assessment covers

The 12 prompts, grouped by area. Each one has a "what to look for" note and a concrete action inside the assessment.

Inventory

Are human, service and emergency identities owned?
Can important permissions be explained in business terms?
Are unmanaged or shared accounts identified?

Authentication

Is phishing-resistant authentication prioritized for high-impact access?
Are account-recovery paths at least as well protected as sign-in?
Are session lifetime and reauthentication decisions explicit?

Privilege

Is privileged access separate from routine work?
Are temporary privileges time-bounded and reviewed?
Can consequential service identities act beyond their purpose?

Lifecycle

Are joiner, mover and leaver changes linked to authoritative events?
Does revocation end active authority as intended?
Are access reviews focused on meaningful decisions?

How scoring works. Only rated prompts count toward the index. Not sure and unanswered prompts are reported separately and never scored as a pass or a gap. Gaps are listed highest priority first, each with a link to a matching template in the open GRC Documentation Kit. This is a conversation starter, not an audit or a certification.

Start the Identity & privileged access assessment

Other assessments: NIST CSF 2.0 · ISO 27001 readiness · SOC 2 preparation · Cloud & identity · AI & agent security · SOC & incident readiness · Small business security · Web & API release readiness · Supplier security review · Backup & recovery readiness · Secure software delivery · Mobile release readiness · Data protection operations · Security culture & role readiness