Fee
Register to see indicative feesConfirmed in writing after discovery01 / Build & Advisory · Supporting
Identity & Access Security
Access has accumulated faster than it has been reviewed, and nobody can currently say who can reach what.
Strategy & ArchitectureBuild and advisory
Typical duration
8 to 12 weeksScoped after discoveryPrimary artefact
Identity control baselinePlus one moreWho leads it
Steve SharmaFounder & Principal04 / What this is
What Identity & Access Security is
A design engagement covering identity lifecycle, access governance and privileged access: what good looks like for your estate, and how to get there from where access actually sits today.
And what this service produces
It starts with an evidenced picture of current access, which is usually the part that changes the conversation.
05 / Who it is for
Built for a real assurance trigger, not a badge project.
01
This fits when
- Access reviews are manual or overdue.
- Privileged accounts are unmanaged.
- Your team is preparing for an audit with access control findings.
02
The usual trigger
- An audit found access control gaps.
- A joiner-mover-leaver process is failing.
- Privileged access has no inventory.
06 / The obligation
Why access accumulates and review does not fix it
Access grows monotonically in most organisations: people join, change roles and accumulate, and the leaver process removes only the obvious. Periodic review is the standard answer and it rarely works, because reviewers approve what they do not understand rather than risk breaking something.
The controls that hold are structural.
Role-based provisioning
Provisioning based on roles grants correctly in the first place, so there is less to review afterwards.
Time-bound privileged access
Privileged access is time-bound and expires without anyone having to decide.
A lifecycle attached to HR
The identity lifecycle is attached to HR rather than to a ticket.
Privilege outside the identity platform
Most organisations cannot produce a complete list of their privileged accounts, because privilege accumulates in places nobody thinks of as identity: service accounts created for a migration, shared credentials in a runbook, a vendor account issued during an implementation and never revoked. An access review that covers only the accounts in the identity platform reviews the accounts least likely to be the problem, which is why the inventory phase routinely changes its own scope.
A review process that depends on a manager understanding 200 entitlements is a process that approves them. The fix is granting correctly, not reviewing harder.
07 / What you receive
Two artefacts. Each one yours to keep.
- 01
Identity control baseline
Lifecycle, provisioning, review and deprovisioning, designed against your estate.
Design documentIdentity owner - 02
Privileged access design
What privileged means here, how it is granted, and how it expires.
Design + inventorySecurity operations
08 / Scope
The whole system is visible before work begins.
Current state
- Identity sources and lifecycle mapped
- Entitlement and access review of key systems
- Privileged account inventory
Lifecycle design
- Joiner-mover-leaver attached to HR
- Role-based provisioning model
- Exception handling
Privileged access
- Privileged account definition
- Time-bound privileged access design
- Session controls and logging
Governance
- Access review design that a reviewer can actually perform
- Attestation cadence
- Metrics and reporting
09 / Included / not included
A useful boundary is part of the deliverable.
Included
- Current-state identity and access mapping
- Lifecycle and role design
- Privileged access design
- Access governance design
Not included
- Implementation: We design. Deploying the platform is your team or a partner.
- Product selection: Vendor-neutral, no product margin.
- Ongoing access administration: Not a managed service.
10 / How we do it
A traceable path from scope to evidence.
Discovery
Identity sources, lifecycle and privileged accounts inventoried.
Lifecycle and role design
Provisioning model attached to HR rather than to tickets.
Privileged access design
Definition, granting, expiry and session controls.
Governance and handover
Review design, cadence and named owner.
Mapped againstNIST SP 800-207ISO/IEC 27001CIS Controls
11 / Timeline
8 to 12 weeks of work.
Elapsed time and customer effort are separated because they are not the same number.
Weeks 1 to 3
Discovery and inventory
Inventory identity sources, the lifecycle and privileged accounts. The fee is confirmed at the end of this phase.
Customer effort
Identity system access, plus 3-5 interviews.
Weeks 4 to 7
Lifecycle and role design
Design the provisioning model and attach it to HR.
Customer effort
Two half-day workshops with HR and IT.
Weeks 8 to 10
Privileged access design
Define privilege, granting, expiry and session controls.
Customer effort
Two review cycles with operations.
Weeks 11 to 12
Governance and handover
Set the review design and cadence, and hand over to a named owner. Discovery is where the timeline moves: privileged account inventories are routinely larger than expected.
Customer effort
One handover session.
Our work: 8 to 12 weeks
12 / Scope check
Test whether Identity & Access Security
is the right next move.
We will cover likely scope, cost and fit.
Book a confidential strategy sessionWith Steve Sharma, who would lead.13 / Who leads the engagement
Named lead. Direct assessment.
Your engagement lead
Steve Sharma
Founder & Principal
Leads the design and the privileged access model.
ASD-endorsed IRAP AssessorCISSPCREST
Every engagement has a named lead. Where a second executive or specialist is needed, they are named in the proposal and subject to client approval.
Review leadership record14 / Why Cybersecurity Link
Three decisions.
Accountability.
We design granting, not reviewing.
A review that depends on understanding 200 entitlements approves them. The structural fix is provisioning correctly.
The inventory usually changes the scope.
Privileged account discovery routinely surfaces more than expected, and we re-scope rather than absorbing it.
Vendor-neutral.
No product margin. Requirements, not a stack.
15 / The boundary
What this engagement does not claim.
Delivery
We design. We do not implement or administer access.
Deploying the identity platform sits with your team or an implementation partner.
Independence
We are vendor-neutral and take no product margin.
The design states requirements, not a stack.
Operations
We are not a managed security service.
Ongoing access administration remains with your team.
Frameworks
One design, mapped across three references.
The work maps to NIST SP 800-207, ISO/IEC 27001 and the CIS Controls.
What moves the fee
Systems and identity sources in scope, the primary driver, confirmed at discovery.
Where the privileged account inventory exceeds expectation.
Discovery as a bounded fixed feeThe engagement quoted in writing after discoveryIdentity control baseline and privileged access designImplementation and product selection excluded
18 / How this fits
Where this sits in the wider programme.
19 / When this is not right
Sometimes the best recommendation is a smaller service, or a later date.
20 / FAQ
The questions that change the decision.
No. We design the model and hand over. Deployment is your team or an implementation partner, and we take no margin either way.
Yes, but far fewer and far more meaningful. The design aims to reduce what needs reviewing rather than to make reviewing easier.
The privileged account count. It is routinely two to three times what the organisation expected, and it usually changes the scope before phase two.
21 / Next move
If Identity & Access Security is what you need, the next step is a conversation about scope.
A 45-minute conversation with Steve Sharma, who would lead the engagement: what your scope looks like, what it involves, and whether this is the right service for you at all.