CIP-1 - Identity Inventory
Inventory of human and non-human identities: integration with the identity provider, HR and full lifecycle management.
Control Definition
A complete, up-to-date inventory of all human and non-human identities with access to organizational resources must be maintained, integrated with the identity provider and the human resources system to reflect their real status. The lifecycle of each identity must be managed from creation to removal, each non-human identity must be assigned an owner and a purpose, and those no longer in use or without an active owner must be deactivated.
Requirements
Requirement 1
We maintain a complete, up-to-date record of all —human— identities that have access to organizational resources.
Requirement 2
We maintain a complete, up-to-date record of all —non-human— identities that have access to organizational resources.
Requirement 3
We define the minimum attributes of the identity inventory: unique ID, type, status, owner, last activity and review date.
Requirement 4
We define the identity lifecycle management mechanisms: onboarding.
Requirement 5
We define the identity lifecycle management mechanisms: changes.
Requirement 6
We define the identity lifecycle management mechanisms: offboarding.
Requirement 7
We assign each non-human identity a human owner, a documented purpose and an expiration date.
Requirement 8
We integrate the identity inventory with the centralized identity provider (IdP).
Requirement 9
We integrate the identity inventory with the HR system (HRIS - Human Resources Information System).
Requirement 10
We manage a 100% cloud IdP under SaaS shared responsibility models, for example: EntraID.
Requirement 11
We automatically reconcile the IdP inventory on a scheduled basis.
Requirement 12
We identify and deactivate non-human identities without an active owner or unused for a period defined by the organization.