Do you remove access during the review?
No changes are made without client authorization. The review identifies excessive, stale, or unclear access and proposes a controlled change and verification plan for the owners responsible for each system.
MODULE_DETAIL // IAM & Identity Review
IAM & Identity Review
A focused review of identity controls across staff, contractors, and administrators, including SSO, roles, privileged access, onboarding, and offboarding in commercial or scoped government environments.
Who this helps
Commercial teams and agency or prime-contractor programs managing complex roles, contractor access, frequent transitions, or access evidence requests.
Execution Parameters
Engagement timeline
2 weeks
Commercial starting estimate
$3,000
Published price is a commercial starting estimate, not a Schedule rate. Government work requires a separately negotiated SOW or task-order scope and price.
Government or federal contracting work is scoped and priced separately through a negotiated statement of work or task order; published prices are not Schedule rates.
What you receive
- ->Access control matrix with system and role owners
- ->Privileged and contractor account review
- ->MFA, SSO, onboarding, and offboarding evidence review
- ->Least-privilege changes with verification plan
Who this service helps
An IAM and identity review is for teams with frequent onboarding and offboarding, complex role hierarchies, inconsistent MFA, or uncertainty about privileged access. It is especially relevant when a customer questionnaire or audit asks who can access sensitive systems and why.
An acquisition, new identity provider, cloud migration, or incident can expose gaps between directory groups, application roles, and actual business ownership. The review creates a practical view of those relationships.
What the work covers
The work maps identity sources, authentication paths, SSO applications, role assignments, privileged accounts, service identities, and lifecycle events. The aim is to compare intended access with what exists, not simply confirm that an identity tool is installed.
Joiner, mover, and leaver workflows are examined for triggers, approvals, timing, exceptions, and evidence. MFA, recovery, break-glass access, shared accounts, and dormant privileges are considered where they affect the agreed scope.
An access matrix makes ownership visible and separates technical cleanup from policy decisions. Recommendations favor controls that a team can operate: role design, approval cadence, logging, access review, and a test that proves deprovisioning works.
The engagement does not make unapproved access changes or decide employment policy. Client owners approve role definitions and changes; Vyer.Net supplies analysis, prioritization, and implementation guidance.
For agency and prime environments, the map can distinguish staff, contractor, sponsor, administrator, and service identities and show who requests, approves, provisions, reviews, and removes access, including offboarding evidence.
How the work is scoped
The focused review is scheduled for two weeks and uses interviews, configuration and export review, sampling, and readout. Government scope records staff and contractor roles, lifecycle events, authorized evidence access, and offboarding acceptance evidence.
Deliverables and handoff
Outputs show where access is broad, stale, unexplained, or difficult to prove, with an owner and verification path for meaningful fixes.
- ->Access control matrix with system and role owners. Each deliverable is prepared for an accountable owner; for contract work, the SOW defines its acceptance format and handoff.
- ->Privileged and contractor account review. Each deliverable is prepared for an accountable owner; for contract work, the SOW defines its acceptance format and handoff.
- ->MFA, SSO, onboarding, and offboarding evidence review. Each deliverable is prepared for an accountable owner; for contract work, the SOW defines its acceptance format and handoff.
- ->Least-privilege changes with verification plan. Each deliverable is prepared for an accountable owner; for contract work, the SOW defines its acceptance format and handoff.
How this connects to your other work
Identity is a foundation for several other security decisions:
- ->a compliance readiness sprint when access evidence must support a customer or framework review.
- ->a security architecture assessment when identity boundaries are part of a larger cloud design.
- ->secure SDLC guidance for service identities and deployment permissions.
- ->executive-ready risk reporting to make access risk legible to leadership.
Common questions
Does this review include SSO and MFA?
Yes, SSO applications, MFA coverage, recovery paths, and exceptions can be included when they fall within the agreed identity boundary. The review also considers whether configuration matches actual role and lifecycle needs.
What is an access control matrix?
It is a practical map of roles, systems, permissions, and owners. It helps a team see what access should exist, who approves it, how it is reviewed, and where current assignments do not match the intended model.
Can this review contractor access and offboarding?
Yes. Scope can map sponsor and approver roles, account provisioning, access reviews, end dates, and deprovisioning evidence across selected systems. Client owners authorize changes and retain personnel decisions.