When a firm of a few hundred people grows, someone has to show who can reach what. This page is for IT managers and business owners at firms of roughly 250 to 2,000 people in India or the GCC. Their headcount is growing faster than their handling of access. An identity and access management checklist holds yes or no tests. They show whether each person has one account, signs in safely and holds only the rights the job needs. They also show whether those rights end when the person leaves. It has 16 checks in five groups and a top score of 32.
Last reviewed 2026-11-01 by Manish Sharma.
How identity and access management works comes down to how a firm decides who can sign in to what. It covers employee and contractor accounts only, while machine, service and AI-agent identities and supplier access stay out. It is a self-check that gives no audit result, certificate or legal opinion, and it recommends no product. This page offers no download either. If you want a working sheet, rebuild the tables in a spreadsheet of your own, with columns for owner, date and score.
Key Takeaway A rule with no dated record scores Partial at best.
Scoring Rules for the Identity and Access Management Checklist
Score each check 2 for Pass, 1 for Partial or 0 for Fail. Pass means the check works as tested and a dated record backs it up. Partial means the test holds for some of the accounts, or the record has gaps. Fail means the check breaks its test or has not been run.
Without a dated record, a rule that works still earns 1 at most.
No total counts as a pass mark. Sixteen checks at 2 points give a maximum of 32, which is Signisys’ own arithmetic. Read the five groups before the sum, since a group that failed outright can sit behind a respectable sum.
When a test names a sample, pick three names from the account list, record your picks, and pick a different three at the next run. Test a list with fewer than three names in full.
If there is nothing to test, mark the check N/A and lower the maximum by 2. For example, check 3 is N/A when you employ no contractors, and check 16 is N/A at a first run.
Ask someone who does not own the accounts under test to run the checks. An account owner is the person answerable for what an account does.
The marks, samples and pass tests are Signisys’ own method, and a full score certifies nothing.
Key Takeaway Five groups, 16 checks, up to 32 points; no target total.
Identity and Access Management Checklist, Checks 1 to 3: Who Holds Access
These three checks test whether the firm can list every account and name a person for each. NCSC’s 10 Steps to Cyber Security is UK guidance for cyber security professionals, published 11 May 2021. Its policy advice covers “who should have access to which systems, data or functionality, why, and under what circumstances”. In this identity and access management checklist, every pass test and sample is ours, while NCSC supplies an idea only where Basis says so.
| Check | Evidence to keep | Pass test | Basis |
|---|---|---|---|
| 1. When the HR list and the account list are compared, every current employee appears once. | The HR people list and the account list, including the date each was exported. | If each of three names drawn from the HR list has an account in the list, and each account maps to one person. | Our check. |
| 2. Each account has a named owner, including shared logins. | The account list, with an owner column. | If each of three sampled accounts names one person rather than a team, and that person confirms it. | Our check. |
| 3. Contractors and other temporary users sit on the same list with an end date. | The list rows for contractors, including their end dates. | If each of three sampled contractors has an end date that is still ahead. | NCSC names staff, contractors, volunteers, students and visitors as types of user to consider, and says temporary accounts should be removed or suspended when no longer required; the end-date test is ours. |
Checks 4 to 6: Can People Sign In Safely?
Three checks cover the second check at sign-in, administrator accounts and the password rule.
Multi-factor authentication is a code, key or prompt on top of a password.
For check 6, NIST’s SP 800-63B-4 (part of SP 800-63 Revision 4, which NIST’s SP 800-63 page dates July 2025) is US federal guidance on digital identity.
| Check | Evidence to keep | Pass test | Basis |
|---|---|---|---|
| 4. A second check guards each account that reaches company data when someone signs in from a new device. | The sign-in policy export and a test record. | If a fresh sign-in on a new device asks three sampled accounts for a second check. | NCSC says to implement multi-factor authentication on any accounts for online services; the test is ours. |
| 5. Each administrator uses one account for daily work and another, with a second check, for admin tasks. | The administrator list, including both account names. | If each of three sampled administrators has two accounts and the admin one asks for a second check. | NCSC advises separate everyday and administrative accounts, and a second check on the latter; the test is ours. |
| 6. The written password rule sets no change timetable but forces a change on evidence of compromise. | The password rule text, with its last update date. | If the rule sets no timetable and forces a change on evidence of compromise. | NIST says “Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically”, and a forced change on evidence of compromise. Verifiers are the systems that check passwords, and the policy test is ours. |
Identity and Access Management Checklist, Checks 7 to 9: Rights Follow the Job
Rights should come from the job. The CISA and NSA best-practices guide for administrators, advisory guidance from US agencies, says to “Limit user account permissions to those that are necessary to perform their job”. This part of the identity and access management checklist tests that rule on the policy, role list and role changes.
| Check | Evidence to keep | Pass test | Basis |
|---|---|---|---|
| 7. A written access policy says who may reach what, why and under what circumstances. | The policy, including an approver’s name and a review date. | If it covers employees and contractors and an approver has signed it. | NCSC’s policy advice covers who, which systems, data or functions, why and under what circumstances; the signature test is ours. |
| 8. Access comes from a role list, and any extra access has an approval. | The role list, including the approvals for extras. | If each of three sampled people holds only what their role lists, or has an approval on file for the rest. | The CISA and NSA guide says to limit permissions to those necessary for the job; the role list and approvals test are ours. |
| 9. A role change removes what only the old role needed. | The person’s access list before and after the change. | If the list dated after each of three role changes no longer holds what only the old role needed. | The CISA and NSA guide says “long-term users tend to accumulate privileges as their roles change” when role changes lack adequate management; the test is ours. |
Checks 10 to 12: Leavers and Reviews
An access review checks who holds access and whether each person still needs it, and it carries a date.
These three checks cover leavers, that review and who approved a grant.
| Check | Evidence to keep | Pass test | Basis |
|---|---|---|---|
| 10. When a person leaves, every account closes by the date HR holds as the leaving date. | The HR leaver list, as well as each account’s disabled date. | If each of three leavers drawn from the HR list shows every account disabled on or before the HR leaving date. | The CISA and NSA guide says a leaver’s accounts and privileges “must be promptly terminated”, while the date test is ours. |
| 11. A named person has reviewed who holds access, and the result carries a date. | The review record, including the reviewer, the date and the removals made. | If the latest record names a reviewer who does not own the accounts, carries a date, and shows every removal it lists as done. | NCSC advises reviewing user accounts and systems for unnecessary privileges, and gives no interval; the owner, the record and the done-test are ours, and your firm picks the interval and writes it down. |
| 12. When access is granted, the record names who approved it. | The request or approval record, including its date, for each sampled grant. | If each of three recent grants drawn from the account list shows a named approver and a date. | Our check. |
Identity and Access Management Checklist, Checks 13 to 16: Records and Ownership
The final four checks look at the trail that access leaves behind.
Checks 13 and 14: Logs and an Owner
| Check | Evidence to keep | Pass test | Basis |
|---|---|---|---|
| 13. When someone signs in or a permission changes, the log entry names the person or account. | A log extract, including the sampled events. | If three sampled events, one sign-in and two permission changes, each show who or what did them. | NCSC says authentication and authorisation events should be logged and monitored, and that actions should be associated with the person or account, but the sample is ours. |
| 14. One named person owns how access is handled, including the run of this checklist. | The policy or a role note, including that person’s name. | If that person confirms the role and has run or signed the latest run of this checklist. | Our check. |
Checks 15 and 16: Exceptions and the Last Run
| Check | Evidence to keep | Pass test | Basis |
|---|---|---|---|
| 15. If an exception to the access rules exists, it has an approver and an end date. | The exceptions list, including each approver and end date. | If every sampled exception shows an approver’s name and an end date still ahead. | Our check. |
| 16. When a previous run exists, its score sheet is on file and each Fail on it has an owner. | The filed sheet, as well as the fix list. | If that sheet is on file and each Fail on it shows an owner and a current status. | Our check. |
Where to Start Fixing: Your Identity and Access Management Checklist Result
Read the groups in this order, which is our view and not a standard. Who Holds Access comes first, since a review or closure that starts from the list does not reach an account missing from it. Sign-In follows, then Rights, Leavers and Reviews, and Records. Inside a group, work through the Fails before the Partials.
Next to each Fail, note the person who will fix it, the change to make and when the next test is due. Check 16 also keeps that trail. If two Fails both look urgent, sizing a wider risk can settle which one starts. Set a date to run the identity and access management checklist again. File the new sheet beside the old one. If you want a shorter set of quick checks before the full run, the use-case page has one.
Key Takeaway A sum can look fine while one group has failed outright.
Who Else Should Look at Your Scores, and What Is Left Out
In our view, a second opinion is worth having if your Fails are spread over several groups. It also helps when nobody can say who owns a given account. Another case is a customer or auditor asking for access records in a format you do not yet hold.
The checklist does not explain why access gets out of hand. It also sets out no order of work and compares no tools. To compare tools, read supplier questions and a five-test pilot. For the order of work, read nine ordered steps for bringing accounts under one set of rules. It covers no machine or service accounts, no supplier access and no law or regulation. NCSC is UK guidance, while the CISA and NSA guide and NIST are US guidance. This page uses all three for ideas, not as standards to comply with. Even a full score shows only that the sampled accounts met every test that applied.
Signisys helps organizations control who can access what, with single sign-on, strong authentication, privileged access and automated provisioning. Signisys settles the scope separately for each engagement. Our Solution: Identity and Access Management (IAM). Our Service: Cybersecurity Services.
Identity and Access Management Checklist FAQ
What should an identity and access management checklist include?
How is the score worked out?
What does a score of 32 actually show?
What comes first when several groups have Fails?
Can I get this as a spreadsheet or template?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.