Citizen data, contractor identities, long system lifetimes
Public sector systems outlive the contracts that built them. Integrator identities, migration accounts and legacy automation persist across administrations, and offboarding processes built for staff rarely cover the non-human identities a program created.
“Which contractor and system identities still hold access they no longer need?”
How the risk takes shape.
Contract boundaries are not identity boundaries
A contract ends. The service principal the integrator created does not. Nothing in the procurement lifecycle enumerates the identities a program introduced or removes them at closeout.
Control families ask reach questions
AC-2, AC-3 and AC-6 are least-privilege and account-management controls. Evidencing them requires showing what each account can reach, which is a graph traversal rather than a directory export.
Long lifetimes accumulate authority
Systems that run for a decade collect a decade of access grants. Each was reasonable when made; the accumulated set is what an assessor evaluates.
What we look for first.
These are structural patterns this operating model tends to produce — not findings from any particular organization. They are where an assessment starts, because the architecture makes them likely.
Whether they are present in your estate is an empirical question. That is the point of looking.
- Integrator and migration identities that survived contract closeout
- Shared service accounts with no individual accountability
- Cross-agency federated trusts with permissive subject claims
- Legacy automation holding elevated directory roles for a task that ended years ago
- Identities with no recorded owner across systems still in production
Evidence, in your framework's language.
The reach set
Every identity that can reach your citizen pii, with the path each one takes — direct, inherited, nested, eligible or federated.
Control-mapped findings
Findings tied to the control families you evidence against — NIST SP 800-53 and FedRAMP — with the underlying facts attached.
One ranked decision
Not a backlog. The single highest-consequence move, with its projected outcome labeled as projected and its evidence trail intact.
Test these patterns against your own estate.
A scoped, read-only assessment on a subscription you choose. We answer the question above with your numbers, and tell you plainly where we could not determine something.
Free forever on a bounded estate · 30-day trial unlocks everything · No credit card
Read-only access · No agents · No log ingestion · Azure generally available