Identity and access decision guide
MFA helps protect sign-in. It does not govern every identity decision.
Multi-factor authentication can be an important safeguard. It does not decide who should have access, how access is approved, which accounts are privileged, how accounts change when people or vendors change, or how the organization can show that its access decisions are still current.
Identity governance turns those questions into repeatable operating work.
Six questions beyond MFA
Who owns the identity record?
Define the authoritative source for workers, service accounts, guests, vendors, administrators, and other identities. An access program becomes difficult to govern when no one can tell which record is current.
How does access begin, change, and end?
Document the approval, provisioning, modification, suspension, and removal steps that apply when a role, employment relationship, provider relationship, or business need changes.
Which access is privileged?
Identify elevated access, who approves it, how it is used, how it is reviewed, and what happens when the use is unexpected. Privilege should have a clear owner and an escalation path.
How are exceptions handled?
Temporary, emergency, shared, service, and legacy access often exists for a reason. Each should have a documented purpose, owner, expiration or review point, and a way to determine whether it is still needed.
What reviews prove the current state?
Use access reviews, activity records, change records, and exception decisions to test whether permissions still match the business need. A feature being enabled is not evidence that the governing process is operating.
Who acts on a finding?
Define who can investigate an anomaly, remove access, approve an exception, accept risk, and communicate the result. Governance is clearer when the intervention authority is known before an issue occurs.
eTrepid's role
Within an agreed scope, eTrepid can help design, implement, integrate, manage, and support defined identity and access practices. The client retains responsibility for its people, roles, approvals, policies, business decisions, risk acceptance, and operating outcome. eTrepid does not guarantee that an identity program will prevent every unauthorized activity or meet every requirement.
Sources and limits
This candidate uses NIST CSF 2.0 as voluntary organizing context, particularly its emphasis on governance, roles, and responsibilities. It is general information, not a security assessment, certification conclusion, legal advice, or assurance that a given identity design is sufficient.
Related: /threatkrusher/access/ · /cmmc-grc/ · /threatkrusher/command/