DefendArm SecurityDefendArm SecurityKnow your risks. Protect what matters.
Self-assessment

Identity control review

Check the access paths an attacker could use, including administrators, help-desk recovery, service accounts, and AI integrations.

IdentityAccess Control

0 of 6 answered

1. Are privileged sign-ins protected by enforced phishing-resistant authentication?

Review the enforced policy and exceptions. Registration of a security key alone does not prove enforcement.

2. Can you explain and remove unnecessary standing administrator access?

Review a current role export, approvals, and the last removal or expiry test.

3. Does offboarding remove active access, including sessions and direct SaaS accounts?

Use a test or recently departed account. Check sessions, direct logins, groups, and owned credentials.

4. Can the help desk reset MFA without relying only on a caller's story or voice?

Review the reset procedure and a recent test of a caller impersonating a user. Include executives.

5. Do service accounts, OAuth apps, and AI agents have owners and limited permissions?

Review the integration inventory, scopes, credential lifetime, and last access review.

6. Can protected emergency access work during an identity-provider outage?

Check credential custody, monitoring, and the last controlled sign-in test.

How to read the score

Use the gaps to plan the next test.

This self-review is not an audit, certification, or estimate of breach probability. Each answer earns 0, 2, or 4 points; unknown answers earn no points and are counted separately. The indicator gives equal weight to each question. Critical gaps are flagged separately so other answers cannot hide them.

View all assessmentsOpen the assessment index
Current stateScore against how the environment works today

Answer for the state you can prove now, not the state you plan to have after a future project lands.

InterpretationResolve unknowns and critical gaps first

Missing evidence is a reason to investigate. Assign an owner to each action, agree a test, and record the result before changing the answer.

Follow-throughRetest after the control changes land

The point of the assessment is to give you a before-and-after view that shows whether the next round of work actually improved the risk.