Skip to main content

5.1 Identity Management

5.1 Identity Management

  • User Lifecycle Management:

    • a. Provision unique identifiers for all users and devices.​

    • b. Deactivate user accounts after 1 year of inactivity.​

    • c. Disable local administrator accounts after 90 days of inactivity.​

    • d. Deactivate staging accounts (e.g., installadmin) after 7 days.​

  • Local Administrator Password Rotation (LAPS) (Applies to Endpoints):

    • e. Rotate dtcadmin user password at system boot, user login, and weekly intervals.​

    • f. Rotate built-in Administrator password at system boot, user login, and weekly intervals.​

  • g. Implement Multi-Factor Authentication (MFA) on critical systems where supported.​

  • Password Policy:

    • h. Adhere to the default password policies established by each identity provider (e.g., Active Directory).​

    • i. Collaborate with clients to develop customized password policies tailored to their specific security requirements and compliance obligations.​

  • Anomaly & Malicious Behavior Detection:
    • j. Review and analyze audit and event logs in order to respond to security incidents.

Technical Controls:

Control ID Description Tools/Methods
a Provision unique identifiers for all users and devices. DTC or Client Procured Identity Management Systems (e.g., Active Directory, Azure AD)
b Deactivate user accounts after 1 year of inactivity. DTC'SNinjaOne RMM, Microsoft Windows PowerShell, Internet Access
c Disable local administrator accounts after 90 days of inactivity. DTC'SNinjaOne RMM, Microsoft Windows PowerShell, Internet Access
d Deactivate staging accounts (e.g., installadmin) after 7 days. DTC'SNinjaOne RMM, Microsoft Windows PowerShell, Internet Access
e Rotate dtcadmin user password at system boot, user login, and weekly. DTC'SNinjaOne RMM, Microsoft Windows PowerShell, Internet Access
f Rotate built-in Administrator password at system boot, user login, weekly. DTC'SNinjaOne RMM,RMM, Microsoft Windows PowerShell, Internet Access
g Implement Multi-Factor Authentication (MFA) on critical systems. Microsoft Entra ID, Google Workspace, Cloudflare ZTNA Email
h Adhere to default password policies of identity providers. Configuration of identity provider settings; Regular policy reviews
i Develop customized password policies with clients. Consultation sessions; Quarterly business reviews; Policy development frameworks
j. Review and analyze audit and event logs in order to respond to security incidents. SaaS Alerts, Blumira Free Edition

Standard Operating Procedures

Control ID Description Tools/Methods
a Provision unique identifiers for all users and devices. DTC or Client Procured Identity Management Systems (e.g., Active Directory, Azure AD)
b Deactivate user accounts after 1 year of inactivity. DTC'S RMM, Microsoft Windows PowerShell, Internet Access
c Disable local administrator accounts after 90 days of inactivity. DTC'S RMM, Microsoft Windows PowerShell, Internet Access
d Deactivate staging accounts (e.g., installadmin) after 7 days. DTC'S RMM, Microsoft Windows PowerShell, Internet Access
e Rotate dtcadmin user password at system boot, user login, and weekly. DTC'S RMM, Microsoft Windows PowerShell, Internet Access
f Rotate built-in Administrator password at system boot, user login, weekly. DTC'S RMM, Microsoft Windows PowerShell, Internet Access
g Implement Multi-Factor Authentication (MFA) on critical systems. Microsoft Entra ID, Google Workspace, Cloudflare ZTNA Email
h Adhere to default password policies of identity providers. Configuration of identity provider settings; Regular policy reviews
i Develop customized password policies with clients. Consultation sessions; Policy development frameworks
j. Review and analyze audit and event logs in order to respond to security incidents. SaaS Alerts, Blumira Free Edition
Back to top