IARisk domain
Identity and access
Identity and access covers how people authenticate and what they are entitled to: credentials, MFA factors, privileged roles, group memberships and standing access to consoles. The domain joins leaked or attacked credentials to the privilege behind them. It also records the habits that decide whether a stolen password works: factor strength, password reuse, SSO use and how a person responds to repeated MFA prompts. Signals come from the identity provider, the governance system and breach-exposure feeds.
Classification
- Dimensions Every signal answers one of 3 questions.
- Evidence levels
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- PR.AA-01
- PR.AA-03
- PR.AA-05
- ID.RA-03
- MITRE ATT&CK
-
- TA0006 Credential Access · T1078 Valid Accounts, T1110 Brute Force, T1621 MFA Request Generation, T1098 Account Manipulation
Credential abuse is the step that turns a lure into an account takeover, and VERIS records it under the Hacking action. Identity is where a behavior becomes an incident, so four of the eleven sequences in this model end in account takeover.
Three dimensions in identity and access.
- Threat7 signals
- Threat is a credential or identity under attack or already exposed: leaked in a public breach, flagged as compromised, offered on the dark web, hit by malicious login attempts or stolen as a session token.
- Access5 signals
- Access is the privilege a compromised identity would carry: admin roles, privileged security groups, standing console access, unused entitlements and third-party or contingent identities.
- Behavior13 signals
- Behavior is MFA and password practice: removing a factor, sharing or exporting credentials, reusing passwords, approving repeated MFA prompts and signing in from unusual contexts on the risky side; enrolling phishing-resistant MFA, using a password manager, SSO and passwordless sign-in on the vigilant side.
Signals
25 signalsScroll sideways to see every column.
Headline metrics and grade bands
4 metricsA to F bands for the numbers a program reports in this domain. Bands marked "framework benchmark" are authored targets until the HRM Benchmark publishes measured values.
Scroll sideways to see every band.
| Metric | Unit | A | B | C | D | Anchor |
|---|---|---|---|---|---|---|
| M-IA-1Phishing-resistant MFA coverage | % of workforce | ≥ 95 | ≥ 85 | ≥ 70 | ≥ 50 | NIST CSF PR.AA-03; Framework benchmark |
| M-IA-2Privileged accounts on weak MFA | % of privileged accounts | ≤ 0 | ≤ 2 | ≤ 5 | ≤ 15 | DBIR 2026 credential-abuse share |
| M-IA-3Exposed credentials unresolved | % of people with a leaked credential open more than 7 days | ≤ 0 | ≤ 1 | ≤ 3 | ≤ 8 | Framework benchmark |
| M-IA-4Password manager adoption | % of workforce | ≥ 90 | ≥ 75 | ≥ 50 | ≥ 25 | Forrester HRM metrics |
Indicator library
74 indicators- I.0024Sends credentials through chat messages
- I.0047Accepts voice call MFA code requests over SMS
- I.0048Shares OTP or MFA codes via email or chat messages
- I.0049Approves suspicious or fraudulent MFA requests
- I.0105Logs into enterprise services using personal accounts
- I.0106Shows simultaneous logins from geographically distant IPs
- I.0107Continues using expired credentials for cloud access
- I.0108Avoids enterprise single sign-on
- I.0111Stores unencrypted credentials in shared cloud folders
- I.0127Uses root credentials for cloud administrative access
- I.0134Regularly uses browser password manager with MFA
- I.0138Misuses elevated privileges to access sensitive resources
- I.0139Abuses access privileges in ways that do not comply with policy
- I.0140Steals or harvests credentials using unauthorized tools
- I.0141Accesses protected resources from unusual locations
- I.0142Uses injected credentials to access protected resources
- I.0143Subverts access controls or disables auditing mechanisms
- I.0144Manipulates identity federation settings to bypass controls
- I.0145Configures persistence mechanisms to maintain unauthorized access
- I.0146Uses cached or stolen credentials to gain unauthorized access
- I.0147Relies on insecure or temporary credentials to maintain access
- I.0148Communicates with known threat actors
- I.0149Engages in activity inconsistent with approved roles
- I.0150Modifies or deletes identity policies to gain unauthorized access
- I.0151Accesses secrets or vaults in unauthorized or unusual ways
- I.0152Disables monitoring or logging to conceal unauthorized activity
- I.0153Uses weak or bypassed authentication methods to gain access
- I.0154Accesses protected resources at unusual volumes or frequency
- I.0170Signs into corporate apps from unapproved devices or locations
- I.0172Bypasses SSO to access SaaS platforms directly
- I.0173Accesses cloud applications exclusively via SSO
- I.0179Signs into SaaS applications with multi-factor authentication
- I.0295Logs in during unusual remote work hours
- I.0296Generates repeated remote login failures
- I.0297Shares corporate credentials with household members
- I.0306Reuses home network credentials on corporate systems
- I.0312Uses shared household accounts on corporate devices
- I.0313Establishes simultaneous VPN sessions from different locations
- I.0314Uses outdated or insecure VPN protocols
- I.0319Connects from unsecured or unknown Wi-Fi networks
- I.0329Restricts email use to enterprise-managed accounts
- I.0331Keeps personal and corporate accounts strictly separated
- I.0332Appears in recent breach with corporate email
- I.0333Appears in multiple breaches within recent time period
- I.0334Reuses exposed passwords across accounts
- I.0335Uses password pattern similar to exposed passwords
- I.0336Rotates credentials promptly after exposures
- I.0337Appears in infostealer logs with corporate cookies
- I.0338Exposes recovery codes or OTP seeds in stealer logs
- I.0339Exposes corporate OAuth tokens or refresh tokens
- I.0340Appears in stealer logs with browser auto-fill data
- I.0341Revokes exposed sessions and tokens within SLA
- I.0342Exposes API keys or cloud credentials in public repos
- I.0343Exposes SSH private keys or key material
- I.0344Removes exposed secrets within remediation SLA
- I.0345Exposes personal identifiers linked to corporate identity
- I.0346Exposes security questions and answers
- I.0347Exposes government ID images or numbers
- I.0348Appears in SIM-swap or account takeover chatter
- I.0349Requests takedown for personal data exposures
- I.0350Is impersonated by lookalike social or messaging accounts
- I.0351Is targeted in ransomware or extortion leak posts
- I.0352Is listed in company access for sale offers
- I.0353Reports impersonation promptly via official channels
- I.0356Removes public links and rotates exposed data quickly
- I.0357Publishes contact details enabling high-fidelity lures
- I.0358Suppresses public footprint of sensitive contact data
- I.0359Appears in breaches of critical third-party vendors
- I.0360Uses unique credentials across vendor portals
- I.0361Acknowledges breach-intel notifications within SLA
- I.0362Ignores breach-intel notifications beyond SLA
- I.0363Confirms credential reset for exposed accounts
- I.0370Exhibits SIM swap indicators
- I.0382Reports anomalies in SIM configuration on mobile device
Cohorts in this domain
6- Exposed credentials without strong MFA Targeted · IA-T-01 + not IA-B-08
- Admin who removed MFA High-impact · IA-B-01 + IA-A-01
- Credential sharer with privilege High-impact · IA-B-02 + IA-A-02
- Dormant privilege, unusual login High-impact · IA-B-04 + IA-A-03
- Keyholder with standing backup access and reuse Critical · IA-B-06 + IA-A-04 + IA-T-01
- Compromised account with privilege Critical · IA-T-07 + IA-A-01
Sequences that start here
3Cite this term
"Identity and access" (IA), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/domains/identity-and-access
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.