Identity & Access Management: Top 10 Must-Do Actions
Essential Actions to Protect Your Most Critical Security Perimeter
CyberCQR Top 10 | January 2026 | 5 minutes reading time
Why Identity Is Your New Perimeter
In cloud-first, remote-work environments, identity has become the primary security perimeter. Stolen credentials were the most common way in, at 22% of breaches in Verizon's 2025 Data Breach Investigations Report. Organisations that implement these 10 actions sharply reduce identity-based breaches and enable secure remote work at scale.
1. Mandate Multi-Factor Authentication (MFA) for ALL Accounts
What to do:
- Require MFA for all users, all systems, no exceptions (including executives)
- Prioritise phishing-resistant MFA: FIDO2, hardware keys, Windows Hello for Business
- Ban SMS-based MFA for sensitive systems (vulnerable to SIM swapping)
- Implement push notification MFA with number matching as minimum baseline
- Monitor and enforce MFA adoption across all cloud services and applications
Impact: Microsoft reports that MFA blocks more than 99.9% of automated account-compromise attacks.
2. Implement Passwordless Authentication Where Possible
What to do:
- Deploy FIDO2 security keys for high-value users (executives, IT admins, finance)
- Enable Windows Hello for Business on all Windows devices
- Implement biometric authentication (fingerprint, facial recognition) where supported
- Use passkeys for supported applications and services
- Establish timeline to eliminate passwords entirely within 24 months
Impact: Passwordless authentication eliminates password-based attacks (phishing, credential stuffing, brute force). It also cuts helpdesk password reset requests.
3. Deploy Privileged Access Management (PAM) for Admin Accounts
What to do:
- Implement PAM solution for all privileged accounts (IT admins, database admins, cloud admins)
- Require Just-in-Time (JIT) access - elevate privileges only when needed, for limited time
- Enforce approval workflows for privileged access requests
- Record and monitor all privileged sessions for audit and incident investigation
- Rotate privileged credentials automatically (daily or per-session)
Impact: Admin accounts are the most valuable accounts an attacker can take. PAM limits their use and records it for investigation.
4. Implement Continuous Identity Verification (Zero Trust)
What to do:
- Deploy conditional access policies that verify identity signals every access attempt
- Assess risk based on: device health, location, network, user behaviour, resource sensitivity
- Require step-up authentication for anomalous access patterns or high-risk actions
- Block access from non-compliant devices or suspicious locations
- Implement session timeouts and re-authentication for sensitive data access
Impact: Continuous verification detects compromised accounts in real-time. Organisations reduce breach dwell time from 200+ days to hours.
5. Enforce Least Privilege Access Across All Systems
What to do:
- Conduct access review: Who has access to what? Is it still necessary?
- Remove excessive permissions - users should have only what they need for their job
- Eliminate standing privileges - use Just-Enough Access (JEA) principles
- Implement role-based access control (RBAC) with clearly defined roles
- Quarterly access certification: Force managers to re-approve team access
Impact: Most users build up more access than their role needs. Least privilege sharply reduces the blast radius of compromised accounts.
6. Protect Board and Executive Identities as High-Value Targets
What to do:
- Issue hardware security keys (YubiKey, Titan) to all executives and board members
- Separate business and personal email/social media accounts completely
- Implement executive protection program: threat monitoring, persona management
- Provide social engineering awareness training specific to executive targeting
- Monitor dark web for executive credential leaks and impersonation attempts
Impact: Executive accounts are high-value targets. Compromise enables wire fraud, data theft, and reputational damage.
7. Implement Identity Governance and Administration (IGA)
What to do:
- Automate identity lifecycle: onboarding, role changes, offboarding
- Deprovision access immediately when employees leave (not "eventually")
- Implement automated access requests and approvals (self-service where appropriate)
- Maintain single source of truth for identity (HR system as authoritative source)
- Monitor orphaned accounts and credentials for dormant identities
Impact: Accounts for former employees often stay active. IGA eliminates this risk and reduces provisioning time from days to hours.
8. Deploy Identity Threat Detection and Response (ITDR)
What to do:
- Monitor identity systems for anomalous behaviour: impossible travel, unusual access patterns
- Detect credential abuse: password spray attacks, brute force, credential stuffing
- Alert on privilege escalation attempts and lateral movement
- Implement automated response: suspend accounts, require re-authentication, block access
- Integrate identity logs with SIEM/SOAR for correlation with other security events
Impact: ITDR spots signs of a compromised account that traditional monitoring misses. Automated response contains breaches before lateral movement.
9. Secure Federation and Third-Party Identity Integration
What to do:
- Implement single sign-on (SSO) with SAML 2.0 or OpenID Connect
- Centralise authentication through identity provider (IdP) - don't scatter credentials
- Validate third-party identity providers before trusting federation
- Monitor federated access for anomalies and misuse
- Implement break-glass procedures for identity provider outages
Impact: SSO reduces password fatigue and shadow IT. A central identity provider gives one place to see and stop a compromised account.
10. Conduct Regular Identity Security Assessments
What to do:
- Quarterly access reviews: Audit who has access to what and why
- Annual penetration testing focused on identity: credential attacks, privilege escalation
- Simulate phishing campaigns targeting credentials (monthly)
- Scan for weak passwords across all systems (eliminate passwords < 15 characters)
- Review identity infrastructure for misconfigurations and vulnerabilities
Impact: Regular assessments identify privilege creep, orphaned accounts, and weak controls before attackers do.
Implementation Priority Matrix
| Priority | Actions | Timeline | Impact |
|---|---|---|---|
| CRITICAL (Month 1) | 1. MFA for all 6. Executive protection |
30 days | Blocks most automated account attacks |
| HIGH (Month 2-3) | 3. PAM for admins 5. Least privilege 7. IGA automation |
60-90 days | Sharply reduces blast radius |
| MEDIUM (Month 4-6) | 4. Zero Trust / Conditional Access 8. ITDR 9. Federation/SSO |
4-6 months | Continuous protection |
| ONGOING | 2. Passwordless migration 10. Regular assessments |
12-24 months | Long-term excellence |
Identity is your new perimeter. Protect it accordingly.
Organisations implementing all 10 actions sharply reduce identity-based breaches and enable secure remote work at scale while meeting Zero Trust requirements.
About CyberCQR
CyberCQR provides strategic cybersecurity advisory services including Identity & Access Management strategy, Zero Trust architecture design, and privileged access management implementation.
Our Services Schedule IAM AssessmentDocument ID: IDENTITY-TOP10-001 | Version: 1.0 | Date: 06 January 2026 | Series: Top 10 for Identity & Access