Identity Management

Identity Management

Our Identity Management Policy establishes a framework for managing user identities, access privileges, and authentication mechanisms to minimize unauthorized access, data breaches, and insider threats. By implementing robust identity management practices, we aim to protect our systems and data, maintain regulatory compliance, and strengthen our overall cybersecurity posture.

Scope

This Identity Management Policy applies to all employees, contractors, and stakeholders, and covers the management of user identities, access privileges, and authentication mechanisms within Safire’s IT infrastructure.

Policy

To achieve Safire’s overall mission and the purpose of this policy, Safire shall adhere to the following controls:

Workforce Lifecycle (HR Process Ownership / Compliance Authority)

• HR Program Management: Maintain a Human Resources (HR) program to formally manage Safire’s workforce members.
• Tracking System: Maintain a Human Resources Information System (HRIS) to track the active/inactive status of every workforce member.
• Screening: The HR program shall perform mandatory background screening for each workforce member prior to granting access to Controlled Unclassified Information (CUI) or sensitive systems. (Basic email access may be granted pending final clearance at the discretion of the CISO).
• Contractual Obligation: Workforce members must agree to Safire’s terms and conditions of employment and Acceptable Use Policy prior to receiving access.
• Asset Return: A strictly enforced process must exist for workforce members to return physical assets (laptops, keys, badges) immediately upon termination.
• Credential Revocation: A mandatory process must exist to revoke authentication credentials within 24 hours of the conclusion of work or termination.

Identity Provider (IDP) Management (IT Process Ownership / CISO Authority)

• IDP Inventory: Maintain an authorized inventory of each Identity Provider (IDP) Safire approves.
• Centralization: Minimize the number of IDPs in use and utilize centralized Single Sign-On (SSO) solutions whenever technically feasible.
• Account Inventory: Maintain an accurate inventory of each user account authorized by the IDP.
• Configuration Benchmarks: Maintain a security configuration benchmark for each of Safire’s authorized IDPs.

Access Control & Configuration Standards

• No Account Sharing: IDP configurations must prevent workforce members from sharing accounts.
• Concurrent Logins: IDP configurations shall restrict or flag concurrent account logins where appropriate.
• Reuse Prevention: IDP configurations shall prohibit the reuse of account names within a defined period.
• Identity Reviews: The Compliance Department shall perform quarterly identity reviews of each IDP to ensure only authorized accounts exist.
• Automated Provisioning: Maintain an identity management system to provision accounts for workforce members only after they are officially entered into the HRIS.
• Automated De-provisioning: The identity management system shall automatically deprovision or disable accounts within 24 hours when a workforce member is tagged as inactive or terminated in the HRIS.

Authentication Security

• Password Strength: IDP configurations must enforce strong password complexity requirements (Minimum 12 characters).
• Account Lockout: IDP configurations must trigger account lockouts if a defined threshold of failed login attempts is exceeded.
• Password Storage: Passwords must be stored encrypted and hashed using salts.
• Encryption in Transit: Passwords must be transmitted only over encrypted channels (TLS 1.2+).
• Multi-Factor Authentication (MFA): Mandatory use of Multi-Factor Authentication (MFA) for all access to Safire’s Identity Providers, remote access solutions, and cloud environments.

Lifecycle & Auditing

• Inactivity Timers: Unused accounts must be automatically disabled after a defined period of inactivity (e.g., 90 days) and/or enforce expiration dates on temporary accounts.
• Logon Logging: IDP configurations must require logging of all logon events (success and failure).
• Deactivation Logging: IDP configurations must require logging of any attempted access to deactivated accounts.

Compliance

Compliance Measurement

The policy owner will verify compliance through methods such as business tool reports and internal and external audits. Oversight is provided by CISO, IT, and Compliance functions. Enforcement of this policy is coordinated through Human Resources and Executive Management.

Exceptions

Any exceptions must be approved by the Policy Owner in advance.

Non-Compliance

Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

Related Standards, Policies, Plans, and Procedures

• Password Construction Policy
• Password Protection Policy
• Employee Offboarding Procedures

Referenced Terms

CUI

Information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies.

Revision History

2026-08-20 — Darren Rush

Merge pull request #2 from safire-dev/dev (16cb681)

Edit this Page