Resources
Written to be used, not filed.
The assessment instrument we score identity risk with, published in full, plus the regulatory changes that actually reach access — both mapped to controls you can implement rather than frameworks you can cite.
The Regulated IAM Assessment Guide
The instrument we score identity risk with, published in full — a weighted ten-category taxonomy, a 0–4 scoring model, a US–Canada control crosswalk with an evidence query for every line, and the artifacts assessors sample first.
Published in 3 sector editions · 10 shared categories · pick your sector on the download form
Get the guide → Workbook + web tool · no signupUser Access Review Template
A working access review workbook, and the 40 questions auditors ask about it — each mapped to the clause in 15 US, Canadian and international frameworks. Built around the failures that sink performed reviews: unproven populations, self-review, rubber-stamping and revocations that never happened.
40 auditor questions · 15 frameworks · clause-level, checked at source
Get the template → Interactive · no signupIAM Self-Assessment Scorecard
Score your own estate against the same ten weighted categories the guide uses, on the 0-4 behavioural scale. Pick your sector and the weights change with it; the total, the band and your widest gaps update as you go.
10 categories · weighted for your sector · runs entirely in your browser
Score your estate → Always growingvaultKEY
Unlocking the essential IAM news that matters — what replaced the FFIEC CAT, HIPAA Section 164.312 evidence kits, NHI ownership models, NYDFS-to-Entra MFA mappings, and the US–Canada crosswalk. Written to be implemented, not skimmed.
What changed, what it means for IAM, and what it takes to implement
Read vaultKEY →The Assessment Guide is published in three sector editions because the ten risk categories are shared but the weights, instruments and artifacts are not. You choose yours on the download form — or read what separates the three first.