Free tool · IAM maturity assessment
Score your identity risk in ten minutes.
The same instrument our consultants use, weighted for your sector. Ten categories on a 0-4 behavioural scale produce one IAM score out of 100. Everything stays in your browser — nothing is sent anywhere, and no result is shared.
1 · Who assesses you?
All three editions share the same ten categories. The weights differ, because what an examiner leans on is not the same in a bank as it is in a hospital.
2 · What the levels mean
Score what is true today, not what the policy says. Every level names an observable state, which is what makes two people scoring the same estate land in the same place.
- 0
- Absent. The control does not exist. No owner, no process, nothing to sample.
- 1
- Ad hoc. It happens when someone remembers. No schedule, no record, no coverage claim you could defend.
- 2
- Defined. Written down and owned, but executed manually and unevenly. Coverage is asserted rather than measured.
- 3
- Enforced. The platform enforces it. Exceptions exist but are registered, time-bound and reviewed.
- 4
- Evidenced. Enforced, and the evidence is produced on demand from the system of record — not rebuilt by hand for the auditor.
3 · Score each category
- ×13
Privilege
1. Standing privilege
Who holds administrative rights right now, without asking anyone?
- ×13
Access
2. Authentication strength
What does it actually take to become a user — and to become an admin?
- ×11
Lifecycle
3. Joiner–mover–leaver
How long does access outlive the reason it was granted?
- ×11
Lifecycle
4. Access certification
When someone attests that access is correct, what did they actually see?
- ×11
Privilege
5. Non-human identity
Which service accounts, keys and workloads can act, and who owns each?
- ×10
Access
6. Third-party access
What can a vendor reach, for how long, and under what agreement?
- ×8
Control
7. Segregation of duties
Which single identity can start and finish a consequential action alone?
- ×7
Control
8. Emergency access
When normal access fails, what is used instead — and is it ever tested?
- ×9
Detection
9. Identity telemetry
If an identity were abused tonight, what would show it, and who would look?
- ×7
Privilege
10. Secrets hygiene
Where do credentials live outside the vault, and how old are they?
Weighted total
0/100
Where you are losing the most points
Ranked by weighted points forgone, not by raw score — a 2 in a category worth 14 costs you more than a 1 in one worth 6.
The number is not the deliverable — the category profile is. It exists to make movement measurable between assessments, and to start a conversation about the three rows above.
Your answers stay in this browser. Nothing is transmitted, and we cannot see your score. Clearing site data or switching device removes it.
Now go find the evidence.
A score tells you where you stand. It does not tell you what an assessor will ask for, or what you can actually produce today. That is what the guide is for.
- An evidence query for every category you scored 2 or below — the one you run, not the policy you cite
- A control crosswalk across US and Canadian instruments, each carrying its edition and verification date
- The six artifacts assessors sample first, and how each one is tested
- Remediation ordered by risk reduction per engineering hour, not by severity
Includes the same scorecard as a printable worksheet · 20 pages · PDF
Get the Compliance-dependent sectors edition
Work email only. We check the domain accepts mail before the download unlocks.
The guide has opened in a new tab.
If your browser blocked it, open the guide.