Steps federal agencies can take to close access gaps, enforce least privilege, and align Identity, Credential, and Access Management (ICAM) capabilities with mission needs.
Mistakes happen. Sometimes, though, an adversary is deliberately looking for a way in, and an agency's access controls can determine how much damage that access allows.
Cybersecurity Awareness Month is a useful reminder that security depends on both the decisions people make and the systems that govern what they can access. For federal IT and cybersecurity leaders, that means looking beyond the login itself to the identity environment behind it.
An employee may authenticate securely and still have permissions that go beyond their current role. Perhaps temporary access was granted to complete a task, or an administrator added a user to an existing group rather than creating a more targeted permission. The change was meant to be temporary, but the access remained.
That gap between verifying an identity and controlling what it can do is an important ICAM challenge. Strong authentication helps establish who is requesting access; effective access management helps ensure that the identity has the right permissions, for the right purpose, and only for as long as necessary.
For federal agencies, addressing these gaps is part of building a stronger Identity, Credential, and Access Management (ICAM) strategy and advancing Zero Trust. But there is no single path that works for every agency. Existing Personal Identity Verification (PIV) investments, legacy applications, cloud services, and mission requirements all influence which capabilities to prioritize and how to implement them.
The goal is to identify where access controls fall short, choose capabilities that address those gaps, and improve them in an order that supports the mission.
Here are five areas federal IT and cybersecurity leaders can consider:
Close the gaps in phishing-resistant authentication
You need phishing resistant Multi-factor authentication (MFA) for agency staff, contractors and partners. That protection has to extend to the exceptions: applications with separate logins, mobile access and users managed outside the primary directory.
Adaptive access policies can weigh device posture and sign-in context to require additional verification or block risky access while maintaining required authentication protections.
You also need to know how many users have phishing resistant authentication, how many of them are privileged, and which exceptions remain. Protect enrollment and credential recovery as carefully as you protect everyday sign-in.
Extend enterprise identity to more applications
Standalone accounts in older systems and specialized mission applications make consistent policy and timely revocation harder to maintain. Start by inventorying applications by sign-on method, owner and mission priority. Use prebuilt application integrations wherever they're supported, and assess access gateways for legacy applications.
Measure the share of applications under centralized sign-on, and make sure high-value systems are clearly identified.
Limit privilege to the task
This always seems to be the simplest to discuss but the hardest to implement. It's also the easiest way to leave your agency exposed. Users end up holding more authority than they need. It is too easy to just add to established groups. Excess privilege is exactly what an adversary looks for. A stolen login is bad; a stolen login with admin rights is worse.
There's no better time than now to review privileges, with a tool or manually (great tools make it much more manageable though). Start with accounts that can change security policies or reach sensitive information. Define the tasks requiring elevation, approvals and access duration. Protect administrative credentials, separate routine and administrative activity, and retain controlled emergency access for recovery.
Finally, track the standing privileged assignments that remain, with a goal of eliminating them and check that temporary elevation expires as intended.
Bring machine identities and AI agents into ICAM
Start by identifying what currently exists. It sounds obvious, but many agencies work from assumptions about what they have rather than taking a hard look at what each credential supports, who owns it, and its permissions, expiration and dependencies. Service accounts, certificates and keys support applications automated processes and AI agents, but their ownership and dependencies can be overlooked until a credential expires or access must be revoked.
From there, establish renewal, rotation and revocation processes, automating where supported and testing changes to protect service continuity.
This work also lays groundwork for post-quantum preparation. A machine identity inventory is one part of the broader cryptographic inventory agencies will need to identify cryptography used in machine identities, user authentication, and digital signatures.
Measure the proportion of discovered machine identities and credentials with verified owners and document any gaps in discovery coverage.
Manage access changes and revocation
Agencies are moving toward lifecycle automation. Identity lifecycle management helps ensure that access is updated when people join, change roles or leave, using authoritative personnel and contract information to trigger account changes and revocation.
Role changes, contract endings and device compliance issues can all change whether access is still appropriate, and agencies need to act on them quickly and keep a record of what happened. Run scheduled access reviews and add reviews that are triggered by a change in role or risk. Test that revocation actually reaches downstream applications and active sessions where supported. Retain approvals, exceptions and revocation records as part of routine operations.
It is also a good idea to track access-review completion and elapsed time to revoke access so program owners can see whether decisions lead to timely action.
Choosing the right ICAM capabilities
As agencies begin or expand their ICAM programs, these capabilities can help address the gaps identified above. Agencies can prioritize one area or combine several, depending on mission requirements and their existing environment.
- Phishing-resistant authentication and adaptive access: extend strong authentication with policies that weigh device and sign-in context.
- Single sign-on, federation and access gateways: bring more applications, including legacy ones, under consistent policy.
- Privileged access and endpoint privilege management: support time-limited elevation and protected administrative credentials.
- Certificate, key and machine identity lifecycle: support discovery, ownership, renewal and rotation for nonhuman identities.
- Identity governance and lifecycle management: support access reviews, joiner/mover/leaver changes and timely revocation.
Take the next step in your ICAM strategy
Cybersecurity Awareness Month is a useful moment to identify the gaps in your identity and access controls and take the next step toward Zero Trust. Set an owner, define the outcome and measure progress at a pace that supports the mission. Mistakes will happen, and adversaries will try to take advantage of them. The goal is to make sure neither gets further than it should.
Talk with Merlin Cyber about your ICAM strategy. We'll help you see where gaps remain and which capabilities could fill them, on a timeline that fits your mission.
