<img src="https://ws.zoominfo.com/pixel/6169bf9791429100154fc0a2" width="1" height="1" style="display: none;">
Curious about how StrongDM works? 🤔 Learn more here!
Search
Close icon
Search bar icon

The Annual Access Audit Survival Guide

StrongDM manages and audits access to infrastructure.
  • Role-based, attribute-based, & just-in-time access to infrastructure
  • Connect any person or service to any infrastructure, anywhere
  • Logging like you've never seen

So, you’ve decided to conduct an annual access audit. Now comes the obvious question: where do I start? Just like you wouldn’t embark on a mountain climbing excursion without a clear understanding of the terrain and gear you need, the starting point for an annual access audit requires an understanding of the process, people, and tools you’ll need to get started. Let’s go!

Step 1: Role Discovery

The starting point for every access audit is identifying and validating the roles you have in your organization. This process defines:

  • The company's employee structure
  • Each team's structure
  • Initial analysis of access available to each role

Technical staff, such as the IT or infrastructure engineering team, are usually responsible for technology roles and planning. However, everyone needs to be involved in this process. If the organization doesn't take the time to plan access upfront, it may end up providing too little or too much access to employees, which can lead to security issues.

While it may be easy to start with job titles and access needs, it is worth noting that there will be cases where a specific job needs the access to multiple roles. 

Step 2: Inventory your stack

After you’ve compiled the full list of roles in your organization, you’ll need to pull together a full list of the tools and technologies in your tech stack. If you skip this step, you’ll find that tools may exist outside of security and IT purview, increasing your overall breach surface.

Similar to the above, this is a collaborative process that defines:

  • Tools and technologies in your tech stack
  • Current and future usage of each tool
  • Understanding of data and sensitivity of each tool

Step 3: Access: Role Alignment

Once you've completed the discovery phase, you must align each role to the required access. The key questions to ask in this phase are:

  • Does this role really need access to this tool?
  • Is every tool still in use? What can be retired or deprecated?
  • What is the appropriate level of access based on the sensitivity of data or the criticality of each tool?

Infrastructure administrators must identify who has access to all resources, including files, databases, Kubernetes clusters, and servers, for example. This step is foundational to implementing just-in-time access and zero-standing privileges. The information gleaned from this step will help define access and when it’s needed. 

Aligning Access: Slices, Roles, And Test Cases

Users need different access to various systems and information to do their jobs. Slices are the specific use cases for access, Roles are the groups of Slices related to specific job responsibilities, and Test Cases are the plan you make to ensure everyone has the access they need to do their jobs safely and securely. Let’s break those down further:

  • "Slices" are like the tools and equipment needed for each part of the climb. Each Slice is a specific task or use case that requires access to certain systems or information. 
  • "Roles" are like each climber's jobs or responsibilities on the mountain. Different people in an organization have different Roles based on their job responsibilities. Each Role is a group of Slices related to a specific task or responsibility. For example, the IT administrator might have a Role that includes Slices for managing servers and databases. In contrast, the marketing team might have a Role that includes Slices for creating and managing campaigns.
  • "Test Cases" are like practice hikes you would run to prepare for scaling a mountain. When setting up access audits, you must map out who needs access to what systems and why. Test Cases are real-world examples that specify who needs access to what information or systems and why they need that access. Test Cases validate the Slices and Roles and ensure everyone has the access to do their jobs safely and securely.

Access discovery can take time, especially if your organization grows rapidly, resulting in a complex and distributed IT infrastructure. However, getting a clear picture of your infrastructure and performing a yearly check-up is essential to reducing risk.

Part 4: Building your annual access muscles 

Conducting an access audit for the first time can be daunting, but there are steps you can take to simplify the process. Start by setting clear objectives and goals for the audit, such as identifying all the access points to your infrastructure or assessing the effectiveness of your existing access management policies. Establish clear milestone goals on the calendar and track your progress against those goals.

After conducting the audit, update it regularly to reflect any changes in your infrastructure or workforce. For instance, if you onboard new employees or migrate to a new cloud provider, you must update your access policies accordingly. Regularly performing an audit ensures that you're always up-to-date with the latest changes in privileges and assures the team that the access management policies remain effective.

Need Help Getting Started?

The annual access audit is a best practice for IAM teams. 

If you need help getting started, we have a webinar for that. Or if you learn more by doing, we have a free access workbook to help you get the ball rolling. 

​​This workbook includes the following:

  • The steps required to run a Role & Access Discovery project
  • Tabs that you can use to track the who, what, roles, and slices of roles and access
  • Example test cases that show how you can attempt to match the case to the best role

Once you wrap up your annual access audit, you’ll need to consider how you implement the changes. At this point in the process, many enterprise organizations seek the help of a Zero Trust Privileged Access Management (PAM) platform (like ours 😎) to help manage all of that access. We can implement and execute the necessary changes based on your findings. Think of us as your seasoned guide to editing access; a knowledgeable and experienced local who knows the environment like the back of their hand. Book a demo. 


About the Author

, Content Manager, Angela supports the marketing team by developing creative content that helps StrongDM tell its story in creative and authentic ways. Experienced in the advertising agency space and the consulting world, Angela spent her early career years serving as a client-facing writer and project manager for brands large and small. Her specialties range from brand development and strategic campaign planning to social media execution and long-form content production. Angela obtained her Bachelor of Science in Business Administration from the University of Tulsa. She majored in Marketing and Management and completed minors in Advertising and Communications during her time at TU. To contact Angela, visit her on LinkedIn.

StrongDM logo
💙 this post?
Then get all that StrongDM goodness, right in your inbox.

You May Also Like

Securing Network Devices with StrongDM's Zero Trust PAM Platform
Securing Network Devices with StrongDM's Zero Trust PAM Platform
Let’s talk about the unsung heroes of your on-premises infrastructure: network devices. These are the routers, switches, and firewalls that everyone forgets about…and takes for granted—until something breaks. And when one of those somethings breaks, it leads to some pretty bad stuff. If your network goes down, that’s bad, bad, bad for business. But if those devices lack the necessary security, well, that can leave you exposed in an incredibly dangerous way.
What Is Zero Trust for the Cloud? (And Why It's Important)
What Is Zero Trust for the Cloud? (And Why It's Important)
Zero Trust cloud security is a cybersecurity model that operates on the principle that no user, device, system, or action should be trusted by default — even if it's inside your organization’s own network. This approach minimizes the risk of breaches and other cyber threats by limiting access to sensitive information and resources based on user roles, device security posture, and contextual factors.
How to Prevent Password Sharing in Healthcare
How to Prevent Password Sharing in Healthcare (8 Ways)
Protecting sensitive patient data in healthcare isn't just a priority—it's a legal and ethical obligation. However, one of the most overlooked security gaps that healthcare organizations face is the practice of password sharing among employees. This seemingly harmless habit can quickly lead to unauthorized access and serious data breaches, putting both the organization and patients at risk. While often seen as a convenient shortcut, password sharing undermines the security of protected health information (PHI), potentially leading to HIPAA violations and data breaches. In this post, we'll explore eight effective ways to prevent password sharing in healthcare.
What Is Privileged Identity Management (PIM)? 7 Best Practices
What Is Privileged Identity Management (PIM)? 7 Best Practices
Privileged Identity Management (PIM) is a complex cybersecurity approach. But it’s the only proven method you can use to lock down access and protect your precious resources. It can help you keep cybercriminals out and ensure that even your trusted users can’t accidentally—or intentionally—jeopardize your system’s security.
What Is Zero Trust Data Protection?
What Is Zero Trust Data Protection?
Zero Trust Data Protection isn't just the best way to safeguard your data — given today's advanced threat landscape, it's the only way. Assuming inherent trust just because an access request is inside your network is just asking for a breach. By implementing the latest tactics in authentication, network segmentation, encryption, access controls, and continuous monitoring, ZT data security takes the opposite approach.