Available Controls

IAP comes with more than 100 off-the-shelf controls. These controls identify problems related to:

Data quality
Security policy violation
Compliance gaps such as access certification
Discrepancies through peer group and predictive analysis

These controls are part of the data model and are presented in each detail pane. They are also used to compute risk scores. You can use them in your own dashboards, reports, reviews and analytics. You can also search for errors through the search pages. (You will have to switch to "free search" and enable "show extended attributes" to do this.)

Sample advanced search using control results

Here is an extract of the available controls in IAP. Please consult "Settings → System → Manage Controls Execution" for an updated list of the controls available in your instance.

Control ID: ACC_01
Entity: Account
Name: Unused account
Description Unused accounts are defined as accounts that have not been used for at least 90 days or those that have never been used at all.
Risk Level: 1
Risk description: Unused accounts are, by definition, no longer monitored by their respective owners. These accounts can be hacked and used by an insider to impersonate an individual while engaging in fraudulent activity. Accounts can be unused if the account owner is no longer using the service, if the account owner is a contractor who no longer works for the company, or if the account is a test/service account that is no longer being used.
Remediation: Monitor the account's last login date. If the last login date is greater than 60 days (or if the account has never been used), notify the manager of the account owner to disable or delete it. The account owner's manager is in charge of enforcing the security policy within his scope of responsibility.

Control ID: ACC_02
Entity: Account
Name: Orphaned account
Description Active accounts identified as orphaned.
Risk Level: 1
Risk description: Orphaned accounts are neither assigned to an individual nor tracked as a service account. Therefore, they can be used by insiders, outliers or hackers to steal data or engage in rogue transactions.
Remediation: Reconcile the account or disable it if it is no longer being used.

Control ID: ACC_03
Entity: Account
Name: Active account whose owner has left the company.
Description An active account belonging to an identity who has left the company.
Risk Level: 4
Risk description: Accounts must be terminated upon the departure of their owner. Otherwise they can be used by a third party (insider, hacker) to compromise data or steal information.
Remediation: Verify that the owner has left the company and disable the account immediately.

Control ID: ACC_04
Entity: Account
Name: Password never expires
Description User account with a password that never expires.
Risk Level: 2
Risk description: User accounts with a password that never expires present a risk because once a password is shared, it can spread rapidly, exposing the assets of the company.
Remediation: Reactivate the password's expiration date.

Control ID: ACC_05
Entity: Account
Name: Password never expires - technical account
Description Technical account with a password that never expires.
Risk Level: 1
Risk description: Technical/service accounts with a password that never expires present a risk because once a password is shared, it can spread rapidly, exposing the assets of the company.
Remediation: Change the password on a regular basis or use a PAM solution to hide the password from users.

Control ID: ACC_06
Entity: Account
Name: Password never expires - orphan account
Description Orphaned account with a password that never expires.
Risk Level: 2
Risk description: Accounts with a password that never expires present a risk because once the password is shared, it can spread rapidly, exposing the assets of the company.
Remediation: Reactivate the password's expiration date.

Control ID: ACC_07
Entity: Account
Name: User password is too old.
Description Active user account with a password that has not been changed in the last 90 days.
Risk Level: 1
Risk description: Passwords must be changed on a regular basis to comply with security policies and mitigate account-hacking risk.
Remediation: For user accounts, verify whether or not the account is still being used. If not, disabled it. Otherwise, check the password policy and reactivate the password expiration policy.

Control ID: ACC_08
Entity: Account
Name: Abnormal login attempts
Description More than 20 unsuccessful login attempts have been detected on this account.
Risk Level: 4
Risk description: A high number of unsuccessful login attempts have been detected on this account. Someone (or a bot) may be attempting to hack into this account.
Remediation: Contact the account owner to investigate. Check account security (password strength) and enable MFA, if needed.

Control ID: ACC_09
Entity: Account
Name: Password not needed
Description Password is not needed to connect.
Risk Level: 2
Risk description: This account can be used without a password which can lead to security problems depending on the type of account.
Remediation: Reactivate authentication for this account.

Control ID: ACC_10
Entity: Account
Name: User password cannot be changed
Description User cannot change their password.
Risk Level: 2
Risk description: User accounts with a password that never expires or cannot be changed present a risk because once the password is shared, it can spread rapidly, exposing the assets of the company.
Remediation: Reactivate the password update capability for this account.

Control ID: ACC_11
Entity: Account
Name: Locked account
Description The account is locked.
Risk Level: 1
Risk description: Locked accounts need to be monitored because they can correspond to former users accounts with unsuccessful login attempts.
Remediation: Disable the account if it is no longer needed.

Control ID: ACC_12
Entity: Account
Name: No user name
Description The account does not have a username, only a login.
Risk Level: 1
Risk description: Accounts should be documented to help with auditing.
Remediation: Enrich the account information.

Control ID: ACC_13
Entity: Account
Name: Username inconsistency
Description The account last name does not match with the account owner's last name.
Risk Level: 1
Risk description: This account could have been reassigned which can lead to security issues if the account permissions have not been updated accordingly.
Remediation: Review account permissions.

Control ID: ACC_14
Entity: Account
Name: Technical account without a manager
Description A technical account without an account manager.
Risk Level: 1
Risk description: These are technical/service accounts that are not associated with an account owner. However, these accounts have sensitive access rights and, as a result, they should be associated with an account manager or business owner who is responsible for reviewing accounts and their permissions on a regular basis.
Remediation: Assign a business owner to this account.

Control ID: ACC_15
Entity: Account
Name: Extremely sensitive permissions
Description An account with a permission sensitivity level that is set to Extreme (4).
Risk Level: 2
Risk description: Accounts granting "extreme sensitivity" access rights should be carefully monitored.
Remediation: Verify that this account is not a standard user account. Review the account on a regular basis. Monitor account access.

Control ID: ACC_16
Entity: Account
Name: Sensitive permissions
Description An account with a permission sensitivity level that is set to High (3).
Risk Level: 1
Risk description: Accounts granting "high sensitivity" access rights should be carefully monitored.
Remediation: Verify that this account is not a standard user account. Review the account on a regular basis. Monitor account access.

Control ID: ACC_17
Entity: Right
Name: Overallocated right
Description The access right is not found in the "granted rights" list.
Risk Level: 2
Risk description: Overallocated rights means that access rights have been given to individuals without following a formal approval process. This can be due to an IT administrative error or direct system update. Because these rights are not approved, they can lead to fraud or data-leakage risk.
Remediation: Review the access right and remove it if it is not necessary. Update the table of granted rights.

Control ID: ACC_18
Entity: Right
Name: Atypical access right
Description Based on the analysis of an organizational peer group, this access right appears to be atypical.
Risk Level: 1
Risk description: Atypical access rights need to be monitored because they can correspond to stale access rights (access rights not removed when an individual moves from one department to another).
Remediation: Review the access right and remove it if it is not necessary.

Control ID: ACC_19
Entity: Right
Name: Atypical new access right
Description Based on the analysis of an organizational peer group, this new access right appears to be atypical.
Risk Level: 3
Risk description: Atypical new access rights need to be monitored because they correspond to new access rights for an individual who appears unusual in the organizational context. It could be an IT error.
Remediation: Review the access right and remove it if it is not necessary.

Control ID: ACC_20
Entity: Right
Name: Atypical access right next to a position update
Description Based on the analysis of an organizational peer group, this access right appears to be atypical.
Risk Level: 2
Risk description: Atypical access rights need to be monitored because they are unusual in the organizational context and the account user position just changed (organization). It could be a leftover access right.
Remediation: Review the access right and remove it if it is not necessary.

Control ID: ACC_21
Entity: Account
Name: Access to extremely sensitive folders
Description An account with folders whose sensitivity level is set to Extreme (4).
Risk Level: 2
Risk description: Accounts granting "extreme sensitivity" access rights should be carefully monitored.
Remediation: Verify that this account is not a standard user account. Review the account on a regular basis. Monitor account access.

Control ID: ACC_22
Entity: Account
Name: Access to sensitive folders
Description An account with folders whose sensitivity level is set to High (3).
Risk Level: 1
Risk description: Accounts granting "high sensitivity" access rights should be carefully monitored.
Remediation: Verify that this account is not a standard user account. Review the account on a regular basis. Monitor account access.

Control ID: ACC_24
Entity: Right
Name: Atypical folder right
Description Based on the analysis of an organizational peer group, this access right appears to be atypical.
Risk Level: 1
Risk description: Atypical access rights need to be monitored because they can correspond to stale access rights (access rights not removed when an individual moves from one department to another).
Remediation: Review the access right and remove it if it is not necessary.

Control ID: ACC_25
Entity: Right
Name: Atypical new folder right
Description Based on the analysis of an organizational peer group, this new access right appears to be atypical.
Risk Level: 3
Risk description: Atypical new access rights need to be monitored because they correspond to new access rights for an individual which seem unusual in the organizational context and the account user's position just changed (organization). It could be an IT error.
Remediation: Review the access right and remove it if it is not necessary.

Control ID: ACC_26
Entity: Right
Name: Atypical folder right next to a position update
Description Based on the analysis of an organizational peer group, this access right appears to be atypical.
Risk Level: 2
Risk description: Atypical access rights need to be monitored because they seem unusual in the organizational context and the account user's position just changed (organization). It could be a leftover access right.
Remediation: Review the access right and remove it if it is not necessary.

Control ID: ACC_27
Entity: Account
Name: Reactivated user account
Description A disabled account has been reactivated and the account is reconciled to an active identity.
Risk Level: 1
Risk description: Reactivated user accounts must be checked because they can be used by an insider to gain control of some systems if these accounts still have permissions.
Remediation: Review the account. Is the account owner returning from a long-term absence? Is he a contractor?

Control ID: ACC_28
Entity: Account
Name: Reactivated user account with inactive identity
Description A disabled account has been reactivated and the account is reconciled to an inactive identity.
Risk Level: 3
Risk description: Reactivated users accounts must be checked because they can be used by an insider to gain control of some systems if these accounts still have permissions. The identity is marked as inactive which means that the account owner is no longer part of the company.
Remediation: Review the account. Is the account owner returning from a long-term absence. Is he a contractor?

Control ID: ACC_29
Entity: Account
Name: Reactivated leaver account
Description A disabled account has been reactivated and the account is marked as being associated with a person who has left the company (leaver).
Risk Level: 3
Risk description: Reactivated user accounts for whom the account owner is marked as no longer being part of the company must be checked because they can be used by an insider to gain control of some systems if these accounts still have permissions.
Remediation: Review the account. Did the account owner return to the company? If this is the case, notify the HR department to update the HR repository.

Control ID: ACC_30
Entity: Account
Name: Reactivated technical account
Description A disabled account has been reactivated and account is marked as a technical account.
Risk Level: 2
Risk description: Reactivated technical accounts must be checked because they provide elevated privileges and can be used by an insider to gain control of some systems.
Remediation: Review the reason for the reactivation of the technical account with the account manager.

Control ID: ACC_31
Entity: Account
Name: Reactivated orphaned account
Description A disabled account has been reactivated and the account is orphaned.
Risk Level: 3
Risk description: Reactivated orphaned accounts have no reason to be reactivated because they can be used by an insider to gain control of some systems.
Remediation: Reconcile the account and review the reason for reactivation with the account owner/manager.

Control ID: ACC_32
Entity: Account
Name: An active leaver account used after the account owner's departure date (inactive user).
Description The account is active, but owner is inactive. The last connection date is more recent than the date of departure.
Risk Level: 4
Risk description: This account should have been revoked because the account owner has left the company. However, it appears that this account is still being used. Either the account password has been shared or the account has been hacked.
Remediation: Investigate by analyzing the account logs and disable the account.

Control ID: ACC_33
Entity: Account
Name: Active leaver account used after the account owner's departure date (leaver)
Description The account is active but the owner has left th company. The last connection date is more recent than the date of departure.
Risk Level: 4
Risk description: This account should have been revoked because the account owner has left the company. However, it appears that the account is still being used. Either the account password has been shared or the account has been hacked.
Remediation: Investigate by analyzing the account logs and disable the account.

Control ID: ACC_34
Entity: Account
Name: Revoked leaver account used after the account owner's departure date (inactive user)
Description The account is disabled and the owner is inactive. The last connection date is more recent than the date of departure.
Risk Level: 2
Risk description: This account has been revoked because the account owner has left the company. However, it appears that this account has been used after the account owner's departure date.
Remediation: Investigate by analyzing the account logs.

Control ID: ACC_35
Entity: Account
Name: Revoked leaver account used after the account owner's departure date (leaver)
Description The account is disabled and the owner has left the company. The last connection date is more recent than the departure date.
Risk Level: 2
Risk description: This account has been revoked because the account owner left the company. However, it appears that this account has been used after account owner's departure date.
Remediation: Investigate by analyzing the account logs.

Control ID: ACC_36
Entity: Account
Name: Account not used since its creation
Description The account creation date is the same as the account's last login date.
Risk Level: 1
Risk description: It seems that this account is not being used. It could be that this account was a test account, used only once, then forgotten.
Remediation: Investigate and disable the account.

Control ID: ACC_37
Entity: Account
Name: User with no department manager
Description The account is reconciled to an identity that belongs to a department with no active manager known.
Risk Level: 0
Risk description: The absence of a known active department manager could be an issue. If a company plans to delegate user account controls to department managers, this account won't be included in the control plan KPIs.
Remediation: Review your organizational tree and assign all departments to active managers.

Control ID: ACC_38
Entity: Account
Name: Identity with multiple active accounts in the same repository
Description Several accounts from the same repository are reconciled with the same identity.
Risk Level: 2
Risk description: Having multiple accounts in the same repository is a bad practice. It can be a way to evade Segregation of Duties (SoD) controls. Unless the user has several accounts for very good reasons (for instance an admin account, and a standard user account), those accounts should be merged.
Remediation: Verify that the user holds these accounts for good reasons. Otherwise consider merging the accounts and their respective permissions.

Control ID: ACC_39
Entity: Account
Name: Identity with multiple accounts in the same application
Description Several accounts from the same application are reconciled with the same identity.
Risk Level: 2
Risk description: Having multiple accounts in the same application is a bad practice. It can be a way to evade Segregation of Duties (SoD) controls. Unless the user has several accounts for very good reasons (for instance an admin account, and a standard user account), those accounts should be merged.
Remediation: Verify that the user holds these accounts for good reasons. Otherwise consider merging the accounts and their respective permissions.

Control ID: ACC_40
Entity: Account
Name: Inactive account whose owner left the company at least 2 years ago
Description This account is inactive, and is reconciled to a user who left the company at least 2 years ago.
Risk Level: 1
Risk description: Repositories should be cleaned up on a regular basis to avoid accounts sprawl on the systems. Inactive users accounts should be deleted after a quarantine period.
Remediation: Delete this account.

Control ID: ACC_41
Entity: Account
Name: AD or Azure account created more than 7 days after the identity's start date
Description This AD or Azure Account was created more than 7 days after the identity's start date.
Risk Level: 1
Risk description: Some repositories, such as AD or Azure, are associated with the identity lifecycle. If the account is created more than 7 days after the identity's start date, it could highlight the fact that the on-boarding process is not efficient.
Remediation: Verify if the account repository is associated with the identity lifecycle. If investigate why it took so long to create the account.

Control ID: GROUP_01
Entity: Group
Name: Group is empty
Description The group does not contain any accounts.
Risk Level: 0
Risk description: Empty groups should be removed if they are no longer being used to improve repository quality.
Remediation: Verify that the group is still being used. If not, delete it.

Control ID: GROUP_02
Entity: Group
Name: Group only contains deactivated accounts
Description All the accounts in the group are deactivated.
Risk Level: 0
Risk description: Legacy groups should be removed if they are no longer being used to improve repository quality.
Remediation: Verify if the group is still being used. If not, delete it.

Control ID: GROUP_03
Entity: Group
Name: Group contains circular references
Description Circular references are detected in the subgroups.
Risk Level: 2
Risk description: Circular references in subgroups can cause application outages (if they manage to retrieve all account subgroups without detecting circular references).
Remediation: Solve the circular reference issue.

Control ID: GROUP_04
Entity: Group
Name: Public group
Description The group contains all (100%) of the active accounts.
Risk Level: 0
Risk description: The public group should be reviewed on a regular basis to ensure that it does not provide access to sensitive information.
Remediation: Review group usage and permissions.

Control ID: GROUP_05
Entity: Group
Name: Group is almost public
Description The group contains 90% of the active accounts.
Risk Level: 0
Risk description: The public group should be reviewed on a regular basis to ensure that it does not provide access to sensitive information.
Remediation: Review group usage and permissions.

Control ID: GROUP_06
Entity: Group
Name: High sensitivity group owner left
Description The manager of a highly sensitive group is inactive.
Risk Level: 1
Risk description: Sensitive groups must have an owner. Otherwise, they are not managed or reviewed.
Remediation: Assign a manager to the group.

Control ID: GROUP_07
Entity: Group
Name: High sensitivity group without owner
Description No manager is found for a highly sensitive group.
Risk Level: 1
Risk description: Sensitive groups must have an owner. Otherwise, they are not managed or reviewed.
Remediation: Assign a manager to the group.

Control ID: GROUP_08
Entity: Group
Name: Extreme sensitivity group owner left
Description The manager of an extremely sensitive group is inactive.
Risk Level: 2
Risk description: Sensitive groups must have a owner. Otherwise, they are not managed or reviewed.
Remediation: Assign a manager to the group.

Control ID: GROUP_09
Entity: Group
Name: Extreme sensitivity group without owner
Description No manager is found for an extremely sensitive group.
Risk Level: 2
Risk description: Sensitive groups must have a owner. Otherwise, they are not managed or reviewed.
Remediation: Assign a manager to the group.

Control ID: GROUP_10
Entity: Group
Name: High sensitivity group owner is a contractor
Description The manager of a highly sensitive group is a contractor.
Risk Level: 0
Risk description: Sensitive resources should not be managed by contractors.
Remediation: Verify that this is a normal situation.

Control ID: GROUP_11
Entity: Group
Name: Extreme sensitivity group owner is a contractor
Description The manager of an extremely sensitive group is a contractor.
Risk Level: 0
Risk description: Sensitive resources should not be managed by contractors.
Remediation: Verify that this is a normal situation.

Control ID: GROUP_12
Entity: Group
Name: Highly sensitive group and new accounts
Description New accounts within a highly sensitive group are found.
Risk Level: 2
Risk description: Sensitive group changes must be reviewed in order to mitigate IT errors and hacking attempts.
Remediation: Review group changes.

Control ID: GROUP_13
Entity: Group
Name: Extremely sensitive group and new accounts
Description New accounts within an extremely sensitive group are found.
Risk Level: 3
Risk description: Sensitive group changes must be reviewed in order to mitigate IT errors and hacking attempts.
Remediation: Review group changes.

Control ID: GROUP_14
Entity: Group
Name: High sensitivity group without description
Description The description field of a highly sensitive group is empty.
Risk Level: 1
Risk description: Sensitive groups must be documented.
Remediation: Update the group description.

Control ID: GROUP_15
Entity: Group
Name: Extreme sensitivity group without description
Description The description field of an extremely sensitive group is empty.
Risk Level: 1
Risk description: Sensitive groups must be documented.
Remediation: Update the group description.

Control ID: GROUP_16
Entity: Group
Name: No group description
Description The description field of a group is empty.
Risk Level: 0
Risk description: Groups should be documented.
Remediation: Update the group description.

Control ID: GROUP_17
Entity: Group
Name: No group sensitivity level
Description The group sensitivity level is empty.
Risk Level: 0
Risk description: Groups should have a sensitivity level set in order to identify the applicable security policy.
Remediation: Update the group sensitivity level.

Control ID: GROUP_18
Entity: Group
Name: Public group grants access to highly sensitive permissions
Description The permission sensitivity level is set at 3.
Risk Level: 2
Risk description: Sensitive information should not be public.
Remediation: Review the group configuration and membership.

Control ID: GROUP_19
Entity: Group
Name: Public group grants access to extremely sensitive permissions
Description The permission sensitivity level is set at 4.
Risk Level: 3
Risk description: Sensitive information should not be public.
Remediation: Review the group configuration and membership.

Control ID: GROUP_20
Entity: Group
Name: Public group grants access to highly sensitive folders
Description A public group grants access to highly sensitive folders and the permission sensitivity level is set at 3.
Risk Level: 2
Risk description: Sensitive information should not be public.
Remediation: Review the group configuration and membership.

Control ID: GROUP_21
Entity: Group
Name: Public group grants access to extremely sensitive folders
Description A public group grants access to extremely sensitive folders and the permission sensitivity level is set a 4.
Risk Level: 3
Risk description: Sensitive information should not be public.
Remediation: Review the group configuration and membership.

Control ID: GROUP_22
Entity: Group
Name: Semi-public group grants access to highly sensitive permissions
Description A semi-public group grants access to highly sensitive permissions and the permission sensitivity level is set at 3.
Risk Level: 2
Risk description: Sensitive information should not be public.
Remediation: Review the group configuration and membership.

Control ID: GROUP_23
Entity: Group
Name: Semi-public group grants access to extremely sensitive permissions
Description A semi-public group grants access to extremely sensitive permissions and the permission sensitivity level is set at 4.
Risk Level: 3
Risk description: Sensitive information should not be public.
Remediation: Review the group configuration and membership.

Control ID: GROUP_24
Entity: Group
Name: Semi-public group grants access to highly sensitive folders
Description A semi-public group grants access to highly sensitive folders and the permission sensitivity level is set at 3.
Risk Level: 2
Risk description: Sensitive information should not be public.
Remediation: Review the group configuration and membership.

Control ID: GROUP_25
Entity: Group
Name: Semi-public group grants access to extremely sensitive folders
Description A semi-public group grants access to extremely sensitive folders and the permission sensitivity level is set at 4.
Risk Level: 3
Risk description: Sensitive information should not be public.
Remediation: Review the group configuration and membership.

Control ID: GROUP_26
Entity: Group
Name: High sensitivity and new accounts
Description A highly sensitive group with new accounts.
Risk Level: 1
Risk description: Highly sensitive groups should be carefully monitored for account changes because these groups can lead to continuity, fraud or data-leakage risk.
Remediation: Perform a review of the changes.

Control ID: GROUP_27
Entity: Group
Name: Extreme sensitivity and new accounts
Description An extremely sensitive group with new accounts
Risk Level: 2
Risk description: Extremely sensitive groups should be carefully monitored for account changes because these groups can lead to continuity, fraud or data-leakage risk.
Remediation: Perform a review of the changes.

Control ID: GROUP_34
Entity: Group
Name: Significant increase in group members
Description The number of group members has increased by more than 1000 since the last analysis.
Risk Level: 1
Risk description: Significant changes regarding access rights can be caused by operational IT errors.
Remediation: Review the change.

Control ID: GROUP_35
Entity: Group
Name: Local server group with direct domain user account
Description A local server group directly includes Active Directory domain active user accounts.
Risk Level: 2
Risk description: Local server groups are difficult to manage because most of the time one must connect to the server to manage the group content. Therefore, as a best practice, it is suggested that Active Directory domain accounts should not be directly added to these groups. This is because there is a high probability that one will forget to remove those memberships when necessary.
Remediation: Create an Active Directory group with the same content and add the Active Directory group in this local server group. As a result, it will be possible to administer the local group content from Active Directory.

Control ID: GROUP_36
Entity: Group
Name: Local server user group contains public access
Description The local user group (sid S-1-5-32-545) contains public Active Directory domain access.
Risk Level: 2
Risk description: The local user group contains all the Active Directory domain accounts meaning that, unless overridden by a GPO, anyone can open a session locally on this server.
Remediation: Verify that a GPO has been configured to prevent login by unauthorized users. As a best practice, create a group on the Active Directory domain and include this group as a subgroup of the local group in order to centrally manage who can open a session on this server.

Control ID: GROUP_37
Entity: Group
Name: Local server remote desktop user group contains public access
Description Local remote desktop user group (sid S-1-5-32-555) contains public Active Directory domain access.
Risk Level: 3
Risk description: The local remote desktop user group contains all the Active Directory domain accounts meaning that, unless overridden by a GPO, anyone can open a session locally on this server.
Remediation: Verify that a GPO has been configured to prevent login by unauthorized users. As a best practice, create a group on the Active Directory domain and include this group as a subgroup of the local group in order to centrally manage who can open a session on this server.

Control ID: GROUP_38
Entity: Group
Name: Local server remote management user group contains public access
Description The local remote management user group (sid S-1-5-32-580) contains public Active Directory domain access.
Risk Level: 3
Risk description: The local remote management user group contains all the Active Directory domain accounts meaning that, unless overridden by a GPO, anyone can remotely execute PowerShell commands on this server.
Remediation: Verify that a GPO has been configured to prevent login by unauthorized users. As a best practice, create a group on the Active Directory domain and include this group as a subgroup of the local group in order to centrally manage who can execute PowerShell commands on this server.

Control ID: GROUP_39
Entity: Group
Name: Local server administrator group contains public access
Description The local administrator group (sid S-1-5-32-544) contains public Active Directory domain access.
Risk Level: 4
Risk description: The local administrator group contains all Active Directory domain accounts meaning that, unless overridden by a GPO, anyone can open a session as a local administrator on this server.
Remediation: Verify that a GPO has been configured to prevent login by unauthorized users. As a best practice, create a group on the Active Directory domain and include this group as a subgroup of the local group in order to centrally manage who can open a session as an administrator on this server.

Control ID: GROUP_40
Entity: Group
Name: Local server power user group contains public access
Description The local power user group (sid S-1-5-32-547) contains public Active Directory domain access.
Risk Level: 3
Risk description: The local power user group contains all the Active Directory domain accounts meaning that, unless overridden by a GPO, anyone can open a session as a power user on this server and create local accounts.
Remediation: Verify that a GPO has been configured to prevent login by unauthorized users. As a best practice, create a group on the Active Directory domain and include this group as a subgroup of the local group in order to centrally manage who can open a session as a power user on this server.

Control ID: HR_01
Entity: Identity
Name: No employee number
Description The HR Code is empty.
Risk Level: 1
Risk description: Having unique employee numbers is a good practice because it helps with audits and account reconciliation processes by avoiding issues with duplicate names.
Remediation: Consider entering an employee number if one exists.

Control ID: HR_02
Entity: Identity
Name: No email found
Description No email is found.
Risk Level: 1
Risk description: No interactions are possible without a valid email address, as in the example of self-certification.
Remediation: Enter a valid email address.

Control ID: HR_03
Entity: Identity
Name: Resource owner without email
Description No email is found and the identity is a resource owner.
Risk Level: 3
Risk description: Resource owners have many security interactions, including approvals, recertification, level 1 control, etc. Without an email, security processes will not be able to reach this resource owner.
Remediation: Enter a valid email address.

Control ID: HR_04
Entity: Identity
Name: Department manager without email
Description No email is found and the identity is a department manager.
Risk Level: 3
Risk description: Department managers have many security interactions, including approvals, recertification, level 1 control, etc. Without an email, security processes will not be able to reach this resource owner.
Remediation: Enter a valid email address.

Control ID: HR_05
Entity: Identity
Name: Team leader without email
Description No email is found and the identity is a team leader.
Risk Level: 3
Risk description: Team leaders have many security interactions, including approvals, recertification, level 1 control, etc. Without an email, security processes will not be able to reach this resource owner.
Remediation: Enter a valid email address.

Control ID: HR_06
Entity: Identity
Name: Inactive identity
Description The identity is active but all its accounts are either inactive or have not been used in the last 90 days.
Risk Level: 1
Risk description: The identity is active but all of its accounts are either inactive or have not been used in the last 90 days. This identity may have left the company.
Remediation: Notify the HR department.

Control ID: HR_07
Entity: Identity
Name: Phantom identity
Description The identity is active but no accounts have been found.
Risk Level: 1
Risk description: The identity is active but no accounts have been found. This identity may have left the company.
Remediation: Notify the HR department.

Control ID: HR_08
Entity: Identity
Name: Contractor without end date
Description An active identity, marked as a contractor, does not have an end date.
Risk Level: 1
Risk description: Contractors should have an end date to help with account revocation.
Remediation: Add an end date.

Control ID: HR_09
Entity: Identity
Name: Contractor with past-due end date and no active accounts
Description An active identity, marked as as a contractor, has an outdated end date.
Risk Level: 1
Risk description: Contractors should be monitored carefully, especially during the off-boarding process.
Remediation: Validate with the contractor manager.

Control ID: HR_10
Entity: Identity
Name: Contractor with past-due end date and active accounts
Description An active identity, marked as as a contractor, has an outdated end date but retains active accounts.
Risk Level: 3
Risk description: Contractors should be monitored carefully, especially during the off-boarding process. It could be that this identity has left the company but still has active accounts.
Remediation: Validate with the contractor manager.

Control ID: HR_11
Entity: Identity
Name: Employee without manager
Description An active, internal identity has no direct manager.
Risk Level: 1
Risk description: All employees must have an assigned manager.
Remediation: Assign this employee to a manager.

Control ID: HR_12
Entity: Identity
Name: Contractor without manager
Description An active, external identity, has no direct manager.
Risk Level: 2
Risk description: All contractors must have an assigned manager.
Remediation: Assign this contractor to a manager.

Control ID: HR_13
Entity: Identity
Name: Employee whose manager left the company
Description An active, internal identity, has an inactive direct manager.
Risk Level: 1
Risk description: Employees must have a manager.
Remediation: Assign this employee to a manager.

Control ID: HR_14
Entity: Identity
Name: Contractor whose manager left the company
Description An active, external identity has an inactive direct manager.
Risk Level: 2
Risk description: Contractors must have a manager.
Remediation: Assign this contractor to a manager.

Control ID: HR_15
Entity: Identity
Name: Employee with a contractor as a manager
Description An active, internal identity has an external direct manager.
Risk Level: 1
Risk description: Employees must not be managed by a contactor, as this is an HR risk.
Remediation: Verify the data quality of the HR source and solve the issue with the HR department.

Control ID: HR_16
Entity: Identity
Name: Identity is its own manager
Description The identity is its own manager
Risk Level: 2
Risk description: This identity is its own manager. When access reviews are launched, this person will be assigned the review for their own entitlements. This should be avoided, and may point to HR data quality issues.
Remediation: Reassign this identity to another manager.

Control ID: HR_17
Entity: Identity
Name: Contractor leaving within the next 30 days
Description This contractor's departure date is coming the next 30 days
Risk Level: 0
Risk description: This contractor will leave the company within the next 30 days. The manager should verify if the contractor's end date is accurate. Upon departure, all the contractor's accesses will be disabled.
Remediation: Verify the contractor's departure date with their manager.

Control ID: HR_18
Entity: Identity
Name: Identity with namesakes
Description Multiple identities have identical first and last names (namesakes)
Risk Level: 1
Risk description: Namesakes must be carefully managed. They may be both a symptom of bad HR data quality, and a trigger for access rights provisioning mistakes.
Remediation: Verify if this is a real namesake or a data quality issue. Identify possible unique identification attributes (employee number, for instance).

Control ID: HR_19
Entity: Identity
Name: Identities with the same email address
Description Multiple identities have the same email address.
Risk Level: 2
Risk description: Several identities have the same email address. This may point to duplicated identities OR data quality issues in the HR system. This must be solved as it breaks all logical access control policies.
Remediation: Investigate and solve the issue (deduplicate identities, or update one email address in the HR system)

Control ID: HR_20
Entity: Identity
Name: Identity with multiple active accounts in the same repository
Description This identity holds several active accounts in a repository.
Risk Level: 2
Risk description: Having multiple accounts in the same repository is a bad practice. It can be a way to evade Segregation of Duties (SoD) controls. Unless the user has several accounts for very good reasons (for instance an admin account, and a standard user account), those accounts should be merged.
Remediation: Verify that the user holds these accounts for good reasons. Otherwise consider merging the accounts and their respective permissions.

Control ID: HR_21
Entity: Identity
Name: Identity with multiple active accounts in the same application
Description This identity holds several active accounts in an application.
Risk Level: 2
Risk description: Having multiple accounts in the same application is a bad practice. It can be a way to evade Segregation of Duties (SoD) controls. Unless the user has several accounts for very good reasons (for instance an admin account, and a standard user account), those accounts should be merged.
Remediation: Verify that the user holds these accounts for good reasons. Otherwise consider merging the accounts and their respective permissions.

Control ID: PERM_01
Entity: Permission
Name: High sensitivity and new rights
Description A highly sensitive permission has new access rights (active accounts added or removed).
Risk Level: 1
Risk description: Highly sensitive permissions should be carefully monitored for access right changes because these permissions can lead to continuity, fraud and data-leakage risk.
Remediation: Perform a review of the changes.

Control ID: PERM_02
Entity: Permission
Name: Extreme sensitivity and new rights
Description An extremely sensitive permission has new access rights (active accounts added or removed).
Risk Level: 2
Risk description: Extremely sensitive permissions should be carefully monitored for access right changes because these permissions can lead to continuity, fraud and data-leakage risk.
Remediation: Perform a review of the changes.

Control ID: PERM_03
Entity: Permission
Name: High sensitivity and new folder rights
Description Highly sensitive folders have new access rights (active accounts added or removed).
Risk Level: 1
Risk description: Highly sensitive folders should be carefully monitored for access right changes because these permissions can lead to continuity, fraud and data-leakage risk.
Remediation: Perform a review of the changes.

Control ID: PERM_04
Entity: Permission
Name: Extreme sensitivity and new folder rights
Description Extremely sensitive folders have new access rights (active accounts added or removed).
Risk Level: 2
Risk description: Extremely sensitive folders should be carefully monitored for access right changes because these permissions can lead to continuity, fraud and data-leakage risk.
Remediation: Perform a review of the changes.

Control ID: PERM_05
Entity: Permission
Name: Highly sensitive permission without owner
Description A highly sensitive permission has no owner.
Risk Level: 1
Risk description: A highly sensitive permission should have an owner and should be reviewed by the owner on a regular basis.
Remediation: Assign an owner and request that he review the rights.

Control ID: PERM_06
Entity: Permission
Name: Extremely sensitive permission without owner
Description An extremely sensitive permission has no owner.
Risk Level: 2
Risk description: An extremely sensitive permission should have an owner and should be reviewed by the owner on a regular basis.
Remediation: Assign an owner and request that he review the rights.

Control ID: PERM_07
Entity: Permission
Name: Highly sensitive folders without owner
Description Highly sensitive folders have no owner.
Risk Level: 1
Risk description: Highly sensitive folders should have an owner and should be reviewed by the owner on a regular basis.
Remediation: Assign an owner and request that he review the rights.

Control ID: PERM_08
Entity: Permission
Name: Extremely sensitive folders without owner
Description Extremely sensitive folders have no owner.
Risk Level: 2
Risk description: Extremely sensitive folders should have an owner and should be reviewed by the owner on a regular basis.
Remediation: Assign an owner and request that he review the rights.

Control ID: PERM_09
Entity: Permission
Name: Highly sensitive permission without description
Description Highly sensitive permission with an empty description field.
Risk Level: 1
Risk description: Highly sensitive permissions must be documented to help with analysis and audits.
Remediation: Fill in the description field.

Control ID: PERM_10
Entity: Permission
Name: Extremely sensitive permission without description
Description Extremely sensitive permission with an empty description field.
Risk Level: 1
Risk description: Extremely sensitive permissions must be documented to help with analysis and audits.
Remediation: Fill in the description field.

Control ID: PERM_11
Entity: Permission
Name: Highly sensitive folders without description
Description Highly sensitive folders with an empty description field.
Risk Level: 1
Risk description: Highly sensitive folders must be documented to help with analysis and audits.
Remediation: Fill in the description field.

Control ID: PERM_12
Entity: Permission
Name: Extremely sensitive folders without description
Description Extremely sensitive folders with an empty description field.
Risk Level: 1
Risk description: Extremely sensitive folders must be documented to help with analysis and audits.
Remediation: Fill in the description field.

Control ID: PERM_13
Entity: Permission
Name: Significant increase in folder rights
Description The increase in folder rights since the last analysis is greater than 100.
Risk Level: 1
Risk description: Significant changes with regards to folder rights can be caused by operational IT errors.
Remediation: Review the change(s).

Control ID: PERM_14
Entity: Permission
Name: Significant increase in access rights
Description The increase in access rights since the last analysis is greater than 100.
Risk Level: 1
Risk description: Significant changes with regards to access rights can be caused by operational IT errors.
Remediation: Review the change(s).

Control ID: PERM_15
Entity: Permission
Name: Local share with AD domain account ACLs
Description Local share permission ('/') contains direct active account access through ACLs.
Risk Level: 2
Risk description: Active Directory domain accounts should not be allowed to directly access local server shares because this is a local, server per server, configuration. There is a high risk of residual access rights.
Remediation: A group in Active Directory should be referenced instead of a shared ACL. Centrally manage the access rights through Active Directory's group membership.

Control ID: QA_01
Entity: Application
Name: Application without owner
Description The application has no assigned owner.
Risk Level: 1
Risk description: Applications without owners are not managed or reviewed which could lead to increased fraud and data leakage risk.
Remediation: Assign an owner to this application.

Control ID: QA_02
Entity: Organization
Name: Organization without owner
Description The organization does not have an assigned owner.
Risk Level: 1
Risk description: Organizations without owners are not managed or reviewed which could lead to increased fraud and data leakage risk.
Remediation: Assign an owner to this organization.

Control ID: QA_03
Entity: Application
Name: Application owner left the company
Description The application owner has left the company.
Risk Level: 1
Risk description: Applications without owners are not managed or reviewed which could lead to increased fraud and data leakage risk.
Remediation: Assign an owner to this application.

Control ID: QA_04
Entity: Organization
Name: Organization owner left the company
Description The organization owner has left the company.
Risk Level: 1
Risk description: Organizations without owners are not managed or reviewed which could lead to increased fraud and data leakage risk.
Remediation: Assign an owner to this organization.

Control ID: QA_05
Entity: Application
Name: Sensitive application owner is a contractor
Description The owner is a contractor and the application sensitivity level is greater than 2.
Risk Level: 0
Risk description: Sensitive applications should not be managed by contractors.
Remediation: Verify that this is a normal situation.

Control ID: QA_06
Entity: Organization
Name: Organization owner is a contractor
Description The organization owner is a contractor.
Risk Level: 0
Risk description: Organizations should not be managed by contractors.
Remediation: Verify that this is a normal situation.

Control ID: QA_07
Entity: Organization
Name: Orphaned organization
Description The organization is orphaned.
Risk Level: 1
Risk description: This can be a data quality problem or a RadiantOne Identity Analytics connector error.
Remediation: Verify that the data has been loaded properly into RadiantOne Identity Analytics. Partial data loading leads to partial analysis. If this is not the case, check with the HR department to correct this organization.

Control ID: QA_08
Entity: Organization
Name: Empty organization
Description The organization is empty.
Risk Level: 1
Risk description: This can be a data quality problem or a RadiantOne Identity Analytics connector error.
Remediation: Verify that the data has been loaded properly into RadiantOne Identity Analytics. Partial data loading leads to partial analysis. If this is not the case, check with the HR department to correct this organization.

Control ID: QA_09
Entity: Application
Name: No application description
Description The application description is empty.
Risk Level: 0
Risk description: An application description should always be provided to help with analysis and audits.
Remediation: Fill in the application description field.

Control ID: QA_10
Entity: Share
Name: No share description
Description The share description is empty.
Risk Level: 0
Risk description: A share application should always be provided to help with analysis and audits.
Remediation: Fill in the share description field.

Control ID: QA_11
Entity: Application
Name: No sensitivity level set for the application
Description The application sensitivity level is empty.
Risk Level: 0
Risk description: The application sensitivity level should always be provided to help with analysis and audits.
Remediation: Fill in the application sensitivity level field.

Control ID: QA_12
Entity: Share
Name: No sensitivity level set for the share
Description The share sensitivity level is empty.
Risk Level: 0
Risk description: The share sensitivity level should always be provided to help with analysis and audits.
Remediation: Fill in the share sensitivity level field.

Control ID: QA_13
Entity: Permission
Name: No sensitivity level set for the permission
Description The permission sensitivity level is empty.
Risk Level: 0
Risk description: The permission sensitivity level should always be provided to help with analysis and audits.
Remediation: Fill in the permissions sensitivity level field.

Control ID: QA_14
Entity: Permission
Name: No sensitivity level set for the folder
Description The folder sensitivity level is empty.
Risk Level: 0
Risk description: The folder sensitivity level should always be provided to help with analysis and audits.
Remediation: Fill in the folder sensitivity level field.

Control ID: QA_15
Entity: Permission
Name: No permission description
Description The permission description field is empty and the sensitivity level is less than 3.
Risk Level: 0
Risk description: A permission description should always be provided to help with analysis and audits.
Remediation: Fill in the permission description field.

Control ID: QA_16
Entity: Permission
Name: No folder description
Description The folder description field is empty, an ACL is associated, and the sensitivity level is less than 3.
Risk Level: 0
Risk description: A folder description should always be provided to help with analysis and audits.
Remediation: Fill in the folder description field.

Control ID: REM_01
Entity: Account
Name: Account not revoked
Description A decision have been made to revoke this account and a remediation process has been implemented. Although the remediation process states that the account has been revoked, the account is still active in the system at the time of data loading.
Risk Level: 3
Risk description: A discrepancy between the remediation process (theoretical view of the situation) and the actual situation in the system can lead to fraud and data-leakage risk.
Remediation: Revoke the account and investigate to understand why this error occurred using the "Decision History" tab on the Account Detail page.

Control ID: REM_02
Entity: Right
Name: Access right not removed
Description A decision has been made to revoke this access right and a remediation process has been implemented. Although the remediation process states that the access right has been revoked, the access right is still active in the system at the time of data loading.
Risk Level: 3
Risk description: A discrepancy between the remediation process (theoretical view of the situation) and the actual situation in the system can lead to fraud and data-leakage risk.
Remediation: Revoke the access right and investigate to understand why this error occurred using the "Decision History" tab on the Application Detail page.

Control ID: REM_03
Entity: Right
Name: Folder right not removed
Description A decision have been made to revoke this folder right and a remediation process has been implemented. Although the remediation process states that the folder right has been revoked, the account is still active in the system at the time of data loading.
Risk Level: 3
Risk description: A discrepancy between the remediation process (theoretical view of the situation) and the actual situation in the system can lead to fraud and data-leakage risk.
Remediation: Revoke the folder right and investigate to understand why this error occurred using the "Decision History" tab on the Share Detail page.

Control ID: REM_04
Entity: Identity
Name: Identity not revoked
Description A decision has been made to revoke this identity and a remediation process has been implemented. Although the remediation process states that the identity has been revoked, the account is still active in the system at the time of data loading.
Risk Level: 3
Risk description: A discrepancy between the remediation process (theoretical view of the situation) and the actual situation in the systems can lead to fraud and data-leakage risk.
Remediation: Revoke the identity and investigate to understand why this error occurred using the Identity Detail page.

Control ID: REV_01
Entity: Account
Name: Account not reviewed in the last 365 days
Description The account has not been reviewed in the last 365 days.
Risk Level: 1
Risk description: Accounts should be reviewed on a regular basis to comply with security policy constraints.
Remediation: Perform a review.

Control ID: REV_02
Entity: Right
Name: Access rights not reviewed in the last 365 days
Description The access rights have not been reviewed in the last 365 days.
Risk Level: 1
Risk description: Access rights should be reviewed on a regular basis to comply with security policy constraints.
Remediation: Perform a review.

Control ID: REV_03
Entity: Right
Name: Folder rights not reviewed in the last 365 days
Description Folder fights have not been reviewed in the last 365 days.
Risk Level: 1
Risk description: Folder rights should be reviewed on a regular basis to comply with security policy constraints.
Remediation: Perform a review.

Control ID: REV_04
Entity: Application
Name: Application not reviewed in the last 365 days
Description The application has not reviewed in the last 365 days.
Risk Level: 1
Risk description: Applications should be reviewed on a regular basis to comply with security policy constraints.
Remediation: Perform a review.

Control ID: REV_05
Entity: Share
Name: Share not reviewed in the last 365 days
Description The share has not been reviewed in the last 365 days.
Risk Level: 1
Risk description: Shares should be reviewed on a regular basis to comply with security policy constraints.
Remediation: Perform a review.

Control ID: REV_06
Entity: Identity
Name: Identity not reviewed in the last 365 days
Description The identity has not been reviewed in the last 365 days.
Risk Level: 1
Risk description: Identities should be reviewed on a regular basis to comply with security policy constraints.
Remediation: Perform a review.

Control ID: REV_07
Entity: Organization
Name: Organization not reviewed in the last 365 days
Description The organization has not been reviewed in the last 365 days.
Risk Level: 1
Risk description: Organizations should be reviewed on a regular basis to comply with security policy constraints.
Remediation: Perform a review

Control ID: REV_08
Entity: Permission
Name: Permission not reviewed in the last 365 days
Description The permission has not been reviewed in the last 365 days.
Risk Level: 1
Risk description: Permissions should be reviewed on a regular basis to comply with security policy constraints.
Remediation: Perform a review.

Control ID: REV_09
Entity: Folder
Name: Folder not reviewed in the last 365 days
Description The folder has not been reviewed in the last 365 days.
Risk Level: 1
Risk description: Folders should be reviewed on a regular basis to comply with security policy constraints.
Remediation: Perform a review.

Control ID: REV_10
Entity: Group
Name: Group not reviewed in the last 365 days
Description The group has not been reviewed in the last 365 days.
Risk Level: 1
Risk description: Groups should be reviewed on a regular basis to comply with security policy constraints.
Remediation: Perform a review.

Control ID: REV_11
Entity: Group membership
Name: Group membership not reviewed in the last 365 days
Description Group membership has not been reviewed in the last 365 days.
Risk Level: 1
Risk description: Group membership should be reviewed on a regular basis to comply with security policy constraints.
Remediation: Perform a review.

Control ID: REV_12
Entity: Right
Name: Highly sensitive access rights not reviewed in the last 90 days
Description Highly sensitive access rights have not been reviewed in the last 90 days and the sensitivity level is set at 3.
Risk Level: 1
Risk description: Highly sensitive access rights should be reviewed on a regular basis to comply with security policy constraints.
Remediation: Perform a review.

Control ID: REV_13
Entity: Right
Name: Highly sensitive folder rights not reviewed in the last 90 days
Description Highly sensitive folder rights have not been reviewed in the last 90 days and the sensitivity level is set at 3.
Risk Level: 1
Risk description: Highly sensitive folder rights should be reviewed on a regular basis to comply with security policy constraints.
Remediation: Perform a review.

Control ID: REV_14
Entity: Group membership
Name: Highly sensitive group membership not reviewed in the last 90 days
Description Highly sensitive group membership has not been reviewed in the last 90 days.
Risk Level: 1
Risk description: Group membership should be reviewed on a regular basis to comply with security policy constraints.
Remediation: Perform a review.

Control ID: REV_15
Entity: Right
Name: Extremely sensitive access rights not reviewed in the last 30 days
Description Extremely sensitive access rights have not been reviewed in the last 30 days and the sensitivity level is set at 4.
Risk Level: 1
Risk description: Extremely sensitive access rights should be reviewed on a regular basis to comply with security policy constraints.
Remediation: Perform a review.

Control ID: REV_16
Entity: Right
Name: Extremely sensitive folder rights not reviewed in the last 30 days
Description Extremely sensitive folder rights have not been reviewed in the last 30 days and the sensitivity level is set at 4.
Risk Level: 1
Risk description: Extremely sensitive folder rights should be reviewed on a regular basis to comply with security policy constraints.
Remediation: Perform a review.

Available Controls

IN THIS PAGE