Nobody knows who has access to what.
Group memberships have grown for years and are nested up to four levels deep. The file server also carries individual permissions that were never documented.
Clear access rights, fully documented
Who can access what?And can you prove it?
In most companies that have grown over the years, nobody can fully answer that question. That is rarely the result of bad work. Staff changes, projects and one-off exceptions leave behind access rights that nobody ever removed. We clean this up, vendor-neutral and traceable, and document it so you can hand it to an auditor.
What it usually looks like
Former employees still have access.
The Active Directory account is disabled, but access to the line-of-business application, the supplier portal and the shared mailbox is still there.
Onboarding takes days and runs differently every time.
Nobody ever wrote down what a sales rep actually needs. So IT copies the rights of a coworker, including everything that person collected over the years.
Access reviews do not happen.
Or they happen once a year as a spreadsheet with 400 rows of cryptic group names that department heads sign off without reading.
MFA is in place, but it has gaps.
There are exceptions for the executives, for legacy applications and for field staff. Every one of these exceptions is an open door.
The auditor asks, and things get hectic.
SOC 2 audits, the HIPAA Security Rule and CMMC all expect access control you can show on paper. You can only prove what is recorded in a structured way.
Four building blocks
Access analysis
We record the current state: who has access where, through which path, since when and with whose approval. You get a report that ranks the risks by urgency instead of a spreadsheet with 8,000 rows.
Role model
We work with roles instead of one-off cases. We define which job in your company needs which access and set that up in your systems. Everything else builds on this model. If you automate without one, you only automate the mess.
Entra ID, Conditional Access, Intune
Instead of blanket access, Conditional Access decides based on the person, location, device and risk level. We harden the Microsoft platform and close the exceptions that let users get around MFA.
Processes and tooling
We turn hiring and departures into a defined process, set up access reviews that department heads can actually complete, and introduce an IAM tool for automation where it pays off. We know the common products on the market and choose based on your environment. Vendor commissions play no part in that choice.
How a project runs
- 01
Intro call (20 minutes)
We listen and tell you honestly whether we are a good fit.
- 02
Assessment
We take stock and deliver a written report with prioritized actions. The assessment has a fixed price, and we credit it to the follow-up project.
- 03
Design
We work out the role model, the target state and an implementation plan with an effort estimate.
- 04
Implementation
We roll out in stages, aligned with each department and documented as we go.
- 05
Handover
The documentation belongs to you, so you could replace us with another provider at any time.
We mean that last point. We build on purpose so that you do not depend on us. A provider who relies on lock-in does not have a good offer.
What it costs
| Identity & Access Management, hourly rate | $225 per hour |
| Consulting and project management | $250 per hour |
| Security assessment (access analysis, Entra configuration, gap analysis against HIPAA, SOC 2 or CMMC) | from $7,900 |
Project size depends on the number of users, systems and departments. After the assessment you get a fixed price for the project, and we credit the assessment fee against it.
The biggest factor is the state of your documentation. Where it is clear who can do what and why, the review goes quickly. The number of connected systems also matters, and whether a tool is needed in the end. After the assessment the price is fixed, and we credit the cost of the assessment.
The price depends mainly on the number of systems and departments, the state of your documentation and whether a tool is introduced. The cost of the assessment is credited to a follow-up project.
Why us
We bring ten years of project management in pharmaceuticals, automotive suppliers, manufacturing and banking in Germany. That includes access projects, IT provider transitions, introducing and replacing tools, and restructuring.
Logistics, international, Germany · 10,000+ users
Replaced the existing IAM setup and introduced a new solution together with a contracted implementation partner. We advised, managed the project, implemented and set up the processes between the client and the partner.
Result: The help desk works faster because service staff received extended permissions. Identity processes were automated, and the HR master data used as the source was cleaned up.
Industrial supplier, international, Germany · 2,000 users
Introduced an IAM solution at a family-owned industrial supplier with international operations. The project included reorganizing file shares and a self-service password reset for users.
Result: The help desk has more time for other work. Users reset their own passwords, and password tickets dropped from almost 300 to 10 per week.
FAQ
Frequently asked questions
Do you work with a specific IAM tool?
No. We know the common products on the market and choose based on your environment. We are not tied to any vendor and do not take commissions. Often you do not need a tool at first. You need a role model.
Do we need an IAM tool at all?
Below about 150 users, rarely. Up to that size, Microsoft Entra ID, clean groups and defined processes get you very far. A tool only automates what is already in order. It does not create order by itself.
How long does an access project take?
The assessment takes two to three weeks including the report. The design takes four to eight weeks depending on size. Implementation runs in stages over several months so your business keeps running.
We already have MFA. Isn't that enough?
No. MFA protects the sign-in, but it does not control permissions. If an account can do too much, MFA does not change that. It only adds protection to the sign-in for those overly broad rights.
What does access management have to do with compliance?
Many US rules and frameworks expect access control you can document. The HIPAA Security Rule requires technical policies that limit access to electronic protected health information to authorized users, and a unique ID for every user. CMMC Level 2 includes the access control requirements of NIST SP 800-171. In a SOC 2 audit, the auditor tests your logical access controls, and access reviews are common evidence. Without a documented role model and traceable approvals, you cannot show any of this. Your legal counsel or auditor decides which rules apply to you. We implement the technical controls.
Can you run things for us afterward?
Yes, if you want that. It is not a requirement, because we build so that your internal IT team can carry on without us.
Identity & Access Management
Let's talk about your access rights
Describe your situation in 20 minutes. We will tell you honestly whether and how we can help, and also if we are not the right fit.