Domain · Identity and access (IAM / IAG)

Who can access what, and why: an answer at any time.

We structure the identity life cycle from joining to leaving, define roles and entitlements with your business teams, extend strong authentication and run access reviews that actually remove the rights nobody needs.

Describe your need All domains

Situations

You are in the right place if…

Accounts of former employees or contractors are still active months after they left.
Rights pile up with every change of role, and nobody knows any more why a user holds them.
Your yearly entitlement review comes down to a spreadsheet sent to managers and approved unread.
Multi-factor authentication protects email, but neither remote access nor business applications.
Your auditor or authority asks for evidence of your access reviews and of rights removed.

Our conviction

An identity is governed from joining to leaving: the tool comes after the model.

Many IAM projects start with the choice of a tool and stumble on what comes before it: reliable identity sources, roles defined with the business, owners who approve the rights.

We set that model first, then the automation it makes possible. Access reviews then become a useful control: every right has an owner, a reason and an end date.

Our approach

From the identity register to access reviews.

A simple model, owned by the business, that tooling then automates.

01InventoryIdentity sources (HR, contractors, technical accounts), applications, existing accounts and rights, orphaned or generic accounts.
You getA map of identities and rights
02ModelBusiness roles, segregation of duties, request and approval workflow, joiner, mover and leaver rules.
You getA role model and an entitlement policy
03AuthenticateMulti-factor authentication in proportion to the risk: remote access, email, sensitive applications, privileged accounts.
You getA strong authentication roadmap
04Review and proveReview campaigns with the business, rights that are actually removed, indicators and evidence for the audit.
You getTraced access reviews and their evidence

What the texts say

What the texts expect of identity and access management.

DORA, NIS 2 and the CNIL guide converge: one identity per person, rights limited to the need, removed in time and reviewed regularly.

DORA · RTSRTS 2024/1774 art. 20(1) · RTS 2024/1774 art. 20(2), point (a)
Financial entities adopt identity management policies that ensure the unique identification and authentication of persons and systems, with a unique identity for each member of their staff or of their providers’ staff.1 2
DORA · RTSRTS 2024/1774 art. 21, point (a) · RTS 2024/1774 art. 21, point (b) · RTS 2024/1774 art. 21, point (e) (iii) · RTS 2024/1774 art. 21, point (e) (iv)
Their access control policy grants rights on need-to-know and least privilege, segregates duties, withdraws rights without undue delay on leaving and reviews them at least once a year, every six months for systems supporting critical or important functions.3 4 5 6
NIS 2 · ReCyFNIS 2 art. 21(2), point (i) · NIS 2 art. 21(2), point (j) · ReCyF v2.5, objectif 10
The directive asks Member States to require access control policies of entities and, where appropriate, multi-factor authentication; ReCyF (working version) sets them the objective of identification and authentication mechanisms and rights management processes, down to revoking rights and disabling accounts on leaving.7 8 9
CNIL guideGuide CNIL sécurité, fiche 5, F05-PE-01 · Guide CNIL sécurité, fiche 5, F05-PE-02 · Guide CNIL sécurité, fiche 5, F05-PE-03 · Guide CNIL sécurité, fiche 5, F05-PE-04 · Guide CNIL sécurité, fiche 4, F04-MC-01
The CNIL recommends defining entitlement profiles that segregate duties, having every request approved by a manager, removing access as soon as it is no longer justified, reviewing entitlements at least once a year with the business, and using multi-factor authentication for sensitive data and risky operations, notably administration, connection from outside and access to work email.10 11 12 13 14

The texts do not apply to every organisation: whether they apply depends on your status, your sector, your size and your contracts. Have it confirmed by your legal counsel or a specialised lawyer.

Our engagement

The same topic, at three levels of engagement.

You choose the level; the scope and deliverables are set by contract.

Level 01

Monitor

We track your entitlement indicators and chase reviews when they fall due.

Deliverables

Tracking of orphaned, generic and inactive accounts
Calendar and follow-up of review campaigns
Periodic check that rights are removed on leaving

Level 02

Advise

We design the role model and the entitlement policy, and recommend tooling, which you decide on.

Deliverables

Map of identities and rights
Role model and segregation-of-duties matrix
IAM / IAG roadmap and tool selection criteria

Level 03

Drive

We run the programme with your HR, IT and business teams, without making the changes in your systems.

Deliverables

Management of review campaigns with the business
Follow-up of rights removed and of gaps
Evidence ready for the auditor or the authority

Accelerators

What we bring from day one.

Template role model

A base of business roles and segregation-of-duties rules, to adapt to your organisation.

Access review kit

Kick-off, instructions for managers, reminders and report: a review campaign ready to start.

Your tracking web app

Identities, rights, reviews and gaps in a tool shared with your teams.

Frequently asked questions

Before we start.

Should we start by choosing an IAM tool?

No. A tool automates a model: without reliable identity sources and defined roles, it reproduces the disorder faster. We set the model first, then help you choose the tool that fits it.

How often should entitlements be reviewed?

At least once a year, and more often for sensitive systems. A financial entity under DORA reviews them at least every six months on systems supporting critical or important functions; the CNIL recommends a review at least once a year.6 13

IAM or IAG: what is the difference?

IAM runs identities and access day to day: creating accounts, authenticating, granting rights. IAG governs them: who approves, on which model, with which reviews and which evidence. We handle both together.

Do you work in our directories?

No. We design, run and verify; your teams or your integrator make the changes in your systems. We can help you find the right integrator, whom you mandate.

Start with the past year’s leavers.

Describe your directories, your sensitive applications and how you handle leavers. We come back to you with a scoping proposal.

Describe your need

Sources

The excerpts quoted.

Exact text, in its original language, from the frameworks extracted from the official text.

Show the 14 excerpts quoted

1RTS 2024/1774 art. 20(1)32024R1774-a20-p1
As part of their control of access management rights, financial entities shall develop, document, and implement identity management policies and procedures that ensure the unique identification and authentication of natural persons and systems accessing the financial entities’ information to enable assignment of user access rights in accordance with Article 21.
Normative force
directly applicable EU law (delegated regulation — RTS, level 2)
Source
Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework
Version
CELEX 32024R1774 — ELI reg_del/2024/1774
Official text
2RTS 2024/1774 art. 20(2), point (a)32024R1774-a20-p2-1
without prejudice to Article 21, first paragraph, point (c), a unique identity corresponding to a unique user account shall be assigned to each staff member of the financial entity or staff of the ICT third-party service providers accessing the information assets and ICT assets of the financial entity;
Normative force
directly applicable EU law (delegated regulation — RTS, level 2)
Source
Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework
Version
CELEX 32024R1774 — ELI reg_del/2024/1774
Official text
3RTS 2024/1774 art. 21, point (a)32024R1774-a21-p0-1
the assignment of access rights to ICT assets based on need-to-know, need-to-use and least privilege principles, including for remote and emergency access;
Normative force
directly applicable EU law (delegated regulation — RTS, level 2)
Source
Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework
Version
CELEX 32024R1774 — ELI reg_del/2024/1774
Official text
4RTS 2024/1774 art. 21, point (b)32024R1774-a21-p0-2
the segregation of duties designed to prevent unjustified access to critical data or to prevent the allocation of combinations of access rights that may be used to circumvent controls;
Normative force
directly applicable EU law (delegated regulation — RTS, level 2)
Source
Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework
Version
CELEX 32024R1774 — ELI reg_del/2024/1774
Official text
5RTS 2024/1774 art. 21, point (e) (iii)32024R1774-a21-p0-8
withdrawal of access rights without undue delay upon termination of the employment or when the access is no longer necessary;
Normative force
directly applicable EU law (delegated regulation — RTS, level 2)
Source
Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework
Version
CELEX 32024R1774 — ELI reg_del/2024/1774
Official text
6RTS 2024/1774 art. 21, point (e) (iv)32024R1774-a21-p0-9
update of access rights where changes are necessary and at least once a year for all ICT systems, other than ICT systems supporting critical or important functions and at least every 6 months for ICT systems supporting critical or important functions;
Normative force
directly applicable EU law (delegated regulation — RTS, level 2)
Source
Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework
Version
CELEX 32024R1774 — ELI reg_del/2024/1774
Official text
7NIS 2 art. 21(2), point (i)32022L2555-a21-p2-9
human resources security, access control policies and asset management;
Normative force
EU law to be transposed (directive): not directly applicable, requires national transposition
Source
Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)
Version
CELEX 32022L2555 — ELI dir/2022/2555
Official text
8NIS 2 art. 21(2), point (j)32022L2555-a21-p2-10
the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate.
Normative force
EU law to be transposed (directive): not directly applicable, requires national transposition
Source
Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)
Version
CELEX 32022L2555 — ELI dir/2022/2555
Official text
9ReCyF v2.5, objectif 10recyf:obj-10
Les entités [importantes ou essentielles] mettent en œuvre : 1. Des mécanismes d’identification et d’authentification des utilisateurs et des processus automatiques de leurs systèmes d’information ; 2. Des processus de gestion des droits permettant notamment l’attribution des droits d’accès aux ressources en fonction du besoin opérationnel des utilisateurs et des processus automatiques, la révocation des droits en cas de changement d’affectation des utilisateurs et la désactivation du compte utilisateur en cas de départ de l’entité.
Normative force
obligation (decree, resilience bill)
Source
ReCyF — Référentiel Cyber France (NIS 2, transposition nationale)
Version
2.5 du 17/03/2026 (version de travail)
Status
Working version: not binding until the transposition is enacted
Official text
10Guide CNIL sécurité, fiche 5, F05-PE-01F05-PE-01
Définir des profils d’habilitation dans les systèmes en séparant les tâches et les domaines de responsabilité, afin de limiter l’accès des utilisateurs aux seules données strictement nécessaires à l’accomplissement de leurs missions.
Normative force
recommendation (soft law)
Source
Guide pratique RGPD — Sécurité des données personnelles
Version
2024 (mise à jour 2026)
Official text
11Guide CNIL sécurité, fiche 5, F05-PE-02F05-PE-02
Faire valider toute demande d’habilitation par un responsable (ex. : supérieur hiérarchique, chef de projet).
Normative force
recommendation (soft law)
Source
Guide pratique RGPD — Sécurité des données personnelles
Version
2024 (mise à jour 2026)
Official text
12Guide CNIL sécurité, fiche 5, F05-PE-03F05-PE-03
Supprimer les permissions d’accès des utilisateurs dès qu’ils ne sont plus habilités à accéder à un local ou à une ressource informatique (ex. : changement de mission ou de poste), ainsi qu’à la fin de leur contrat.
Normative force
recommendation (soft law)
Source
Guide pratique RGPD — Sécurité des données personnelles
Version
2024 (mise à jour 2026)
Official text
13Guide CNIL sécurité, fiche 5, F05-PE-04F05-PE-04
Réaliser une revue régulière, au moins annuelle, des habilitations afin d’identifier et de supprimer les comptes non utilisés et de réaligner les droits accordés sur les fonctions de chaque utilisateur. Les métiers devraient être impliqués dans cette revue afin qu’ils s’assurent de la légitimité opérationnelle des droits attribués.
Normative force
recommendation (soft law)
Source
Guide pratique RGPD — Sécurité des données personnelles
Version
2024 (mise à jour 2026)
Official text
14Guide CNIL sécurité, fiche 4, F04-MC-01F04-MC-01
Utiliser une authentification multifacteur lorsque des données sensibles au sens de l’article 9 du RGPD sont traitées, des traitements ou opérations à risque pour les personnes concernées sont effectuées, telles que l’administration systèmes et réseaux, la connexion au système d’information depuis l’extérieur ou, en général, l’accès à une messagerie professionnelle.
Normative force
recommendation (soft law)
Source
Guide pratique RGPD — Sécurité des données personnelles
Version
2024 (mise à jour 2026)
Official text