Identity Assurance : Who has access, who approved it, and when it was removed.
Every framework asks the same three questions about access. Identity assurance answers them on a cycle, on whatever identity platform you already run — and keeps the evidence so the answer is ready before the assessor asks.
Part of security assurance. Golonex reviews access and keeps the evidence; the identity platform stays with you or your vendor, overseen by the seat.
Six checks, on a cycle your framework sets.
Access reviews
Per system, on a cycle your framework sets: who has what, whether the owner still approves it, and whether the exceptions are justified.
Privileged access
Administrative and service accounts inventoried, justified, and covered by MFA and logging — with the evidence to show it.
Joiner, mover, leaver
Starters get what the role needs, movers lose what they no longer need, leavers are gone on the day — tested against HR records, not assumed.
MFA and conditional access
The policy says MFA everywhere; assurance checks that it is, including the legacy protocols and break-glass accounts people forget.
Segregation of duties
The combinations of access your framework or your auditor forbids, found and resolved before the audit does.
Evidence
Completed reviews, exceptions, and remediation mapped to NIST 800-171, ISO 27001 Annex A, PCI DSS, SOX, or HIPAA.
Need Entra ID set up, migrated, or hardened rather than reviewed? That is Microsoft 365 & Entra ID under the managed Microsoft ecosystem.
An answer that is already written down.
- Completed access reviews per system, with owner sign-off
- A privileged-account inventory with justification, MFA, and logging status
- Joiner-mover-leaver test results against HR records
- Exceptions tracked to closure, and a monthly report for the evidence pack
Identity assurance — your questions, answered
Do you implement SailPoint, Saviynt, or Okta? +
No. Identity assurance works on the platform you already run — Entra ID, Okta, SailPoint, Saviynt, or Active Directory alone. Golonex reviews the access, tests the controls, and keeps the evidence. If a platform cannot produce the evidence your framework needs, we say so in writing; implementation is your vendor’s work, overseen by the seat.
What does an access review involve? +
For each in-scope system: who has access, whether the business owner still approves it, whether privileged accounts are justified, and whether leavers are actually gone. Findings go to a named owner with a due date, and the completed review is kept as evidence.
Why does identity matter so much to assessors? +
Because access is the control most frameworks test first. NIST 800-171 3.1 and 3.5, ISO 27001 A.5.15 to A.5.18, PCI DSS 7 and 8, SOX, and HIPAA all turn on who had access to what, who approved it, and when it was removed. Assurance makes that answer available before the question is asked.
How do you handle access to our environment? +
Read-only wherever possible, under NDA, through your privileged-access controls where you have them, with activity logged. We review identity; we do not need standing administrative rights to do it.
Who runs it? +
A named Golonex engineer owns the review cycle for a single identity estate, with a second briefed for cover. Several directories, subsidiaries, or a first full review ahead of an assessment are a team.
How is it priced? +
Fixed monthly pricing by seat, dedicated or fractional, set before the month starts; a six-month minimum for the engineer seat, three to six months for a team.
Know who has access before the assessor asks.
Bring your system list and your last access review, if there was one. Thirty minutes tells you which questions you can already answer.
Managed delivery — seven practices · All managed delivery →
Managed GCC
Your Global Capability Center — set up, run, and handed over
02Managed talent
Supervised engineering seats in six practices
03Managed software delivery
Teams and builds with a Golonex lead on every engagement
04Managed infrastructure
Azure, AWS, Google Cloud, on-prem, and the data center
Security assurance
Recovery, patching, evidence, identity, and people — tested, not assumed
You are here
Managed Microsoft ecosystem
Microsoft 365, Azure workplace, and Dynamics 365
07Managed process & AI automation
A process lead in your business, automating the work