Bring an identity expert to your team right now
Have an independent expert check your security position before the merger, data migration or audit, not after. A targeted engagement gets you advice that isn't coming from a vendor or a services firm, and it spares your internal team from playing catch-up on the latest security. The cost of waiting could mean failed audits, delayed projects, or even worse... a data breach.
- over thirty yearsin software, hardware, systems and infrastructure. Identity was part of every one of them, because it is the one thing every level of a business shares.
- Common sectorsfederal, healthcare, non-profit, franchisors, mergers and acquisitions, food manufacturing, game development, startups, and more
- Expertise inpublic company readiness, compliance, audit preparation, professional services engagements and migrations, built on Zero Trust, least privilege and NIST, SOX and ISO controls
- Effective in all environmentsgreenfield builds, legacy on-premises systems, hybrid and disconnected multi-cloud infrastructure, multiple physical locations, post-merger directories, and high-assurance federal systems
Four focus areas
Identity discovery and mapping
Employees, contractors, partners, vendors and customers all reach your systems in different ways. Working side by side with your team, we find every one of those edges and trace each back to the identity behind it, so nothing is left unaccounted for.
Application access and SSO coverage
Together with your team, we work out how people and service accounts get into each application, whether it sits behind single sign-on, and whether MFA is actually enforced. The gap analysis that follows shows which systems fall outside policy and what it takes to bring them in.
Governance and policy design
Together with your team, we design the policies that decide who gets access, how it is approved and how often it is reviewed: roles, least privilege, and joiner, mover and leaver rules. Zero Trust is the starting point, and the result is a roadmap your business sets the pace on.
Gap and risk report
Whether your team works through the roadmap at its own pace or we implement the changes together, we conclude the engagement with a gap and risk report. It shows the applications in your environment, the policies governing access to them, and how you recertify that access in the future. It also calls out any risk acceptance required during the engagement.
Every use case is unique. We start with your working environment, identify the risks, then custom build an approach that satisfies compliance without disrupting operations.
John Castillo
I am a cybersecurity architect, engineer and consultant with over thirty years in technology. Secure IGA is my own contract company, and I come in to advise on and design identity governance and access management. The sectors have varied widely, but the problem is the same in every one of them: knowing who can get into your systems, and how that access is governed.
- Not tied to any one solutionI know the major identity platforms well, but I am not sponsored by any of them and take no commission for recommending one. My recommendations are based only on what fits your situation.
- Dedicated to your engagementEach client gets my full attention and singular focus, from the first conversation to the final report.
- Your identity expert, when you need itIdentity questions may come up only during a project or for a limited time, and a full-time hire does not make sense. Bring in a specialist who fills the gaps and can represent your needs with vendors, service providers and internal teams.
Common questions
As an independent contractor brought in for a defined engagement. Every use case is unique, so we start with your working environment, identify the risks, then custom build an approach that satisfies compliance without disrupting operations. Your business sets the pace of implementation.
The work spans the major identity platforms, including Microsoft Entra ID and Active Directory, Okta, SailPoint, Saviynt, and the identity services in AWS, Azure and Google Cloud. No matter what applications your environment has or needs, we have a proven approach to set you up for success.
Use the contact form and give a short description of what is going on. I'll reply with a calendar invite so we can get on a call and talk through your needs.
Start with a conversation
Give a short description of what is going on, and we'll set up a call to talk through your needs.
Or write to contact@secureiga.net