KRIs and KPI for Access Governance

The report proposes a practical set of Key Risk Indicators (KRIs) and supporting Key Performance Indicators (KPIs) for Access Governance, designed to be easy to measure and to provide a fast, management-friendly view of how access-related risks evolve over time. It positions KRIs as a missing complement to traditional KPI scorecards: KPIs show process performance, while KRIs express risk in terms of probability and impact, enabling “management by risk” and “management by exception.” A central theme is that many modern attacks succeed by abusing apparently legitimate credentials, making abnormal behavior in real user accounts a key early warning signal. Access Governance is therefore framed as both a cyber-risk control (reducing theft, fraud, ransomware-driven subversion) and a compliance mechanism that also produces evidence for auditors, including privacy regimes affecting PII and even customer identity contexts (CIAM).

The KRIs/KPIs are organized across four domains: classification of applications and information; identity lifecycle management; access management (authentication plus allocation/review, including roles, entitlements, attestation, and segregation of duties); and identity/access monitoring. Each indicator includes a target “direction,” associated risk categories (security, operational, cost, performance, efficiency, availability, compliance), and optimization actions. Examples include increasing data classification toward full coverage, minimizing orphan accounts, reducing multiple digital identities per person, expanding systems governed by centralized lifecycle management (with pragmatic limits), shortening time to provision/deprovision access, advancing delegated administration maturity, increasing central authentication and SSO reach while deploying strong authentication, and improving federation support—especially for cloud services.

Implementation guidance emphasizes starting lean without major restructuring: define targets, metrics and thresholds, responsibilities, and control actions; then establish collection, aggregation, reporting, alerting, escalation, and auditing routines. A KRI scorecard should track current value, change, direction, and a red/yellow/green status to inform IT and corporate decision-making and investment.

• Key Risk Indicators for Access Governance can be combined into a risk scorecard for use in IT management and corporate management.
• Access Governance targets legitimate access while managing illegitimate access risks such as information theft, fraud through alteration, and system subversion including ransomware.
• External cyber-attacks often use apparently legitimate access credentials to bypass layered network defenses.
• Abnormal activity by a legitimate user’s account is often the first sign that a cyber-attack is in progress.
• Privacy laws worldwide require stringent controls over how Personally Identifiable Information is collected and used.
• Unstructured data commonly exists as documents, spreadsheets, and presentations, complicating classification.
• The “percentage of data classified” indicator is intended to increase toward 100%.
• Orphan accounts are defined as user accounts not associated with a specific known person or entity.
• The “average number of digital identities per physical person” indicator is intended to be minimized with an optimum of 1.
• Typical numbers of defined business roles are stated as 80 to 150, and values above 200 are considered very high.

• “To manage IT services effectively requires a set of measures against which performance can be judged.”
• “The key benefit of using this approach is that performance at the IT process level can be related back to the strategic business requirements.”
• “In short. the benefits of using KPIs for managing by risk are: reduced impact, clearly defined control measure and proven success.”
• “You can’t protect what you don’t know you have.”
• “For every indicator, the report provides a ‘direction’ in which the value of the metric should be managed to evolve.”
• “The explosion in the ways that people can connect to the systems using mobile devices and the internet has increased the risks of impersonation…”
• “The user’s SSO provides a single ’golden key’ which creates an obvious increased security risk.”
• “Managing privileged user access is an important objective of identity and access governance.”
• “This monitoring requires trustworthy logs of the activities of users as well as security related events.”
• “If you need special tools and several people to collect metrics, you’ve chosen the wrong metric – collection should be easy.”