IA-P1Govern identity scope and ownership
Identity Access Modernization
Gantt
Review schedule timing and dependencies
Actions
StatusIn progress
IA-P1-M01Name the sponsor, program owner, and identity decision rights
StatusCompleteForecast finish—IA-P1-M02Define the workforce, contractor, service, and privileged identity scope
StatusIn progressIA-P1-M03Identify authoritative identity sources and account owners
StatusPlannedIA-P2Control identity lifecycle and operations
IA-P2-M04Define joiner, mover, and leaver handling goals
StatusPlannedIA-P2-M10Establish service-account ownership and credential lifecycle rules
StatusPlannedIA-P2-M11Establish third-party identity sponsorship and expiration rules
StatusPlannedIA-P2-M14Establish periodic access and entitlement reviews
StatusPlannedIA-P2-M18Define operating metrics, review cadence, and transition to routine operations
StatusPlannedIA-P3Protect authentication and privileged access
IA-P3-M05Establish a repeatable privileged-account inventory process
StatusPlannedIA-P3-M06Separate daily-use and administrative identities
StatusPlannedIA-P3-M07Set authentication requirements by access risk
StatusPlannedIA-P3-M08Establish phishing-resistant authentication for high-risk access
StatusPlannedIA-P3-M09Define emergency-access accounts and recovery controls
StatusPlannedIA-P3-M12Define a protected path for administrative access
StatusPlannedIA-P3-M13Establish privileged-secret rotation and revocation rules
StatusPlannedIA-P3-M15Centralize important authentication and privilege event logs
StatusPlannedIA-P3-M16Define identity incident triage, containment, and recovery
StatusPlannedIA-P3-M17Pilot the controls with one bounded user or administrator group
StatusPlannedGovern identity scope and ownership
- Forecast finish
- September 11, 2026
Complete
IA-P1-M02 · Define the workforce, contractor, service, and privileged identity scope
- Forecast finish
- August 28, 2026
- Generated baseline
- August 28, 2026
IA-P1-M03 · Identify authoritative identity sources and account owners
- Forecast finish
- September 11, 2026
- Generated baseline
- September 11, 2026
Control identity lifecycle and operations
- Forecast finish
- January 22, 2027
IA-P2-M04 · Define joiner, mover, and leaver handling goals
- Forecast finish
- September 25, 2026
- Generated baseline
- September 25, 2026
IA-P2-M10 · Establish service-account ownership and credential lifecycle rules
- Forecast finish
- October 23, 2026
- Generated baseline
- October 23, 2026
IA-P2-M11 · Establish third-party identity sponsorship and expiration rules
- Forecast finish
- November 6, 2026
- Generated baseline
- November 6, 2026
IA-P2-M14 · Establish periodic access and entitlement reviews
- Forecast finish
- December 4, 2026
- Generated baseline
- December 4, 2026
IA-P2-M18 · Define operating metrics, review cadence, and transition to routine operations
- Forecast finish
- January 22, 2027
- Generated baseline
- January 22, 2027
Protect authentication and privileged access
- Forecast finish
- January 15, 2027
IA-P3-M05 · Establish a repeatable privileged-account inventory process
- Forecast finish
- September 18, 2026
- Generated baseline
- September 18, 2026
IA-P3-M06 · Separate daily-use and administrative identities
- Forecast finish
- October 2, 2026
- Generated baseline
- October 2, 2026
IA-P3-M07 · Set authentication requirements by access risk
- Forecast finish
- October 9, 2026
- Generated baseline
- October 9, 2026
IA-P3-M08 · Establish phishing-resistant authentication for high-risk access
- Forecast finish
- October 23, 2026
- Generated baseline
- October 23, 2026
IA-P3-M09 · Define emergency-access accounts and recovery controls
- Forecast finish
- November 6, 2026
- Generated baseline
- November 6, 2026
IA-P3-M12 · Define a protected path for administrative access
- Forecast finish
- November 20, 2026
- Generated baseline
- November 20, 2026
IA-P3-M13 · Establish privileged-secret rotation and revocation rules
- Forecast finish
- December 4, 2026
- Generated baseline
- December 4, 2026
IA-P3-M15 · Centralize important authentication and privilege event logs
- Forecast finish
- December 18, 2026
- Generated baseline
- December 18, 2026
IA-P3-M16 · Define identity incident triage, containment, and recovery
- Forecast finish
- January 1, 2027
- Generated baseline
- January 1, 2027
IA-P3-M17 · Pilot the controls with one bounded user or administrator group
- Forecast finish
- January 15, 2027
- Generated baseline
- January 15, 2027
Recommendations
| Actions | |||||
|---|---|---|---|---|---|
| No active recommendations for this view. | |||||
- No active recommendations for this view.



