Pillar 1: User
Continuously authenticate, assess, and monitor user activity to govern access to data, applications, assets, and services.
Key principles
- Identity is the new perimeter — every request is authenticated regardless of network location.
- Authentication is continuous and risk-adaptive, not a one-time login event.
- Least-privilege access is enforced per session, not granted broadly at account creation.
Maturity snapshot
| Stage | Characteristics |
|---|---|
| Traditional | Passwords, static roles, one-time login trust for the session duration |
| Advanced | Phishing-resistant MFA, federated SSO, conditional access policies |
| Optimal | Continuous, behavior-based authentication; just-in-time, attribute-based access |
Related capabilities
See Multi-Factor Authentication and Identity Federation & Single Sign-On in the capability matrix.
Framework tie-ins
NIST 800-53 (IA family), NIST 800-207 §3.1, PCI-DSS v4.0 (Req. 8), NYDFS 500 (500.12).
Capabilities in this pillar
Identity Federation & Single Sign-On
Local identity stores per application
Centralized IdP with federated SSO across most applications
Unified identity fabric with just-in-time, attribute-based access across all environments
Multi-Factor Authentication
Password-only or basic MFA (SMS/OTP) at network login
Phishing-resistant MFA (FIDO2/PKI) enforced at app and privileged-session level
Continuous, risk-adaptive authentication using behavioral and contextual signals
Privileged Access Management (PAM)
Shared admin accounts; standing privileged access
PAM vault with just-in-time checkout and session recording for privileged accounts
Zero standing privilege; automated privileged-session analytics with anomaly-based revocation
Segregation of Duties (SoD) Enforcement
Manual SoD review during periodic audits
Automated SoD conflict detection in IAM/ERP systems
Continuous, real-time SoD enforcement blocking conflicting access at request time