W3SAMM

Identity and Access Management

Control Criteria

You have a method of tracking users or identities within your org or project by alias or identity
You have a method of integrating authentication mechanisms into your technical and business or project workflows
Level 1: Is there a basic system for user authentication, possibly using common credentials or simple key-based access for participants?
Level 2: Are there more advanced, multi-factor authentication systems in place, catering to the decentralized and pseudonymous nature of users, while ensuring secure access control?
Level 3: Is there a sophisticated, dynamic authentication and authorization system that adapts to user roles and contexts, integrating decentralized identity solutions where applicable?

Control Criteria

You have identified roles for each person in the project or org
There is some separation of roles / permissions for identities
Level 1: Are basic privileges assigned based on user roles, even if these roles are not tied to real-world identities?
Level 2: Is there an advanced system for managing privileges that reflects the dynamic and distributed nature of the team, with periodic reviews?
Level 3: Are privilege management processes highly evolved, with automated role-based access control and continuous monitoring for anomalous access patterns?

Control Criteria

You can verify authenticity of identities within your workflows
Level 1: Is there a basic form of identity proofing, possibly relying on community reputation or existing trust networks?
Level 2: Are there more structured identity verification processes that balance the need for some form of reliable identification with the respect for pseudonymity?
Level 3: Is there a comprehensive identity verification system that effectively manages risk while accommodating the decentralized, pseudonymous nature of the community?

Control Criteria

There is a method for provisioning and deprovisioning identities or accounts
Level 1: Is there an initial process for managing the lifecycle of identities (creation, maintenance, deletion) in a decentralized environment?
Level 2: Are there advanced processes in place for systematically managing the identity lifecycle, including periodic verification and adjustment of access rights?
Level 3: Is the identity lifecycle management process fully integrated, featuring continuous updating and refinement, and leveraging decentralized technologies where appropriate?

This site is open source. Improve this page.