Identity And Access Management

The long view, in annual and quarterly filings

A 10-K or 10-Q is a periodic report, so this counts how often the phrase appears in routine annual and quarterly reporting. It moves far more slowly and the numbers are larger. Every month since 2008. The last point is the current month and is still filling, so it always looks lower than it will be.

Who disclosed it

From SEC full-text search over 8-K filings. Every row links to the filing itself.

The full search on EDGAR

Who is hiring for it

A sample of the open roles naming this phrase. An employer paying a salary against something is the least ambiguous demand signal there is, and every row links to the posting so the claim can be checked rather than believed. The total above is the whole US market; these are the ones we hold the posting for.

Which industries file it

Companies grouped by the industry classification on their own filing. A count, not a survey.

What it obligates

Our corpus holds 29 controls across 28 frameworks whose text speaks to this. Not a judgement: these controls say so, and each is one lookup from its source document. Ordered by how much each framework has to say about it, so the one that will cost you the most work is first. Every name opens that framework in the corpus.

What an auditor will ask you to produce

The artefacts named on those controls, most frequently cited first.

• The approved identity and access management policy with approver and date
• Annual review record
• The procedures implementing it, such as provisioning and review procedures
• Evidence of communication to the teams that grant access
• IAM concept document
• Periodic access review reports
• Privileged account inventory
• IAM policy

How it usually fails

Recorded when each control was verified against its source. This is where programmes that think they are covered turn out not to be.

• Policy written and never implemented in the systems it governs
• Annual review missed
• Procedures exist for the main directory only, leaving cloud and application identity ungoverned
• No periodic recertification
• Shared accounts in use
• Identity and access management policy is fragmented across systems

What this obligates

The instruments in our corpus that govern this disclosure, and how many controls sit behind each. This is not a filing count. It is what applies once a company has written the phrase down.

5 frameworks, 259 controls between them.

What closing it also moves

The same controls appear in other frameworks through mappings held in our corpus. Work done here is already progress there. This is the part that is not in EDGAR and not in any public dataset: it comes from mappings built and verified by hand, control by control.

Counted as controls reached through cross-framework mappings. It measures overlap of work, not compliance with the named framework.

Today's edition · How programmes fail · The obligation index