- ✅ Example tabs with 8 key KPIs, pre-filled
- ✅ Ready-made template you can adapt for your own organisation
- ✅ Aligned with ISO 27001 and NIS 2 control frameworks
What does it mean to be in control?
Being in control of your identities boils down to four aspects: security, risk, operational efficiency, and compliance. The Identity Indicator Canvas gives you a starting point to measure all four — without needing a year-long IGA project.
The 8 categories
Most organisations care about the same core set of identity indicators. The canvas covers eight categories that, together, give you a defensible picture of where your IAM stands today.
Orphaned Accounts
Accounts no longer active or with no owner — a classic foothold for attackers and a drag on your IAM hygiene.
Privileged Accounts
Track who holds admin or elevated rights — and whether those rights are still justified.
Inactive Accounts
Dormant accounts that haven't been used in a defined window (often 90 days for standard, less for privileged).
External Identities
Contractors, guests and partner accounts that often outlive their original purpose.
Role & Permission Sprawl
Accounts with an unusually high number of roles or permissions — a sign that least-privilege has eroded.
Separation of Duties
Toxic combinations: people who can both submit and approve the same sensitive transaction.
Access Reviews Coverage
Which systems and which user populations have actually been reviewed in the current cycle.
Data Quality
How complete and timely is the identity data feeding all the above? Garbage in = false confidence.
How to use the canvas
Open the Excel template, work through the pre-filled example tab to get a feel for the structure, then duplicate it for your own org. Use the rule-of-thumb thresholds we included as a starting point — adjust to match your risk appetite, then track each indicator over time.
One useful rule of thumb: an account flagged as having a "high" number of roles or permissions is one where the total exceeds twice the average for its population. Tune from there.
Want to go further?
The canvas is intentionally lightweight. If you want continuous tracking, separation-of-duties analytics, or automated access reviews on top of the same indicators, that's exactly what Elimity Insights does — see it in action with a 20-minute demo.
Ready to apply this to your environment?
Book a 20-minute call with our team — we'll walk you through Elimity Insights on your own scenarios. No pressure.