The Contractor Whose Role Outlived the Project
Priya joined Meridian Health as a contract data analyst in March to support a 6-month claims-migration project. Her access was provisioned by copying the role template of a departing employee, which included read access to the claims warehouse and write access to a reporting share. The project ended in September, but no one disabled her account because the project had no defined end date in the identity system and her manager had transferred departments. In November, an access review ran. Priya's new de facto manager-who had never met her-certified her access as 'still needed' because the reports she produced appeared in a weekly dashboard. A quarterly reconciliation shows 41 contractor accounts with no active sponsorship, and 12 of those have logged in within the last 30 days. The CISO wants a recommendation before the next audit cycle, which begins in three weeks.
1. Diagnose why the access review failed to catch Priya's stale access, and identify the two or three root causes worth fixing first.
Read the worked answer
The review failed at three linked points:
- Certification by the wrong authority. Priya's certifier was a manager who had no relationship with her and no basis to judge need. The dashboard artifact made the access look used, which is not the same as needed. Reviews must be certified by someone who can actually attest to the business requirement-here, the project owner or a named sponsor.
- No lifecycle anchor. The account had no project end date, so no event triggered deprovisioning. Contractor identities should carry a defined expiry that is enforced by the IGA platform, not tracked in a spreadsheet.
- Role template copying. Provisioning by cloning a departing employee's entitlements imported access Priya never needed, and it bypassed any role-based justification. This inflates the blast radius and makes reviews harder.
Prioritize: (a) enforce contractor expiry and sponsorship at provisioning, (b) route certifications to sponsors/project owners rather than line managers, (c) replace copy-the-predecessor provisioning with a defined contractor role.
2. The 41 unsponsored accounts must be handled before the audit. Recommend an approach and explain the tradeoffs of acting immediately versus investigating first.
Read the worked answer
A defensible approach is tiered containment, not a blanket disable:
- Immediately disable or lock the 12 accounts with recent logins after confirming with their owners whether activity is legitimate; if no owner can be reached within 48 hours, disable and notify. Disabling first and investigating second is appropriate when there is no accountable sponsor-unsponsored access is by definition unauthorized.
- For the remaining 29, suspend rather than delete, preserve logs, and start a 5-business-day owner-identification sprint. Deletion destroys evidence the auditor may want.
Tradeoffs: acting immediately reduces risk and demonstrates control before the audit, but can break legitimate batch jobs or shared service accounts if any of the 41 are machine identities mislabeled as contractors-so check account type before disabling. Investigating first is safer operationally but leaves a known gap open during an audit window and signals weak response. The middle path-contain now, remediate ownership after-balances both. Document every decision with timestamps so the auditor sees a controlled process rather than a scramble.