CIIM key terms

The set of policies, processes, and controls that ensure the right people have the right access to the right resources for the right reasons, with evidence that this is true.

The end-to-end process of creating, changing, and removing digital identities as people join, move within, or leave an organization. It typically covers joiner, mover, and leaver events.

A recurring review in which managers or resource owners confirm that each user's existing entitlements are still justified. Unconfirmed access is revoked, producing an auditable record of the decision.

A control that prevents one person from holding combinations of permissions that would let them both commit and conceal a harmful act, such as creating a vendor and approving its payment.

A specific pair or set of entitlements that together create unacceptable risk even though each entitlement is individually reasonable. Detection requires analyzing permissions across systems, not just within one.

The analytical process of examining existing access assignments to discover common patterns and derive business roles. The resulting roles simplify provisioning and make access reviews easier to interpret.

A specific permission, group membership, or attribute value granted to an identity on a target system. Entitlements are the atomic units that reviews, policies, and risk analysis operate on.

An account that remains active on a system after its owner has left the organization or changed roles, usually because no automated link exists between the HR record and the target system.

The automated creation and configuration of accounts and entitlements on target systems, driven by authoritative identity data. Deprovisioning, its counterpart, removes access when it is no longer needed.

The system of record an identity program treats as the definitive truth for a population, such as the HR database for employees. Other systems are reconciled against it rather than trusted independently.

The principle that each identity receives only the access needed to perform its current duties, for only as long as needed. It limits the damage any single compromised account can cause.

An access model where permissions are bundled into roles and users receive roles rather than individual entitlements. This makes assignment and review more consistent and easier to audit.

An access model that evaluates attributes of the user, resource, action, and environment against policy at request time. It supports fine-grained, context-aware decisions that static roles cannot express.

An authentication arrangement in which one successful login grants access to multiple applications through a trusted session or token, reducing password fatigue and the number of credential exposures.

A trust arrangement in which separate organizations or domains accept each other's authentication assertions, letting users access external services with credentials issued by their home organization.

An XML-based standard for exchanging authentication and authorization assertions between an identity provider and a service provider. It is common in browser-based enterprise federation.

An identity layer built on OAuth 2.0 that lets a client verify a user's identity and obtain basic profile claims. It issues a signed ID token alongside an access token.

A framework for delegated authorization in which a resource owner grants a client limited access to a protected resource without sharing credentials. It issues access tokens with defined scope.

A parameter in delegated authorization that declares which permissions a client is requesting or has been granted. Overly broad scopes increase the impact of a leaked token.

The explicit approval a user or administrator gives before an application receives access to protected data. Consent screens should state clearly what data and actions are being authorized.

Access that confers administrative or elevated control over systems, data, or other accounts. Because compromise of such access is highly damaging, it receives stricter controls and monitoring.

The tools and practices used to vault, rotate, broker, and record the use of high-risk credentials. It typically includes session recording and approval workflows for elevated access.

A model in which elevated permissions are granted only for a limited window and then automatically removed. It reduces standing privilege that attackers could exploit if an account is compromised.

Access that remains assigned continuously rather than being activated only when needed. Persistent administrative rights enlarge the attack surface and are a common target for lateral movement.

The practice of labeling information by sensitivity and business value so that handling rules can be applied consistently. Labels drive encryption, retention, and access decisions.

Collecting and keeping only the personal data actually needed for a stated purpose. It reduces breach impact and is a core principle in many privacy regulations.

The rule that personal data collected for one stated purpose may not be reused for an unrelated purpose without a lawful basis. It constrains secondary use and sharing.

Technology that inspects content and context to detect and block unauthorized movement of sensitive data, such as through email, uploads, or removable media.

Protecting stored data by converting it to ciphertext so that stolen disks, backups, or database files are unreadable without the key. Key management is the critical dependency.

Protecting data while it moves across networks by using transport protocols such as TLS, so that interception does not expose content. It complements, but does not replace, protection at rest.

Replacing sensitive values with non-sensitive substitutes that map back to the original only through a protected vault. It reduces the scope of systems that must store regulated data.

The lifecycle of generating, distributing, rotating, storing, and destroying cryptographic keys. Weak key handling defeats encryption regardless of algorithm strength.

Rules defining how long each class of data is kept and when it must be securely destroyed. Good retention limits both legal exposure and the volume of data available to attackers.

The entitlements individuals hold over their personal data, such as access, correction, deletion, and portability. Organizations must be able to locate and act on that data on request.

The discipline of measuring and reducing the likelihood and impact of harm arising from identities, their credentials, and their access. It blends access analytics, behavior monitoring, and remediation.

Assigning a numeric value to a user, session, or access request based on signals such as privilege, behavior anomalies, and data sensitivity. Scores drive step-up authentication and review priority.

Adjusting authentication requirements according to the assessed risk of a login attempt, for example demanding an extra factor for an unusual location or device.

Monitoring patterns of user and entity activity to establish a baseline and flag deviations that may indicate compromise, such as unusual access times, volumes, or peer-group comparisons.

The practice of continuously detecting identity-based attacks in progress, such as credential misuse or token theft, and responding quickly to contain them before they spread.

A detection signal triggered when the same account authenticates from two geographically distant locations within a timeframe that makes physical travel infeasible, suggesting credential or session compromise.

The process of verifying that a claimed identity corresponds to a real person, using evidence such as documents, biometrics, or authoritative records, before issuing credentials.

A fraud pattern in which an attacker gains control of a legitimate customer account, often through phishing, credential stuffing, or SIM swapping, and then misuses it for theft.

An automated attack that replays username and password pairs leaked from one breach against other services, exploiting password reuse. Rate limiting and breached-password checks reduce its success.

A fictitious identity assembled from a mix of real and fabricated data, such as a real national ID number with a fake name. It is used to open accounts and build credit before defaulting.

A fraud technique in which an attacker convinces a mobile carrier to transfer a victim's phone number to a SIM they control, capturing SMS codes used for authentication or account recovery.

Requiring two or more independent verification factors, such as something you know plus something you have, before granting access. It blocks many credential-only attacks but is not immune to phishing.

Authentication that removes shared secrets entirely, relying instead on cryptographic keys, hardware tokens, or biometrics. It eliminates password reuse and phishing of static credentials.

A standards-based authentication approach using public-key cryptography bound to an origin, so credentials cannot be replayed on a phishing site. It underpins many passkey implementations.

Authentication designed so that a deceived user cannot hand an attacker usable credentials, typically through origin-bound public-key cryptography rather than shared secrets or typed codes.

An attack in which a user approves a malicious application's request for access to their data, giving the attacker persistent API-level access that survives password changes.

Stealing or forging an active session token so the attacker inherits an already-authenticated session, bypassing the login step entirely. Short token lifetimes and binding tokens to context limit it.

An account that has not been used for a defined period but remains enabled. Dormant accounts are attractive to attackers because unusual activity on them draws less attention.

A configured link in which one system accepts identity assertions or delegated authority from another. Each trust widens the blast radius if the trusted party is compromised.

A code valid for a single login or short window, generated by hardware, an app, or delivered by message. Delivered codes are vulnerable to interception and relay phishing.

An organized group coordinating multiple identities or accounts to commit fraud at scale, often sharing tools, synthetic identities, and laundering infrastructure across many victims and institutions.