Identity Sprawl and Privileged Access After a University Merger
Riverton State University System is merging three community colleges into one shared services organization: 78,000 identities, 1,200 privileged accounts, and 11 IAM tools. An audit found 240 orphaned accounts, nine shared local administrator credentials, and no MFA on 38 service accounts tied to the ERP. Each college has its own help desk and Active Directory domain; 35% of endpoints grant local admin to users. The new CIO wants a zero-trust program in 18 months. The Faculty Senate opposes mandatory MFA for research computing, citing collaboration with external labs. The registrar reports that FERPA-protected student records are accessed by 600 staff across three domains, and a recent access review was completed by only 42% of managers.
1. Prioritize the IAM remediation work and justify the order.
Read the worked answer
Prioritize by blast radius and evidence of active risk. First remove the nine shared local administrator credentials and the 240 orphaned accounts, and enforce MFA for the 38 ERP service accounts or migrate them to managed identities. These are immediate paths to privilege abuse and data exposure. Second consolidate the three Active Directory domains and help desks under one identity governance process, because the merger multiplies orphan and privilege risk. Third implement joiner, mover, and leaver automation for the 78,000 identities and access reviews for FERPA data. Zero trust in 18 months is unrealistic if foundational identity hygiene is missing; sequence identity proofing, MFA, privileged access, and least privilege before microsegmentation. Report progress in orphan accounts removed, privileged accounts under management, MFA coverage, and review completion.
2. Design a privileged access governance model for the merged organization.
Read the worked answer
Create a privileged access management program: vault all administrator credentials, eliminate shared accounts, require just-in-time elevation with approval, record sessions for tier-0 systems, and define break-glass procedures. Tier administrators by system criticality. For the ERP service accounts, use managed service accounts or secrets rotation rather than static passwords. Require quarterly recertification by system owners and monthly anomaly review. Measure standing administrator accounts, unvaulted secrets, and time to revoke access. This model addresses the audit findings directly and gives the CIO a measurable path toward zero trust rather than a label.
3. Propose a data protection governance model for FERPA records that also addresses the Faculty Senate concerns.
Read the worked answer
Use a data governance council with the registrar, research office, CIO, CISO, and faculty representatives. Classify data by FERPA, research contract, and public status, and define access rules by data domain. For research computing, offer a defended enclave or risk-based step-up MFA rather than a blanket exemption. Require data stewards to approve access and complete reviews; automate attestation from HR and enrollment feeds. Publish exception criteria and an appeal path. This addresses faculty autonomy while keeping FERPA accountability explicit and measurable, and it prevents the 42% review completion problem from persisting.