SaaS Identity Lifecycle and a Marketing Data Export
A SaaS company with 80 employees and 15 contractors stores customer names, email addresses, support tickets, and partial payment card data. Contractors use personal laptops and share one 'support-admin' account for the ticketing system because licenses are expensive. When an employee leaves, HR emails IT, but there is no checklist; last quarter two departed employees still had active accounts 30 days later. The company uses single sign-on for email but not for the ticketing or billing systems. Marketing wants to export all customer emails to a third-party analytics tool. The privacy policy says data is kept only as long as needed, but no retention schedule exists. An access review has never been performed. The company must answer a customer security questionnaire in two weeks.
1. Identify the identity-lifecycle failures and propose immediate containment.
Read the worked answer
The failures are: no joiner-mover-leaver process, no reliable offboarding trigger, partial SSO, shared privileged accounts, contractors on unmanaged devices, and no access review. The two departed employees with active accounts 30 days later are a concrete confidentiality risk and would be a serious questionnaire finding. Immediate containment: disable the two departed accounts and review all accounts for other leavers. Rotate the shared support-admin password and stop using it. Enforce MFA on ticketing and billing, then bring those systems under SSO if possible. Build a leaver checklist with HR, IT, and the system owners; require a ticket and evidence. Produce an account inventory with owner, role, last login, and MFA status. For contractors, require named accounts, a sponsor, and an end date. These steps are achievable in two weeks and directly answer the questionnaire. A full access review can follow, but the leaver accounts and shared admin account cannot wait.
2. How should contractor access and the shared support-admin account be redesigned?
Read the worked answer
Replace the shared account with named contractor accounts tied to a sponsor and a contract end date. Give only the permissions needed for assigned tickets; do not grant admin by default. Use time-bound roles and require MFA. If contractors use personal laptops, either provide a managed virtual desktop or apply minimum endpoint checks before access. Log contractor actions and review them monthly. The shared support-admin account should be removed or converted into a break-glass account with a strong credential in a vault, MFA, and alerting on every use. Normal support work should use individual accounts with role-based permissions. This improves accountability, least privilege, and revocation. It also helps the questionnaire: the company can show that contractor access is approved, limited, monitored, and removed on schedule. License cost is not a sufficient reason to keep a shared privileged identity.
3. Evaluate the marketing export and the missing retention schedule against privacy principles.
Read the worked answer
Exporting all customer emails to a third-party analytics tool raises purpose limitation, data minimization, and third-party processor issues. Marketing should define the purpose, export only the fields needed, and avoid sending support-ticket content or payment data. The analytics vendor needs a data processing agreement, security review, and restrictions on secondary use. Customers may have consented only to service emails, not broad analytics; legal should check the privacy notice and applicable law. The missing retention schedule violates the stated policy of keeping data only as long as needed. Create retention periods by data type, automate deletion where possible, and document exceptions. Payment card data should be minimized or tokenized; partial card data still needs protection. Before the questionnaire, produce an inventory of data types, purposes, locations, and retention. Then answer honestly with a remediation plan rather than claiming controls that do not exist.