Identity security maturity is easy to overstate and just as easy to oversimplify. For an IT leader, the real question is not whether the organisation owns an identity tool. It is whether identity controls are connected, repeatable, risk aware and able to show that they worked. Citadel Identity360 supplies the lifecycle records, review outcomes and risk context that make that question answerable without a heavyweight scoring exercise.
The practical lens is simple: inspect a few real identity processes and judge where control is still manual or fragmented. You do not need a universal score. You need a clear view of what is governed well, what is brittle and what to fix next, whether the estate runs in the cloud, in SaaS or in your own data centres.
What identity maturity really reflects
Identity maturity is the consistency of your governance, not the number of tools you own. A mature environment knows who and what has access, grants and removes that access through a defined process, reviews permissions with context, notices risk and keeps evidence that holds up when an auditor starts asking questions.
That means treating identity as more than employee accounts. The NIST Cybersecurity Framework 2.0 makes this explicit in its Protect function: identities and credentials for authorised users, services and hardware are managed by the organisation, and access permissions are defined in policy, managed, enforced and reviewed with least privilege and separation of duties in mind. A real assessment therefore covers contractors, partners, privileged users, service accounts, workloads and AI agents. If any of those populations sits outside normal governance, maturity is uneven by definition.
Many teams look at a directory or an MFA rollout and assume the job is finished. Those are useful controls, but they prove little unless they are tied to lifecycle decisions, permission management and remediation.
Four stages you can recognise without a consultant
The CISA Zero Trust Maturity Model describes four stages, Traditional, Initial, Advanced and Optimal, across its Identity pillar, and notes that each later stage demands greater protection, detail and complexity. Treat the patterns below, adapted from that model, as a recognition guide rather than a grading system.
Traditional
Identity stores are mostly self-managed and weakly connected. Access tends to be permanent, risk checks are limited and staff onboard, change and disable accounts by hand. Next move: a dependable inventory with named owners, starting with high-risk accounts.
Initial
MFA covers many users, but access remains largely static. Hosted and self-managed stores coexist with little integration, and identity risk is judged with manual methods and static rules. Next move: connect authoritative sources and priority applications, automate predictable joiner, mover and leaver cases, and make reviews repeatable.
Advanced
Identity stores are being consolidated and phishing-resistant authentication starts to reach every identity. Some access decisions draw on automated analysis, and orchestration is automated across environments. Next move: close gaps in privileged, external and application coverage, and measure whether review decisions become completed access changes.
Optimal
Identity is validated continuously, risk is judged in real time and identity policy is automated enterprise-wide. Treat this as a direction, not a destination every organisation must reach. CISA expects effort and benefit to rise together, so prioritise the controls your business, threat and regulatory picture genuinely demand.
Maturity is not one average. You can be advanced in lifecycle automation and weak in non-human identity governance, so rate each capability on its own.
Swap the score for a current and target profile
NIST CSF 2.0 offers a lightweight way to run this. Its Organisational Profiles pair a Current Profile, the outcomes you achieve now, with a Target Profile, the outcomes you have chosen to prioritise. You analyse the gaps and build a prioritised action plan. Its four Tiers, Partial, Risk Informed, Repeatable and Adaptive, describe the rigour of risk governance across the whole organisation rather than an identity-specific ladder.
For identity, keep the profile narrow. Pick five critical applications and the identities that reach them. For each capability below, note the current state, the target that fits your risk and obligations, and the two or three gaps that matter most. The result is a programme self-assessment a leadership team can read in one sitting and repeat each quarter.
Inventory and ownership come first
Can you name the identities and systems you actually govern? List your high-value applications and identity sources, then check whether you hold a reasonably complete view of accounts and access across them. For each identity, record the source record, owner, purpose and the systems it can reach.
Warning signs of an early-stage programme include:
- teams maintaining incompatible spreadsheets
- nobody able to say who owns a service account
- an application missing from central access reviews
- accounts discovered only after a departure or an audit request
NIST SP 800-53 sets a useful bar in control AC-2, Account Management: define allowed account types, assign account managers, require approval for new accounts, manage accounts according to policy and review them on a defined schedule. Our guide to identity sprawl and access ownership explains why unowned accounts multiply so quickly.
Citadel Identity360 pulls accounts and entitlements from connected systems into one governed inventory. Third-party accounts can be grouped by vendor, so supplier access is counted against the organisation it belongs to rather than scattered across applications.
Trace a joiner, a mover and a leaver
A mature process is easiest to spot when you follow one real person through it. Take a recent hire, a role change and a departure. Trace each from the authoritative source record through approval, provisioning and completion in the target systems. Ask who initiates the change, which steps are automated, where exceptions go and how you know access was actually removed.
Lower-maturity processes lean on tickets and email that prompt follow-up but never prove the result. Mature ones are documented, repeatable and able to show both the decision and its completion.
Role changes deserve special attention, because many organisations handle hires and terminations better than transfers. When new access is added but obsolete permissions stay, the identity lifecycle becomes a source of risk. Our article on automating mover events safely covers that transition, and our piece on excess access and lateral movement shows what leftover permissions cost after a compromise.
Citadel Identity360 turns each of those three events into an orchestrated workflow: a hire triggers provisioning, a transfer triggers removal as well as addition, and a departure triggers deprovisioning across connected systems. Contractors carry a sponsor and an engagement end date, so outside access has a natural expiry point. For an application with no provisioning interface, RPA-based integration carries the approved change through its user interface, alongside connectors, directories, databases and file-based methods.
Test authentication and authorisation for quality, not presence
For authentication, ask where MFA is enforced, whether it covers privileged and externally reachable access, which applications bypass it and whether you can tell phishing-resistant methods apart from the rest. CISA guidance on implementing phishing-resistant MFA calls it the gold standard and urges organisations to make migration a high priority, treating one-time codes and push with number matching as the best options only where phishing-resistant methods cannot be adopted immediately.
For authorisation, look for a documented business purpose, approver, owner and least-privilege rationale. Check whether privileged work runs through separate administrator identities, whether roles reflect real work and whether separation-of-duties conflicts are identified. Zero trust guidance in NIST SP 800-207 centres on giving each subject the least privilege its task requires, which is a fair test for every role you inspect.
If role definitions exist only on paper, or reviewers lack context to decide, governance is still fragile. Citadel Identity360 supplies that context through its identity graph, a connected picture of how people, roles, permissions and applications relate, and through SoD conflict detection that highlights toxic combinations.
Make reviews and evidence close the loop
For a small sample of access decisions, see whether you can show the identity, entitlement, decision-maker, rationale, timestamp, outcome and remediation status. If assembling that means reconstructing the story from several teams, the control is not yet closed-loop. A campaign that produces an attestation but no completed change falls short, and so does a revoke decision that never reaches the target system.
Signs of progress include certification campaigns that run predictably, traceable exceptions and evidence retrieved without manual reconstruction. Our comparison of continuous compliance and point-in-time audits shows why evidence gathered as work happens beats evidence rebuilt before an audit.
Citadel Identity360 brings a detailed access review module, with scheduled campaigns and risk context on every line a reviewer sees, and identity attestation, where owners attest that each account they sponsor still has a reason to exist. Every revoke decision is followed through to completion, so the result is recorded beside the decision that caused it.
Govern machines and AI agents on their own terms
Your assessment should cover service accounts, application and workload identities, credentials and agents. Each needs a named owner, a stated purpose, limited permissions, tracked creation and retirement, and periodic review. Do not force them into the employee model: a workload is not an interactive account, and interactive MFA is not the answer for every identity type.
Non-human identity governance is built into Citadel Identity360 rather than bolted on. Service accounts, API keys, machine identities and AI agents each get an owner on day one and keep one until retirement. Agent discovery draws on the central registries in AWS, Google Cloud and Microsoft Entra, and Citadel endpoint agents add the AI agents found running on endpoints, which brings shadow AI into the count. Each MCP server and each agent is registered against an owner, tools are authorised individually, and a kill switch lets teams intervene and contain an agent when needed. On the cloud side, the CIEM capability gathers permissions, scopes, grants, policies and usage data and presents a 360-degree view of the key actions to take.
A short baseline beats a long framework
For a selected set of critical applications, record:
- the share of discovered accounts represented in the inventory
- the share with an accountable owner and purpose
- whether contractors, service accounts, workloads and agents sit inside normal governance
- whether granting, role changes and departures follow documented workflows
- where MFA is enforced, and where phishing-resistant methods protect higher-risk users
- whether reviews find and remove unnecessary access
- how much manual follow-up remains
These are indicators of change over time, not universal benchmarks. State the population and period, and compare like with like.
Citadel Identity360 can feed this baseline. Risk scores, which you can customise, are calculated for managers, departments, applications, individual identities and the organisation as a whole. They show where exposure is concentrated, so you can decide which gaps to close first. The scores inform your judgement; the maturity view remains your own programme self-assessment.
Where Citadel Identity360 takes the next step
When a self-assessment exposes gaps, the answer is not a more elaborate framework. It is connecting the systems and workflows you already depend on, with governance that reaches every identity type.
Deployment does not force a compromise: Citadel Identity360 runs as SaaS, in a private cloud or on-premises, so the governance layer fits the estate you assessed. The platform also comes with roughly 400 hours of customisation, which teams can spend on the workflows, reports and policies their self-assessment flags as priorities.
An illustrative quarter
Picture a regional bank that scopes its first profile to five applications and finds unowned service accounts and a payments application missing from reviews. In Citadel Identity360, owners are assigned, the application joins the next campaign and department risk scores steer reviewers toward the heaviest exposure. A quarter later, its Current Profile has moved on ownership and review coverage. The bank is hypothetical, used only to show the method, not a real customer.
FAQ: identity maturity self-assessment
Is there a single universal identity maturity model?
No. The CISA model offers a four-stage Identity pillar that works well as a guide, and NIST CSF 2.0 Tiers describe broader risk governance. Neither is a universal identity-specific requirement.
Does MFA mean an organisation has reached an advanced stage?
No. Coverage, phishing resistance, lifecycle control, permissions, reviews and evidence all count, and an organisation can have MFA alongside weak identity governance.
How should machine and AI-agent identities be assessed?
Inventory them, assign an owner and purpose, limit permissions, manage credentials and lifecycle, and review access. Do not treat them as ordinary human accounts.
Should every organisation aim for the Optimal stage?
Not automatically. The right target depends on risk, obligations and operational complexity.
What evidence can Citadel Identity360 add to a self-assessment?
A governed inventory, lifecycle records, review and attestation outcomes, and customisable risk scores. Your team defines the current and target state and judges the gaps; Citadel Identity360 provides the records that show whether the gaps are closing.
Run the check on one application
Pick one critical application, trace a joiner, a mover and a leaver through it, and sample five review decisions. Next, connect that application to Citadel Identity360 and turn each gap into owned, tracked work. Request Demo and we will run the exercise with you, or watch the product in action first on our videos page.