Identity and access

- Identity provider and federation strategy - MFA coverage and phishing-resistant methods - Privileged access management (PAM) maturity - Just-in-time and just-enough access - Machine identity and service account management