Hands holding a smartphone in near darkness, lit by the screen.

Pillar 02 // Secure // Identity & Cybersecurity

Know who has access to what, and be able to prove it.

Identity is the control plane for everything a business runs. We design how people, devices and applications get access, keep that access accurate as things change, and take it away when it is no longer needed.

Book a discovery call See the capabilities

The problem

Access spreads faster than anyone tracks it.

Every new tool, team and hire adds accounts and permissions. New starters wait for what they need. People keep access after they change role. Leavers' accounts stay open. Shared logins appear because they are quicker.

Signs it is time

01Onboarding depends on someone remembering a checklist
02Nobody can say for certain who still has access after a role change or a departure
03Access reviews are a scramble before an audit or a renewal
04Administrator accounts are shared, or used for everyday work
05Customers or insurers ask security questions you can only partly answer

Fig 03 // Identity & Cybersecurity

Fig 03 // Access follows the person, then goes

Outcomes

What changes for the business

01 // What changes for the business

New starters get the access their role needs, when they need it
Access changes when the role changes, without a request for each system
Leavers lose access the day they leave
Owners review access on a schedule, not in a panic
One clear record of who can reach what, and why

02 // What the security work aims at

These are aims we design towards. We do not promise an outcome that has not been scoped with you.

Fewer ways in for an attacker
Accounts that are harder to take over
Administrator access kept under control
A clear view of what is happening across the environment
Less impact when something does go wrong
Governance you can show to an auditor, an insurer or a customer

Identity & Cybersecurity

Access should follow the person. Then it should go.

Six stages every person moves through. Choose one to see what should happen to their access.

Stage 01 // create

Join

Someone starts. Their identity is created and linked to their role.

Identity created from the HR record
Access assigned by role, not by request
Strong sign-in required from day one

Illustrative event // not client datajoin.event

{
  stage: join,
  trigger: hr.record.created,
  access: [role: finance-officer, apps: email, files, finance],
  mfa: required,
  decided_by: role policy
}

Stage 02 // update

Change

Someone changes role or team. Their identity is updated to match. This can happen many times.

Role change updates the identity
Access the new role needs is added
Access the old role needed is removed

Illustrative event // not client datachange.event

{
  stage: change,
  trigger: hr.role.changed,
  added: [apps: reporting],
  removed: [apps: payroll],
  leftover_access: none
}

Stage 03 // grant

Access

They are given the access their role needs, and no more.

One sign-in for every application
Only what the role needs
Extra access requested and approved, with a record

Illustrative event // not client dataaccess.event

{
  stage: access,
  request: shared-drive: projects,
  approver: data owner,
  expires: end of project,
  recorded: yes
}

Stage 04 // policy

Govern

Roles and policies, not one-off requests, decide who can have what.

Rules decide who may hold what
Conflicting access is prevented
Administrator access kept separate

Illustrative event // not client datagovern.event

{
  stage: govern,
  rule: no one approves their own payments,
  check: on every request,
  admin_accounts: separate, time-limited
}

Stage 05 // certify

Review

Access is checked again from time to time: owners confirm what is still needed and what should go.

Owners confirm what is still needed
Unconfirmed access is flagged for removal
A record of every decision

Illustrative event // not client datareview.event

{
  stage: review,
  cycle: scheduled,
  reviewer: application owner,
  decisions: [keep, remove],
  evidence: exportable
}

Stage 06 // revoke

Remove

Someone leaves, or no longer needs something. The access is removed.

Leaving removes access everywhere
Sessions ended, not just passwords changed
Nothing left behind to clean up later

Illustrative event // not client dataremove.event

{
  stage: remove,
  trigger: hr.record.ended,
  accounts: disabled across connected apps,
  sessions: revoked,
  leftover_access: none
}

Discuss identity

A person looking at a phone beside a window at night, with city lights beyond.

Method

How the work runs

DiscoverMap who and what has access today: people, roles, applications and administrator accounts, and where the gaps are.
DesignAgree the access model before anything is configured: roles, rules and owners, so security is designed in, not added afterwards.
ImplementSet up sign-in, provisioning, reviews and privileged access, and connect the systems that need to follow the rules.
OptimiseRun the first review cycles, tune the rules, and hand over what your team needs to keep it running.

Core capabilities

What is covered

Identity
Identity Governance & Administration (IGA)
IGA · JML · provisioning
Accounts and access created, changed and removed as people join, move and leave, with requests and approvals that leave a record.
Technical detail
Joiner, mover and leaver workflows from an authoritative source of people data, connector and API-based provisioning, standards-based provisioning where an application supports it, access request and approval flows, entitlement catalogues, and detection of orphaned accounts.
Identity
Identity Governance
RBAC · access reviews · SoD
Setting the rules for who may hold which access, and making reviews a routine rather than a scramble before an audit.
Technical detail
Role-based access with role modelling and clean-up, attribute-based rules for context, separation-of-duties rules, scheduled access-review campaigns, least-privilege reviews, and evidence for audit.
Identity
Identity Engineering
directory · identity provider
Designing how identities are created, connected and kept in step across the applications the business uses.
Technical detail
Identity provider and directory design, authoritative sources for people data, attribute models, lifecycle events, and the integration patterns that carry them to applications.
Identity
Access Management
SSO · MFA
One secure way in, and a second check that a stolen password cannot beat.
Technical detail
Single sign-on, multi-factor authentication, conditional access policy, and session and device signals.
Identity
Privileged Access Management (PAM)
PAM
Administrator and other high-impact accounts controlled: who can use them, when, and with a record of what was done.
Technical detail
Vaulting, just-in-time elevation, session recording, emergency-access procedures, and separating administrator accounts from everyday ones.
Cybersecurity
Cybersecurity Governance & Compliance
policy · risk · controls
Security policies, risks and controls set out clearly, so the business can answer the questions customers, insurers and auditors ask.
Technical detail
Security policy and control sets, risk registers, gap assessments against the framework the business chooses, incident-response readiness, and evidence preparation. Readiness support; certification is issued by the relevant body, not by HelptechX.
Cybersecurity
Penetration Testing
pen testing · remediation
Systems, applications and access tested under agreed rules, with findings ranked by risk and a plan to fix them.
Technical detail
Scoped, authorised testing of external and internal infrastructure, web applications and identity configuration. Scope and rules of engagement agreed in writing before any testing, findings ranked by risk, and a retest after remediation where agreed.
Cybersecurity
Endpoint Security
endpoints · hardening
The devices people work on are hardened, protected and kept up to date, and only trusted devices reach business data.
Technical detail
Endpoint hardening baselines, protection and detection tooling, disk encryption, patching, email and web protections, and device compliance tied to sign-in.

Related work

Also within this pillar.

Control who and what can reach your environment, and be able to show it.

Identity and access management (IAM) programmes
Engineering capacity and design help for an identity programme that has stalled, grown, or never had a clear plan.
MFA and passwordless roll-out
Stronger sign-in introduced in stages, so people are protected without being locked out.
Application onboarding and single sign-on
New and existing applications brought under the same sign-in and access rules as everything else.
Access reviews and audit evidence
Reviews that owners can actually complete, and records you can hand to an auditor, insurer or customer.
Zero Trust planning, starting from identity
A practical sequence of steps towards checking every request, beginning with who is asking and from what.
Security engineering for identity and cloud services
Configuration hardening and sensible defaults for the identity and cloud services the business already runs.
Also draws on Digital Transformation
Identity platform health checks
A look at how an existing identity platform is set up, and a prioritised list of what to fix.
Something related, not listed?
These lists are representative, not exhaustive. If your need sits close to this area, describe it and we will tell you plainly whether it is work we do.
Describe what you need

Engagement

Ways to work together.

Advisory
Design and engineering
Implementation and integration
Ongoing support
Review and optimisation

Questions

Do we need to replace the tools we already use?

Not usually. The first step is understanding what is in place and what it can already do. Any change is proposed against your environment and scoped with you before work starts.

Is this only for large organisations?

No. The problems appear as soon as a business has more than a handful of applications and people joining and leaving. The approach is scaled to the business, and the smallest useful step is often a leaver process that actually works.

What is the difference between identity and cybersecurity?

Identity decides who can reach what. Cybersecurity is the wider set of controls that protect the environment. Most of those controls depend on identity being right, which is why we design it first.

Do you recommend particular products?

The design starts from your environment and the problem, not from a product. Where a product choice is needed, we set out the trade-offs so the decision is yours.

01
AI & Automation
Automations act with someone's access. Governed access is what makes them safe to leave running.
03
Managed IT
Onboarding, offboarding and device access are identity events, and Managed IT is where they are carried out every day.
04
Digital Transformation
Administrator access, hosting accounts and site security are identity problems too.

Start with the problem.

Tell us what is getting in the way, and we will take it from there.

Book a discovery call Not sure where to start? Run the diagnostic

Know who has access to what, and be able to prove it.

Access spreads faster than anyone tracks it.

What changes for the business

Access should follow the person. Then it should go.

Join

Change

Access

Govern

Review

Remove

How the work runs

What is covered

Identity Governance & Administration (IGA)

Identity Governance

Identity Engineering

Access Management

Privileged Access Management (PAM)

Cybersecurity Governance & Compliance

Penetration Testing

Endpoint Security

Also within this pillar.

Identity and access management (IAM) programmes

MFA and passwordless roll-out

Application onboarding and single sign-on

Access reviews and audit evidence

Zero Trust planning, starting from identity

Security engineering for identity and cloud services

Identity platform health checks

Something related, not listed?

Ways to work together.

Questions

Related pillars

AI & Automation

Managed IT

Digital Transformation

Start with the problem.