- Least privilege by default.
- Just-in-time access for privileged roles.
- MFA required for administrative access.
- Privileged Identity Management (PIM) for elevated roles.
- Quarterly role reviews for critical subscriptions.
- Break-glass accounts monitored and restricted.
- PIM activation logs
- Role review reports
- Access recertification records
- Metrics & KPIs:
07-metrics-and-kpis.md - Incident response:
11-incident-response.md