Identity Lifecycle Responsibility Matrix
Splits responsibilities between HR, line managers, IT and system owners for each lifecycle event.
Available soon
- Format
- Excel
- Size
- 64 KB
- Length
- 12 sheets
- Version
- 2.0
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 2.0
Rewritten to the depth of the other CISO Times packs: the sixteen activities with accountable and responsible roles named by formula, role holders with deputies and duty counts, who answers for each step of each lifecycle event, and a separation check that no role both approves access and makes the change (JML-05, P02 SOD-IT-01).
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Read the Responsibilities sheet. Each row is one activity, with the rule it serves. Across are the nine roles: R does it, A answers for it (exactly one per activity), C is consulted before, I is told after. |
| 2 | Adjust the letters to how your organisation works. Keep exactly one A per row: the Check column says when a row has none, or two. Keep the approval of access (RA-06) away from the roles that make changes (RA-08, RA-09): the Separation Check sheet refuses a role that does both. |
| 3 | On Role Holders, name the person or post that holds each role, a deputy who acts when they are absent, and whether it is a person, a team or a provider. The counts show how many activities each role does or answers for. |
| 4 | Read Lifecycle Events: for each lifecycle event, the activities it calls for and who answers for each, from the matrix. Use it to brief HR, line managers and the service desk on their part of each event. |
| 5 | Add activities of your own on the blank rows of Responsibilities, with an ID in the same form and the rule they serve. The Separation Check counts them. |
| 6 | Review the matrix with the Access Control Policy, at least every [[12]] months, and whenever a role holder or a provider changes. Record the review on Document Control. |
| 7 | To clear the EXAMPLE, delete the contents of the Example column, replace the role holders, and keep or change the letters. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. The process owner is the Head of IT and the monthly report is owned by the Head of Information Security. The letters are the pack's own (RA-01 to RA-16); the example organisation adopted them unchanged on 1 Jul 2026, and names its role holders on Role Holders.
Delegation: a deputy acts for a role while its holder is absent and is bound by the same rules. A deputy for an approver never makes the change they approve.
Adapting for a small organisation: one person may hold several roles, but the person who makes a change in a system never approves it (JML-05). Where IT is one person, the line manager and the system owner approve and that person makes the change.
Adapting for a regulated entity (NIS2, DORA): the approved matrix shows that roles and responsibilities for access management are assigned (NIS2 Article 21(2)(i); Delegated Regulation (EU) 2024/1774 Article 21(e)). Keep each approved version.
Adapting where a service provider runs your IT: the provider usually holds the service desk and administrator roles. Approvals, the process owner and the reconciliation's accountability stay inside your organisation.
Responsibilities
R does it · A answers for it, exactly one per activity · C is consulted · I is told. Yellow cells are yours; the last three columns calculate. A role that approves access never makes the change (JML-05).
| Example | Activity ID | Activity | Rule | HR | Line manager | IT service desk | System owner | System administrator | Sponsor | Process owner | Head of Information Security | Campaign coordinator | Accountable (calc) | Responsible (calc) | Check (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | RA-01 | Record a joiner, mover, leaver or long absence in the HR record, with its date | JML-01 | A | C | I | HR | OK | |||||||
| EXAMPLE | RA-02 | Record a non-employee in the sponsor register, with the reason and end date | JML-10 | C | I | A | Sponsor | OK | |||||||
| EXAMPLE | RA-03 | Confirm which role profile a joiner or mover needs | JML-03 | C | A | I | Line manager | OK | |||||||
| EXAMPLE | RA-04 | Build and keep each role profile | JML-03 | C | R | A | C | Process owner | System owner | OK | |||||
| EXAMPLE | RA-05 | Request non-standard access for an employee, with the reason and expiry | JML-04 | A | I | Line manager | OK | ||||||||
| EXAMPLE | RA-06 | Approve non-standard access to a system: the line manager for an employee or the sponsor for a non-employee, with the system owner | JML-04 | R | I | A | R | System owner | Line manager; Sponsor | OK | |||||
| EXAMPLE | RA-07 | Check resulting access against the conflict matrix before a grant | JML-06 | R | A | C | Process owner | IT service desk | OK | ||||||
| EXAMPLE | RA-08 | Create, change, suspend and remove accounts in single sign-on and connected systems | JML-14 | R | A | Process owner | IT service desk | OK | |||||||
| EXAMPLE | RA-09 | Remove local accounts and access rights the service desk cannot reach | JML-09 | C | A | R | System owner | System administrator | OK | ||||||
| EXAMPLE | RA-10 | Decide an urgent leaver and tell the service desk before the person is told | JML-09 | A | R | I | I | HR | Line manager | OK | |||||
| EXAMPLE | RA-11 | Recover equipment, badges and tokens, and change shared credentials | JML-09 | C | A | R | Line manager | IT service desk | OK | ||||||
| EXAMPLE | RA-12 | Check a caller's identity before a password or factor reset | JML-13 | R | A | Process owner | IT service desk | OK | |||||||
| EXAMPLE | RA-13 | Discover systems outside single sign-on and decide each outcome | JML-12 | C | A | R | Process owner | Head of Information Security | OK | ||||||
| EXAMPLE | RA-14 | Run the monthly reconciliation and report | JML-15 | R | C | A | I | Head of Information Security | IT service desk | OK | |||||
| EXAMPLE | RA-15 | Raise late leavers, residual access and orphaned accounts as access review findings | JML-15 | I | A | R | Head of Information Security | Campaign coordinator | OK | ||||||
| EXAMPLE | RA-16 | Request non-standard access for a non-employee, with the reason and an expiry no later than their end date | JML-04 | I | A | Sponsor | OK |
Role Holders
One row per role in the matrix, in the matrix's order: who holds it, who deputises, and how many activities it does, answers for, is consulted on or told of.
| Example | Role (calc, from the matrix) | Held by (post or person) | Deputy | Person, team or provider | R: does (calc) | A: answers for (calc) | C: consulted (calc) | I: told (calc) | Check (calc) |
|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | HR | HR Manager | HR Adviser | Person | 0 | 2 | 3 | 0 | OK |
| EXAMPLE | Line manager | Each person's line manager, as the HR record names them | The line manager's own manager | Person | 2 | 3 | 2 | 0 | OK |
| EXAMPLE | IT service desk | IT service desk, led by Dan Morgan (Service Desk Lead) | Li Chen (Service Desk Analyst) | Team | 5 | 0 | 1 | 7 | OK |
| EXAMPLE | System owner | Each system's owner in the system inventory, for example the Chief Financial Officer for the ERP | Each owner's named deputy | Person | 1 | 2 | 2 | 0 | OK |
| EXAMPLE | System administrator | Warehouse systems administrator and transport office administrator; the ERP provider (P06 SUP-004) for roles inside the ERP | IT Operations Manager | Team | 1 | 0 | 0 | 0 | OK |
| EXAMPLE | Sponsor | The line manager of the team each non-employee works for, as the sponsor register names them | The sponsor's own line manager | Person | 1 | 2 | 0 | 0 | OK |
| EXAMPLE | Process owner | Mark Ellis, Head of IT | IT Operations Manager | Person | 0 | 5 | 0 | 1 | OK |
| EXAMPLE | Head of Information Security | Ruth Okafor, Head of Information Security | Information Security Manager | Person | 1 | 2 | 2 | 1 | OK |
| EXAMPLE | Campaign coordinator | Information Security Manager | Ruth Okafor, Head of Information Security | Person | 1 | 0 | 0 | 1 | OK |
Lifecycle Events
Who answers for each step of each event
Each event of the Joiner-Mover-Leaver Operating Procedure, the activities its rules call for, and the roles the matrix gives them. Every event ends in a change made in the systems and recorded (RA-08, JML-14). Change the matrix, not this sheet.
Events and their steps
| Event | Activity | What is done (calc) | Accountable (calc) | Responsible (calc) |
|---|---|---|---|---|
| LE-01 Joiner (employee) | RA-01 | Record a joiner, mover, leaver or long absence in the HR record, with its date | HR | |
| LE-01 Joiner (employee) | RA-03 | Confirm which role profile a joiner or mover needs | Line manager | |
| LE-01 Joiner (employee) | RA-04 | Build and keep each role profile | Process owner | System owner |
| LE-01 Joiner (employee) | RA-08 | Create, change, suspend and remove accounts in single sign-on and connected systems | Process owner | IT service desk |
| LE-02 Joiner (non-employee) | RA-01 | Record a joiner, mover, leaver or long absence in the HR record, with its date | HR | |
| LE-02 Joiner (non-employee) | RA-02 | Record a non-employee in the sponsor register, with the reason and end date | Sponsor | |
| LE-02 Joiner (non-employee) | RA-08 | Create, change, suspend and remove accounts in single sign-on and connected systems | Process owner | IT service desk |
| LE-03 Mover | RA-03 | Confirm which role profile a joiner or mover needs | Line manager | |
| LE-03 Mover | RA-04 | Build and keep each role profile | Process owner | System owner |
| LE-03 Mover | RA-07 | Check resulting access against the conflict matrix before a grant | Process owner | IT service desk |
| LE-03 Mover | RA-08 | Create, change, suspend and remove accounts in single sign-on and connected systems | Process owner | IT service desk |
| LE-04 Leaver | RA-09 | Remove local accounts and access rights the service desk cannot reach | System owner | System administrator |
| LE-04 Leaver | RA-10 | Decide an urgent leaver and tell the service desk before the person is told | HR | Line manager |
| LE-04 Leaver | RA-11 | Recover equipment, badges and tokens, and change shared credentials | Line manager | IT service desk |
| LE-04 Leaver | RA-08 | Create, change, suspend and remove accounts in single sign-on and connected systems | Process owner | IT service desk |
| LE-05 Urgent or hostile leaver | RA-09 | Remove local accounts and access rights the service desk cannot reach | System owner | System administrator |
| LE-05 Urgent or hostile leaver | RA-10 | Decide an urgent leaver and tell the service desk before the person is told | HR | Line manager |
| LE-05 Urgent or hostile leaver | RA-11 | Recover equipment, badges and tokens, and change shared credentials | Line manager | IT service desk |
| LE-05 Urgent or hostile leaver | RA-08 | Create, change, suspend and remove accounts in single sign-on and connected systems | Process owner | IT service desk |
| LE-06 Non-employee end date | RA-02 | Record a non-employee in the sponsor register, with the reason and end date | Sponsor | |
| LE-06 Non-employee end date | RA-08 | Create, change, suspend and remove accounts in single sign-on and connected systems | Process owner | IT service desk |
| LE-07 Long absence | RA-08 | Create, change, suspend and remove accounts in single sign-on and connected systems | Process owner | IT service desk |
Source, trigger and deadline of each event are on the Access Provisioning Log's Event rules sheet. Privileged access in any event follows the Privileged Access Standard (JML-16).
Separation Check
Separation check
The matrix against JML-05 and the Segregation of Duties Conflict Matrix's SOD-IT-01: "Create or change user accounts and permissions" and "Approve access requests" are not held by one role (rated High). Every line should say OK.
Approving and making changes, by role
| Role (calc) | Approves access (RA-06) | Makes changes (RA-08, RA-09) | Result (calc) | Rule |
|---|---|---|---|---|
| HR | No | No | OK | JML-05; P02 SOD-IT-01 |
| Line manager | Yes | No | OK | JML-05; P02 SOD-IT-01 |
| IT service desk | No | Yes | OK | JML-05; P02 SOD-IT-01 |
| System owner | Yes | No | OK | JML-05; P02 SOD-IT-01 |
| System administrator | No | Yes | OK | JML-05; P02 SOD-IT-01 |
| Sponsor | Yes | No | OK | JML-05; P02 SOD-IT-01 |
| Process owner | No | No | OK | JML-05; P02 SOD-IT-01 |
| Head of Information Security | No | No | OK | JML-05; P02 SOD-IT-01 |
| Campaign coordinator | No | No | OK | JML-05; P02 SOD-IT-01 |
Checks
| Check | Result | Status | What it means |
|---|---|---|---|
| Activities in the matrix | 16 | Rows with an Activity ID. | |
| Activities with exactly one A and someone who does it | 16 | OK | Every activity has one accountable role (A) and a role that does it (R or A). |
| Roles that approve access and also make changes | 0 | OK | The person who makes a change does not approve it (JML-05, P02 SOD-IT-01). |
| Core roles with no duty (HR, Line manager, IT service desk, System owner) | 0 | OK | The four roles every lifecycle event turns on each hold at least one duty. |
| Roles held by nobody named | 0 | OK | Every role in use has a holder on Role Holders. A [[placeholder]] left there counts until replaced. |
| Overall (calc) | 0 | Every activity has one owner, and no role approves what it makes | |
The overall result covers the matrix. Role holders are yours to name: replace the EXAMPLE's holders with your own posts or people.
Rules
Rules this workbook applies
The rules come from the Access Control Policy and keep their IDs across the pack. Change a rule there, never here: this sheet quotes it.
| Rule | Requirement | Where this workbook applies it |
|---|---|---|
| JML-01 | Every employee's account is created, changed, suspended and removed only from an event in the HR record, and every non-employee's only from the sponsor register. No account is created on a manager's request alone, and no account exists without a record in one or the other. | Responsibilities: RA-01. |
| JML-03 | Joiners and movers receive the base profile and their role profile without further approval. Each role profile has a named owner, is approved by the owner of every system in it, never contains a segregation-of-duties conflict or privileged access, and is reviewed every [[12]] months and after a reorganisation or a new core system. | Responsibilities: RA-03, RA-04. |
| JML-04 | Access outside the person's profiles is non-standard. It needs a business reason, approval by the line manager (or the sponsor) and by the owner of the system or data, and an expiry date no more than [[6]] months ahead, or the non-employee's end date if that is sooner. At expiry it is removed unless the same approvers renewed it beforehand, with a new expiry date. | Responsibilities: RA-05, RA-06, RA-16. |
| JML-05 | Nobody approves their own access, or the access of anyone who approves theirs. The person who makes the change in a system does not approve it (P02 SOD-IT-01). | Separation Check: no role both approves access and makes the change. |
| JML-06 | Before any access right is granted or changed, the person granting it checks the person's resulting access, everything they will hold after the change including what they still hold from an earlier role, against the Segregation of Duties Conflict Matrix (P02 SD-03). A grant that would create a conflict is not made unless it has been accepted under P02 SD-04. | Responsibilities: RA-07. |
| JML-09 | A leaver's access is removed from every system, including local accounts outside single sign-on, by the end of their last working day. For an urgent leaver it is removed within [[60]] minutes of the decision, and before the person is told. Equipment, badges, tokens and shared credentials are recovered or changed the same day, using the leaver checklist. Removed accounts are deleted after [[90]] days, once their data has been dealt with. | Responsibilities: RA-09, RA-10, RA-11. |
| JML-10 | Every non-employee has a sponsor and an end date, recorded in the sponsor register before the account is created and no more than [[12]] months after the start. The account expires automatically at the end of that date. The sponsor is reminded [[10]] working days before, and only the sponsor can extend it, with a new end date. An engagement that ends early is a leaver the same day. | Responsibilities: RA-02. |
| JML-12 | Every system that holds accounts, including software bought with a card or signed up to with a work email address, is in the system inventory with an owner. Discovery runs every [[3]] months from card and expense spend, single sign-on and app-consent logs and the supplier register. Each system found is connected to single sign-on, or kept with its local accounts listed on the leaver checklist and in the reconciliation, or closed. | Responsibilities: RA-13. |
| JML-13 | The service desk resets a password or a multi-factor authentication factor only after checking the caller's identity independently of the call, by one of the identity checks the Joiner-Mover-Leaver Operating Procedure sets. Information the caller gives is never enough on its own. The person is told of every reset through a second channel. Resets of privileged accounts follow the Privileged Access Standard. | Responsibilities: RA-12. |
| JML-14 | Every grant, change, suspension and removal is recorded in the access provisioning log with its request reference, the approvers, who made the change and when it was completed. A removal is recorded as complete only when it is confirmed in the system. | Responsibilities: RA-08. |
| JML-15 | Within [[3]] working days of each month end, every in-scope system's accounts are reconciled with the HR record and the sponsor register. An orphaned account is disabled within [[1]] working day of being found. Every late leaver, mover with residual access and orphaned account is raised as a finding with the access review coordinator (P07 AR-08), and a pattern goes to the process owner as a process weakness (P07 AR-11). | Responsibilities: RA-14, RA-15. |
| JML-16 | Privileged access, including administrator, emergency ("break-glass") and service accounts, follows the Privileged Access Standard of the Privileged Access Management pack. This pack sets no rule for it and puts no privileged access in a role profile. A leaver or mover who holds privileged access is handled by this pack's process, with the privileged steps the Privileged Access Standard sets. | Privileged access: the privileged access pack's own responsibilities apply. |
Lists
| RACI | Kind |
|---|---|
| R | Person |
| A | Team |
| C | Provider |
I
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| R: responsible | Does the activity. More than one role may share it. |
| A: accountable | Answers for the activity being done, and done right. Exactly one per activity. |
| C: consulted | Asked before the activity, and their view taken into account. |
| I: informed | Told after the activity, so they can act on it. |
| HR | for joiner, mover and leaver data. |
| Line manager | each person's manager. |
| IT service desk | internal service desk, or the managed IT provider's. |
| System owner | the manager accountable for the system. |
| System administrator | IT operations, or the supplier's support team. |
| Sponsor | the line manager of the team a non-employee works for. |
| Process owner | For example, Head of IT, who owns the Access Control Policy. |
| Head of Information Security | For example, Head of Information Security. |
| Campaign coordinator | For example, Information Security Manager. |
| Sponsor | The employee accountable for a non-employee's access: normally the line manager of the team they work for. Confirms the end date, and ends or extends the access. |
| HR record | The HR system's record of each employee: start date, job, department, line manager, absence and leaving date. The only source for an employee's lifecycle events. |
| Sponsor register | The record of every non-employee who uses the organisation's systems: who they are, who sponsors them, why, and the end date. Kept by [[HR, or the service desk where HR does not hold non-employees]]. The only source for a non-employee's lifecycle events. |
| Deputy | The person who acts for a role holder while they are absent. The same rules bind them. |
| Core roles | The four roles every lifecycle event turns on: HR, Line manager, IT service desk, System owner. |
| RA-nn, JML-nn | Activities in this matrix, and the rules of the Access Control Policy (JML-01 to JML-16). |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Replace the holders before approval. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.2 — Information security roles and responsibilities | Responsibilities and Role Holders: identity lifecycle duties assigned to named roles, with one accountable role per activity |
| NIST CSF 2.0 | GV.RR-02 — “Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced” | The whole matrix: roles, responsibilities and authorities for access management established and communicated |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(i) — “human resources security, access control policies and asset management” | The matrix as part of access control and human resources security |
| DORA — Delegated Regulation (EU) 2024/1774 | Article 21(e) — account management: roles for granting, reviewing and revoking access; privileged access on a need-to-use basis; removal without undue delay; review at least every six months for systems supporting critical or important functions and at least yearly for others | Responsibilities: who removes access, and who checks it was removed (financial entities) |
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.