1.1 Identity Governance in a Zero-Trust World

TL;DR — If your user directory looks like a junk drawer, “never trust, always verify” is wishful thinking. Identity governance turns Zero Trust from PowerPoint to execution.

Problem

Every high‑stakes breach storyboard starts the same way: “An unused admin account still had Global Admin rights…” or “A contractor’s access wasn’t revoked after off‑boarding.” In Verizon’s 2023 Data Breach Investigations Report (DBIR), 68 % of breaches involved a “human element” — phishing clicks, credential abuse, orphaned accounts.

Zero Trust promises continuous verification, but that contract collapses if the identity list itself is stale. Governance answers two relentless questions, every minute of every day:

1. Who is allowed to exist?
2. Exactly what can they do — right now?

Miss either and an attacker (or auditor) walks straight through.

But even before we ask those questions, we have to trust the face behind the login. Incorporate identity proofing during enrollment — government PIV/CAC verification, biometric match, or remote video KYC for contractors — then bind that assurance level to the credential as a claim (assurance=AAL3). Policies downstream can demand AAL3 + device-compliant before granting access to classified data…