Capstone: designing IAM for an organization

This capstone brings the course together by designing an identity and access management program for an invented organization, Larchmere Mutual, a regional insurer with about 1,600 employees, 400 independent brokers who use a partner portal and 120,000 policyholders who use a customer portal. Larchmere is fictional, but its problems are typical of the findings security managers meet in practice. Work through each section as if you were presenting to its executive committee, then use the final section to prepare for Domain 5 questions on the exam.

Current state

An assessment of Larchmere's identity environment produced the following findings. Employees sign in with passwords and push MFA to a cloud identity provider for about half of the 70 business applications; the rest have local accounts. The on-premises Active Directory synchronizes to the cloud through a server administered by a contractor. Thirty-one people are permanent members of Domain Admins, and local administrator passwords are the same on every workstation. Leavers are processed when managers email the help desk; a reconciliation found 146 enabled accounts belonging to former staff, eleven used in the past six months. Brokers share logins within brokerages. The customer portal uses passwords with security questions for recovery. There are 940 service accounts and API keys, and nobody can say who owns two-thirds of them. Access reviews are annual spreadsheets that come back 98 % approved.

Requirements and constraints

Requirements come from risk, regulation and the business. The board wants to reduce the chance of a major breach through stolen credentials, which the insurer's own claims data shows to be the leading cause of cyber losses in its industry. Brokers must be able to quote and bind policies quickly. Customers must be able to recover accounts without calling, but the claims team reports fraudsters changing payout details after taking over accounts. Auditors require evidence of timely removal of leavers and periodic review of access to financial and claims systems.

As a Canadian insurer regulated provincially and, for its federally regulated affiliate, by OSFI, Larchmere follows OSFI Guideline B-13 on technology and cyber risk, which expects identity and access management with strong authentication, least privilege, privileged access controls and recertification. PIPEDA, and Quebec's Law 25 for its Quebec policyholders, require safeguards appropriate to the sensitivity of personal and health information, breach reporting where there is a real risk of significant harm and limits on retaining identity data. Any biometric verification for customers in Quebec would require express consent and advance disclosure to the Commission d'accès à l'information. Checked October 2026.

Target architecture

The target architecture follows the principles of this course. A single cloud identity provider becomes the front door for employees and brokers, with every application federated through SAML or OpenID Connect, or placed behind an identity-aware proxy where it cannot federate. The HR system drives employee joiners, movers and leavers; a partner management system drives broker identities, with each brokerage's administrator able to manage its own users under delegated administration and every broker given an individual account. The customer portal uses a separate customer identity service, with passkeys offered to all customers, risk-based step-up and strong recovery. Privileged access goes through a PAM platform with just-in-time elevation. Non-human identities move to managed identities and a secrets vault. Identity logs from all components flow to the SIEM with identity threat detections.

Prioritizing the roadmap

With limited budget and staff, Larchmere must sequence the work. A simple risk-reduction model helps the executive committee compare options. The annualized loss expectancy, ALE, is the expected number of incidents per year, the annualized rate of occurrence, ARO, times the single loss expectancy, SLE:

The figures below are illustrative estimates a team might produce from industry data and its own incident history. The point is not precision but a defensible ranking.

import random
random.seed(2026)
# Illustrative annual rates and single-loss estimates for credential-driven incidents
scenarios = {
    'workforce account takeover': (0.9, 1_800_000),
    'privileged credential compromise': (0.25, 6_500_000),
    'leaver or dormant account misuse': (0.4, 600_000),
    'customer account takeover and payout fraud': (6.0, 45_000),
    'leaked non-human credential': (0.5, 900_000),
}
# Estimated fraction of each risk removed by each initiative, and its yearly cost
initiatives = {
    'phishing-resistant MFA and full SSO': ({'workforce account takeover': 0.75, 'leaver or dormant account misuse': 0.3}, 420_000),
    'PAM with just-in-time and tiering': ({'privileged credential compromise': 0.7, 'workforce account takeover': 0.1}, 380_000),
    'HR-driven JML and reconciliation': ({'leaver or dormant account misuse': 0.8}, 150_000),
    'customer passkeys and risk-based step-up': ({'customer account takeover and payout fraud': 0.7}, 200_000),
    'workload identities and secrets vault': ({'leaked non-human credential': 0.7}, 160_000),
}
base = {k: aro * sle for k, (aro, sle) in scenarios.items()}
print(f'Baseline ALE: ${sum(base.values()):,.0f}')
rows = []
for name, (effects, cost) in initiatives.items():
    saved = sum(base[k] * f for k, f in effects.items())
    rows.append((saved - cost, name, saved, cost))
for net, name, saved, cost in sorted(rows, reverse=True):
    print(f'{name:42s} ALE reduced ${saved:>10,.0f}  cost ${cost:>8,.0f}  net ${net:>10,.0f}')
# Uncertainty: vary every estimate by +/-40 % and count how often the top initiative stays first
wins = 0
for _ in range(2000):
    b = {k: aro * sle * random.uniform(0.6, 1.4) for k, (aro, sle) in scenarios.items()}
    scores = {n: sum(b[k] * f * random.uniform(0.6, 1.4) for k, f in e.items()) - c for n, (e, c) in initiatives.items()}
    wins += max(scores, key=scores.get) == sorted(rows, reverse=True)[0][1]
print(f'Top initiative stays first in {wins / 2000:.0%} of 2,000 simulations')

Baseline ALE: $4,205,000
PAM with just-in-time and tiering          ALE reduced $ 1,299,500  cost $ 380,000  net $   919,500
phishing-resistant MFA and full SSO        ALE reduced $ 1,287,000  cost $ 420,000  net $   867,000
workload identities and secrets vault      ALE reduced $   315,000  cost $ 160,000  net $   155,000
HR-driven JML and reconciliation           ALE reduced $   192,000  cost $ 150,000  net $    42,000
customer passkeys and risk-based step-up   ALE reduced $   189,000  cost $ 200,000  net $   -11,000
Top initiative stays first in 53% of 2,000 simulations

In this illustration, privileged access management and phishing-resistant MFA with full SSO dominate the ranking, each removing about $1.3 million of expected loss, far ahead of the rest. They are so close that the simulation swaps their order about half the time, which tells the committee to treat them as joint first priorities rather than argue over which comes first. HR-driven deprovisioning saves less in expected loss but is cheap, closes an audit finding and is a prerequisite for much else, so a sensible roadmap runs it in parallel. Customer passkeys show a small net cost in this narrow model, which counts only direct fraud losses; customer trust, regulatory expectations and the help desk cost of security-question recovery could justify them, and a manager would say so. A manager presents the ranking together with dependencies, regulatory deadlines and quick wins, not as a mechanical answer.

Strategy for Domain 5 questions

Domain 5 questions reward the same disciplined thinking used in this capstone. First, identify which access control step the scenario is about: identification, authentication, authorization, accountability or life cycle. Second, look for the root cause rather than the symptom: a former employee logging in is a deprovisioning process failure, not merely a bad account. Third, prefer preventive, systemic controls over detective or one-off ones, unless the question asks what to do first in an incident. Fourth, apply the core principles: unique identities, phishing-resistant authentication, least privilege, separation of duties, just-in-time privilege, automated life cycle management and reviewed logs.

Watch for the distractors that appear in many questions: answers that strengthen passwords when the problem is phishing, answers that add monitoring when a preventive control is available, answers that fix one account when the process is broken, and answers that are technically correct but skip governance, such as deploying a tool before defining ownership and policy. As in every domain, the best answer is usually the one a responsible manager would choose: risk-based, systemic, documented and aligned with the organization's objectives.

Thinking like a manager

An IAM program succeeds when identity is treated as core infrastructure with business ownership, not as a help desk function. It needs an authoritative source of truth, a single strong front door, least privilege enforced by architecture, privileged access under tight control, machine identities governed like human ones and evidence that all of this works. Larchmere's roadmap shows that the work can be sequenced so that each phase reduces risk measurably, and that the case for investment is made in terms of attacks stopped and losses avoided.