# 2025 retrospective: start security planning with identity owners

A 2025 retrospective on account ownership, joiner and leaver responsibilities, and governance, using primary sources published before the cutoff.

Canonical page: https://mosheldon.com/blog/identity-first-security-2025-retrospective/
Author: OpenTech Consulting
Published: 2026-10-11T12:00:00Z
Updated: 2026-10-15T12:00:00Z

> Retrospective as of 2025-12-31: 2025 retrospective, written October 15, 2026. Supporting sources predate December 31, 2025. Publication metadata uses the actual 2026 date; current product capabilities are not attributed to 2025.

Start an identity security plan by finding who owns each account and who can authorize its access. A tool evaluation is premature when nobody can explain why an identity exists, what it can reach, or when its access should end.

This retrospective uses a December 31, 2025 knowledge cutoff. It was written in October 2026 and does not claim to be an article published in 2025.

## Use governance to settle responsibility

[NIST's February 2024 CSF 2.0 announcement](https://www.nist.gov/news-events/news/2024/02/nist-releases-version-20-landmark-cybersecurity-framework) introduced the Govern function and described a framework intended for organizations of all sizes and sectors. That provides a dated foundation for discussing accountability before the 2025 cutoff.

A practical identity exercise is to assign an owner to personnel data, directory operations, application access decisions, and incident response. One team may hold several responsibilities, but the responsibilities still need names.

## Build a register that leads to decisions

For a hypothetical organization, begin with a limited set of important applications. Record the person or service behind each account, its business owner, source of authorization, and end condition.

| Identity | Question to settle |
| --- | --- |
| Employee | Which personnel event should create, change, or end access? |
| Contractor | Who sponsors access, and when must it be renewed? |
| Privileged administrator | Why is a separate elevated identity needed, and who reviews it? |
| Service account | Which service depends on it, and who can change its credential? |

A spreadsheet can support the first review. It becomes less useful when it merely lists usernames without an owner who can approve a correction.

## Put lifecycle decisions into an explicit process

By July 2023, [Microsoft had announced general availability of Lifecycle Workflows](https://techcommunity.microsoft.com/blog/microsoft-entra-blog/lifecycle-workflows-is-now-generally-available/2466931). Lifecycle automation was an established option before this retrospective's cutoff.

That historical fact does not establish today's task list, licensing, or every integration's past availability. The design question is simpler: what approved event should initiate a change, who is affected, and what result counts as complete?

For a leaver, "ticket closed" is a weak result. A more useful result identifies account restrictions confirmed in each required system and any unresolved exception. For a mover, decide which old access must be removed rather than only listing what to add.

## Test the ownership gaps before buying more software

Ask who would act if a contractor's sponsor left, an application owner declined to review access, or an urgent departure happened before the HR record changed. These are proposed planning scenarios, not reported incidents or client results.

The point of an identity-first plan is to turn unanswered questions into assigned work. Once the organization has settled the rules, it can evaluate automation against them.

Keep the register useful by assigning a review date and a responsible person to each unresolved account. The next review should show which decisions were made and which access was corrected.

## Sources and references

- [NIST: Version 2.0 Cybersecurity Framework release](https://www.nist.gov/news-events/news/2024/02/nist-releases-version-20-landmark-cybersecurity-framework): February 26, 2024 announcement, including Govern and the expanded audience.
- [Microsoft: Lifecycle Workflows is now generally available](https://techcommunity.microsoft.com/blog/microsoft-entra-blog/lifecycle-workflows-is-now-generally-available/2466931): July 2023 announcement establishes availability before the 2025 cutoff.