Frame
Agree the purpose, scope, stakeholders, evidence and decision the assessment must support.
Consulting assessments
Current state to
prioritised roadmap.
MAITS assessments are bounded professional engagements that connect evidence, material risk, target direction and practical next steps.
Scope before certainty
Systems, participants, evidence and outputs are agreed before work begins. Assessments do not promise certification, compliance or a fixed duration.
Assessment method
Current State → Risks → Target State → Prioritised Roadmap
The depth reflects the decision the organisation needs to make, the available evidence and the environments placed in scope.
Review
Examine architecture, configuration, process, ownership and operational evidence.
Evaluate
Connect findings to risk, control intent, dependencies and target-state principles.
Prioritise
Sequence remediation, design and programme actions into a usable roadmap.
Assessment family
Choose the boundary that matches the decision.
Each assessment explains its purpose, review scope, outputs and likely continuation. Final scope is agreed with the client.
Entra Security Assessment
Purpose: Establish the security position of a Microsoft Entra tenant.
- Typical problems: Policy sprawl, weak methods, excessive privilege, unmanaged applications and unclear ownership.
- MAITS reviews: Tenant architecture, authentication, Conditional Access, PIM, applications, workloads, guests and monitoring.
- Expected outputs: Findings, risk priorities, target controls and remediation backlog.
- Likely next step: Security uplift, configuration delivery or assurance.
IAM Maturity Assessment
Purpose: Understand identity capability across strategy, architecture, lifecycle, security and governance.
- Typical problems: Fragmented ownership, legacy patterns, manual lifecycle, weak evidence and competing projects.
- MAITS reviews: Identity sources, directories, authentication, authorisation, provisioning, governance, applications and operating model.
- Expected outputs: Current maturity, material risks, target state and prioritised IAM roadmap.
- Likely next step: IAM strategy, identity leadership or programme definition.
Identity Security Assessment
Purpose: Review how accounts are established, protected, recovered and monitored.
- Typical problems: Phishable methods, risky recovery, policy gaps, weak device context and emergency-access exposure.
- MAITS reviews: Methods, registration, MFA, passkeys, Conditional Access, risk, recovery, privilege and support.
- Expected outputs: Identity threat view, control gaps and sequenced security actions.
- Likely next step: Passkey programme, policy redesign or privileged-authentication uplift.
IGA Assessment
Purpose: Assess whether access follows valid relationships and accountable decisions.
- Typical problems: Stale access, manual joiner-mover-leaver, weak ownership, ineffective reviews and orphan accounts.
- MAITS reviews: Lifecycle, birthright and requestable access, entitlements, approvals, roles, SoD, reviews and application onboarding.
- Expected outputs: IGA capability position, lifecycle gaps, entitlement priorities and roadmap.
- Likely next step: IGA design, governance operating model or implementation.
PAM Assessment
Purpose: Find and prioritise routes to administrative power.
- Typical problems: Standing privilege, shared administration, weak activation, vendor access and unmanaged service accounts.
- MAITS reviews: Privileged identities, roles, PIM, JIT/JEA patterns, workstations, authentication, emergency access and monitoring.
- Expected outputs: Privilege inventory, target model, priority controls and operating actions.
- Likely next step: PAM architecture, PIM delivery or privileged-authentication uplift.
CIAM Assessment
Purpose: Review customer identity as a complete service and security boundary.
- Typical problems: Registration friction, risky recovery, fragmented profiles, consent gaps and tightly coupled applications.
- MAITS reviews: Registration, authentication, federation, recovery, account linking, consent, APIs, lifecycle and fraud context.
- Expected outputs: Journey findings, target architecture, risk priorities and delivery roadmap.
- Likely next step: CIAM strategy, migration, architecture or implementation.
RBAC / Access Model Assessment
Purpose: Determine whether roles and entitlements express real business responsibility.
- Typical problems: Role sprawl, excessive birthright access, opaque permissions, toxic combinations and weak ownership.
- MAITS reviews: Business and technical roles, permissions, entitlements, access matrices, attributes, SoD and lifecycle.
- Expected outputs: Role-model findings, rationalisation priorities and governance direction.
- Likely next step: Role engineering, RBAC workshop or IGA integration.
Passkey Readiness Assessment
Purpose: Establish readiness for phishing-resistant authentication.
- Typical problems: Unsupported populations, weak enrolment, recovery gaps, application constraints and support uncertainty.
- MAITS reviews: Users, devices, methods, registration, Conditional Access, recovery, privileged use and operations.
- Expected outputs: Readiness position, dependency map, pilot scope and rollout roadmap.
- Likely next step: Passkey strategy workshop, pilot design or delivery.
Zero Trust Assessment
Purpose: Translate Zero Trust principles into specific control priorities.
- Typical problems: Implicit trust, weak segmentation, excessive access, limited device assurance and poor visibility.
- MAITS reviews: Identity, devices, applications, data, network, workloads, telemetry and governance.
- Expected outputs: Control gaps, target principles and a prioritised uplift plan.
- Likely next step: Security architecture, identity security or cloud security uplift.
Cloud Security Assessment
Purpose: Review cloud identity, exposure, configuration and operational control.
- Typical problems: Excessive roles, public exposure, unmanaged secrets, policy gaps and insufficient telemetry.
- MAITS reviews: Identity, RBAC, PIM, workloads, network, data, policy, secrets, APIs, logging and operations.
- Expected outputs: Risk findings, target controls, remediation backlog and architecture actions.
- Likely next step: Cloud security design, configuration delivery or assurance.
Security Maturity Assessment
Purpose: Establish a practical view of security capability and priority risk.
- Typical problems: Competing initiatives, unclear control ownership, audit pressure and weak operational evidence.
- MAITS reviews: Governance, identity, endpoint, cloud, network, applications, suppliers, resilience, vulnerability and incidents.
- Expected outputs: Maturity position, risk priorities, target state and security roadmap.
- Likely next step: Security uplift programme, retained advisory or programme assurance.
Architecture Review
Purpose: Test whether a proposed or existing design is coherent, supportable and aligned to risk.
- Typical problems: Unclear boundaries, hidden dependencies, vendor assumptions, resilience gaps and implementation drift.
- MAITS reviews: Requirements, decisions, integration, security, data, operations, testing and delivery evidence.
- Expected outputs: Architecture findings, decision gaps and prioritised corrective actions.
- Likely next step: Design remediation, technical leadership or independent assurance.
Digital Identity Discovery
Purpose: Qualify digital credential and reusable-evidence opportunities before selecting technology.
- Typical problems: Technology-first pilots, unclear issuer authority, weak trust models and privacy uncertainty.
- MAITS reviews: Use case, issuer, holder, verifier, wallet, evidence, lifecycle, privacy, standards and relying decision.
- Expected outputs: Qualified use case, trust model, architecture direction and pilot roadmap.
- Likely next step: Credential workshop, detailed design or DiligenceID evaluation.
SaaS Architecture Assessment
Purpose: Review a SaaS product’s identity, security, integration, tenancy and operational architecture.
- Typical problems: Scaling constraints, weak tenant boundaries, risky administration, integration debt and unclear reliability.
- MAITS reviews: Identity, authorisation, APIs, data, cloud, observability, deployment, resilience and operations.
- Expected outputs: Architecture findings, technical-debt priorities and target-state roadmap.
- Likely next step: Technical leadership, architecture design or delivery uplift.
Start a conversation
Establish the current position before choosing the solution.
Tell us what decision, risk or programme the assessment needs to support. We’ll agree a credible scope and useful outputs.