Identity security for government

Federal agencies and state governments run some of the largest and oldest directories there are: forests that predate Windows Server 2008, service accounts from contractors who left a decade ago, and delegation chains granted during a 2014 crisis that nobody cleaned up. The mandate is Zero Trust. The reality is 20 years of organic growth with little lifecycle management.

The federal identity mandate

Executive Order 14028 (May 2021) directed agencies to adopt Zero Trust architectures. OMB Memorandum M-22-09 followed with specific requirements, including centralized identity management and phishing-resistant MFA. CISA's Zero Trust Maturity Model makes identity the first of its five pillars.

NIST SP 800-53 Rev 5 defines the access control family (AC-1 through AC-25) behind federal identity requirements. AC-6 (Least Privilege) requires the most restrictive set of rights needed, AC-2 covers account management, and AC-17 covers remote access.

For defense contractors, CMMC 2.0 Level 2 requires all 110 practices in NIST SP 800-171 Rev 2, including the Access Control, Audit and Accountability, and Identification and Authentication families.

Why government identity environments are uniquely difficult

Agencies deal with classification levels that need strict forest segmentation, contractor accounts with time-limited access across organizational boundaries, incident-response admin accounts that were never decommissioned, and Tier 0 service accounts from past MSPs that nobody has credentials for but that still authenticate every night.

The tiered administration model is well understood in government. Verifying that it's enforced is the hard part. Cross-tier delegation, nested groups that bypass tier boundaries and service accounts that authenticate across tiers are the gaps between the architecture diagram and reality.

GraphnAI doesn't map findings to NIST or CMMC controls or certify compliance. It gives you evidence for the reviews those frameworks require.

What GraphnAI gives you for these requirements

Least privilege, with quantified evidence

AC-6 reviews need proof of who holds more than their role requires. Over-Permission Analytics compares each identity with its peers in the same domain, department and title, and gives an outlier a deviation score, weighted by permission severity, with a breakdown of what drives it. That's a number you can put in a review.

Account management, with stale detection on every sync

Stale detection uses the activity each sync collects. Users go stale after 90 days, computers after 30 and service accounts after 180, or you set one threshold for an audit. Dormant Tier 0 and Critical accounts are marked urgent. The identity inventory lists every account in every directory you connect and exports to CSV or JSON.

Continuous validation with Tiered Fidelity™

Zero Trust asks you to validate access continuously. Tiered Fidelity separates Theoretical paths from Constrained and Validated ones. Sign-in and privilege-use events promote a path to Validated once it has been seen in use, so the evidence sharpens as telemetry arrives.

Tier model and plane boundaries

A service account with delegated control over a Tier 0 OU is invisible in a permission list and obvious in the graph. Delegation Risk finds custom delegations on OUs and containers, scores each against best practice, and flags cross-plane delegations, such as an application service account with WriteDacl on the Domain Controllers OU.

Incident response and forensic investigation

After a breach, the identity timeline puts one account's sessions, sign-in and privilege-use events, and detection alerts in time order, over anything from an hour to 90 days. Its group memberships and what it can reach sit in the same flyout. It needs a collector that forwards your domain controllers' Windows security events.