A customer identity platform can pass every configuration review and still be losing accounts to credential stuffing, fake sign-ups and recovery abuse, because those failures show up in outcomes, not settings. This health check is a recurring, measurable review of a live customer identity and access management (CIAM) platform, run every quarter with a deeper annual review. It measures what the platform does for and to customers: how many accounts are protected by strong authentication, how often takeover succeeds, whether recovery and registration are being abused, and whether account data is kept and deleted as promised. It is written for CIAM product owners, identity engineers, fraud and trust and safety teams, privacy leads and internal audit.
What this health check covers
It does not repeat how to secure the platform's own control plane (tenant admins, management API clients, signing keys, configuration drift); that is covered in Securing the customer identity (CIAM) platform itself, together with the self-protection metrics listed there. For customer journey design, see the Customer IAM (CIAM) Guide. This page is vendor-neutral and covers hosted and self-managed platforms, business-to-consumer and business-to-business.
Key takeaways
- Measure outcomes in customer terms. Confirmed takeovers per 100,000 active accounts is the number leadership and fraud teams both understand.
- Strong authentication adoption is a trend, not a switch. Track the share of active customers with a passkey or second factor every quarter, by segment.
- Recovery is the soft entry point. Measure what share of confirmed takeovers began with account recovery, not just how many recoveries ran.
- Test enumeration and session revocation, do not assume them. Two metrics here are scripted test results run each quarter against production-like environments.
- Privacy metrics belong on the same scorecard. Dormant account volume, consent coverage and deletion timeliness are identity data quality measures as much as legal ones.
How to use this template
Copy the metrics table and the findings log into your own tracker, then run this Customer identity (CIAM) platform health check at the cadence set out below. Collect each figure from the data sources described, score it against the green, amber and red thresholds, and record every amber or red result as a finding with an owner and a due date. Keep each completed review so you can compare results quarter on quarter: the trend matters as much as any single score.
Cadence and sign-off
Use one measurement date per quarter and, for rate metrics, the full quarter as the window. Fraud and takeover figures should use the same case definitions as the fraud team.
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Operational dashboard (CIAM-02, CIAM-03, CIAM-06) | Weekly or monthly | Identity engineering lead | CIAM product owner | Dashboard snapshot and query definitions |
| Quarterly health check (all metrics) | Quarterly | CIAM product owner | Security risk or GRC, fraud lead | Raw exports, test results, scorecard, findings log |
| Annual review (metrics plus sampling) | Yearly | CIAM product owner | CISO and data protection officer | Recovery and deletion samples, threshold review, sign-off |
| Independent re-performance | Yearly | Internal audit | Audit committee | Re-performed calculation of at least three metrics |
| Event-driven check | After a credential stuffing campaign, platform migration, new market launch or breach disclosure | CIAM product owner | CISO | Scoped scorecard for affected metrics |
Metrics
Use active accounts (a successful sign-in in the last 12 months) as the denominator unless the metric says otherwise, and record it with each figure. NHI Mgmt Group recommended thresholds; adjust to your risk appetite. Bands for adoption metrics depend heavily on market and product, so treat them as a trend target first.
| ID | Metric | Formula (numerator / denominator) | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| CIAM-01 | Strong authentication adoption | Active accounts with a passkey or second factor registered / active accounts | CIAM user store export with authenticator fields | Up on last quarter and above your target | Flat | Falling |
| CIAM-02 | Sign-in failure ratio | Failed sign-in attempts / all sign-in attempts, per day, reported as quarterly median and peak | CIAM sign-in event logs | Peak below 3 times the median | Peak 3 to 10 times the median | Peak above 10 times the median, or any day not investigated |
| CIAM-03 | Confirmed account takeover rate | Confirmed takeover cases / active accounts, per 100,000 | Fraud or case management records | Down on last quarter | Flat | Up on last quarter |
| CIAM-04 | Takeovers via recovery | Confirmed takeover cases where entry was through account recovery / confirmed takeover cases | Case records joined with recovery events | Below 10% | 10% to 25% | Above 25% |
| CIAM-05 | Breached credential exposure open | Accounts flagged with a password found in breach data and not yet reset or protected by a second factor / accounts flagged | Breached password check results, user store export | Below 5% | 5% to 20% | Above 20% |
| CIAM-06 | Fake registration rate | Registrations flagged as fraudulent or automated within 30 days / registrations in the quarter | Registration events, fraud flags | Below 1% | 1% to 5% | Above 5% |
| CIAM-07 | Enumeration test pass rate | Sign-in, registration and recovery endpoints returning indistinguishable responses for existing and unknown accounts / endpoints tested | Quarterly scripted test results | 100% | One endpoint failing with a fix scheduled | Any failing endpoint unscheduled, or on the sign-in page |
| CIAM-08 | Session revocation on credential change | Test credential changes (password, authenticator, email) after which other sessions and refresh tokens were revoked / test changes performed | Quarterly scripted test results | 100% | One path failing with a fix scheduled | Any path failing unscheduled |
| CIAM-09 | Security event notification | Sensitive account changes (email, phone, password, authenticator) that triggered a customer notification / sensitive account changes | CIAM audit events, notification service logs | 99% or more | 95% to below 99% | Below 95% |
| CIAM-10 | Dormant account share | Accounts with no successful sign-in within your retention period / all accounts | User store export with last sign-in | Below 5%, with a deletion process running | 5% to 20% | Above 20%, or no dormant account process |
| CIAM-11 | Consent record coverage | Active accounts with a consent record matching the current terms and purpose version / active accounts that require one | Consent store export, user store export | 99% or more | 95% to below 99% | Below 95% |
| CIAM-12 | Deletion requests completed on time | Account deletion requests completed across the user store and downstream copies within your statutory or policy deadline / deletion requests due in the quarter | Request tracking records, user store and downstream deletion logs | 100% | 95% to below 100% | Below 95% |
The formulas, the test-based metrics and the sample sizes are NHI Mgmt Group recommended methods, not requirements of any standard. Where a single event is severe (a confirmed takeover campaign, an enumeration flaw on the sign-in page), report it as red regardless of the rate.
Why these metrics, and where standards help
- CIAM-02 and CIAM-03: the OWASP Credential Stuffing Prevention Cheat Sheet advises defence in depth and logging volume metrics for detection, on the assumption that individual defences will fail. A spike in the failure ratio is the early signal; the takeover rate is the outcome.
- CIAM-05: NIST SP 800-63B-4 requires new and changed passwords to be checked against a blocklist that includes values from previous breach corpuses. This metric covers the remaining gap: existing accounts found in new breach data after the password was set. See Breached password checks.
- CIAM-07: the OWASP Authentication Cheat Sheet asks for the same generic response on sign-in, password reset and registration whether or not the account exists, including similar response times and HTTP status codes. Test all three.
- CIAM-09: the OWASP Credential Stuffing Prevention Cheat Sheet recommends notifying users about unusual security events and showing recent sign-in activity and active sessions.
- CIAM-02 data: the same OWASP Authentication Cheat Sheet asks for all authentication failures and account lockouts to be logged and reviewed; if they are not logged, this metric cannot be calculated, which is itself a finding.
How to collect the data
- CIAM sign-in event logs: success and failure events with timestamp, client, network and risk fields (CIAM-02). Keep daily counts for the whole quarter so peaks are visible.
- CIAM user store export: authenticator registrations, last sign-in and creation date per account (CIAM-01, CIAM-10). Export counts and flags only; do not copy customer personal data into the health check workbook.
- Fraud or case management records: confirmed takeover and fake account cases with entry vector (CIAM-03, CIAM-04, CIAM-06). Agree one definition of "confirmed" with the fraud team.
- CIAM audit events: recovery, credential change and profile change events (CIAM-04, CIAM-09).
- Notification service logs: messages sent for sensitive changes, matched to the audit events (CIAM-09).
- Breached password check results: accounts flagged at sign-in or by a periodic check, and their later state (CIAM-05).
- Scripted tests: a fixed quarterly test pack against a production-like environment for enumeration (CIAM-07) and session revocation (CIAM-08), using test accounts only.
- Consent store and request tracking records: consent versions per account (CIAM-11) and deletion requests with completion evidence from each downstream copy (CIAM-12). See the Right to Erasure Engineering Guide.
Running the quarterly check
- Freeze the date and window: pull exports within one working day of the measurement date.
- Agree case definitions: reconcile takeover and fake account counts with the fraud team before calculating rates.
- Run the test pack: execute the enumeration and session revocation tests and keep the raw results.
- Calculate and compare: apply the recorded formulas and compare with last quarter and the band.
- Sample the reds: review five to ten underlying cases or events for each red metric to confirm it is real.
- Log and sign off: record each amber and red item, then present to the approvers.
In the annual review, sample 25 completed recoveries and confirm each followed the documented verification step, and sample 25 deletion requests and confirm removal in each downstream copy.
Red flags that need action now
- A day with a sign-in failure spike that nobody investigated.
- A rising takeover rate for two consecutive quarters, or a takeover cluster in one segment or market.
- More than a quarter of confirmed takeovers entering through account recovery.
- Any endpoint that reveals whether an account exists.
- A credential change that leaves other sessions or refresh tokens active.
- Email or phone changes completed without a notification to the previous contact address.
- A burst of registrations from the same infrastructure or with patterned identifiers. See the Fake Account Creation and Sign-up Fraud Guide.
- Deletion requests past their deadline, or deletions that never reached downstream copies.
Findings log
Keep one running log across quarters so repeat findings are visible. Escalate a finding that is red for two consecutive quarters to the CISO, and record any finding that repeats three times in the risk register.
| ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-CIAM-01 | Takeover rate up [n]% on last quarter in [segment] | CIAM-03 | [Severity] | [Fraud lead] | [Date] | [Open / In progress / Closed / Risk accepted] |
| HC-CIAM-02 | [Endpoint] reveals account existence | CIAM-07 | Red | [Identity engineering lead] | [Date] | [Status] |
| HC-CIAM-03 | Refresh tokens survive password change on [client] | CIAM-08 | Red | [Application owner] | [Date] | [Status] |
| HC-CIAM-04 | [n] accounts in breach data still unprotected | CIAM-05 | [Severity] | [CIAM product owner] | [Date] | [Status] |
| HC-CIAM-05 | [n] deletion requests overdue | CIAM-12 | [Severity] | [Privacy lead] | [Date] | [Status] |
Remediation map
| Finding type | Where to fix it |
|---|---|
| Low strong authentication adoption (CIAM-01) | Passwordless and Passkeys Guide; Customer Authentication Policy Template |
| Failure spikes and rising takeovers (CIAM-02, CIAM-03) | Account Takeover Prevention Guide; Credential Stuffing Attack Response Playbook |
| Recovery-led takeovers (CIAM-04) | Secure Password Reset Flow Guide; Account Recovery and Help Desk Security Guide |
| Breached credentials left open (CIAM-05) | Breached password checks |
| Fake registrations (CIAM-06) | Fake Account Creation and Sign-up Fraud Guide; Bot Management Guide |
| Enumeration and session revocation failures (CIAM-07, CIAM-08) | Customer IAM (CIAM) Guide; Global Token Revocation Guide |
| Missing notifications (CIAM-09) | Account Takeover Prevention Guide |
| Dormant accounts, consent gaps, late deletions (CIAM-10 to CIAM-12) | Identity Data Privacy and Consent Guide; Data Retention and Secure Deletion Guide |
| Control plane findings (admins, management clients, keys) | Securing the customer identity (CIAM) platform itself |
Related guides
- Securing the customer identity (CIAM) platform itself: hardening the control plane behind these metrics.
- CIAM Maturity Model: where your scorecard places you.
- Fraud Metrics and KPIs Guide: aligning takeover and fake account figures with fraud reporting.
- If your customer identity (CIAM) platform is compromised: response when a red finding is an intrusion.
- Account Takeover Response Playbook: handling confirmed takeover cases.
References
- OWASP: Credential Stuffing Prevention Cheat Sheet
- OWASP: Authentication Cheat Sheet
- NIST: SP 800-63B-4 Digital Identity Guidelines, Authentication and Authenticator Management
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls (IA-8 Identification and Authentication (Non-organizational Users), AC-7 Unsuccessful Logon Attempts, AC-12 Session Termination, SI-4 System Monitoring)
- NIST: Cybersecurity Framework 2.0 (PR.AA-02, PR.AA-03, DE.CM-03)
Related NHI Mgmt Group resources: Securing the customer identity (CIAM) platform itself, CIAM Maturity Model, Fraud Metrics and KPIs Guide, If your customer identity (CIAM) platform is compromised, Account Takeover Response Playbook.