Cloud entitlements grow faster than anyone reviews them, and a cloud infrastructure entitlement management (CIEM) capability only helps if someone measures whether the permission surface is actually shrinking. This health check gives you nine quarterly metrics, each with a formula, a data source type and thresholds, to answer that question across every cloud account, subscription and project you run. It is written for cloud identity owners, platform engineering leads and the security team that signs off cloud access. The step by step review of individual policies lives in the Cloud IAM Review Checklist; this page measures outcomes across the estate rather than repeating those checks.
What this health check covers
The scope is every identity that holds permissions in your cloud control planes: human users, groups, roles, service accounts, workload identities and the trust relationships that let one account or tenant act in another. It applies whether the entitlement data comes from a dedicated CIEM tool, a cloud security platform module or exports you assemble yourself. The review is run by the cloud identity or platform team and approved by the cloud service owner with a security delegate. For how to fix individual findings use the Cloud IAM Review Checklist and the Cloud PAM and CIEM Guide.
Each metric answers a question an auditor or board member asks about cloud iam least privilege: how much granted access is never used, how many identities hold more than they need, how many doors exist between accounts, and how quickly problems are closed. Non-human identities usually outnumber people in cloud accounts, so every metric is reported for human and non-human identities separately as well as in total.
Key takeaways
- Unused permissions are the headline number. The gap between granted and used permissions is the clearest single measure of least privilege in the cloud.
- Split every metric by identity type. Workload identities and access keys behave differently from people, and a blended number hides where the risk sits.
- Trust relationships are entitlements too. Cross-account and cross-tenant trusts extend your permission surface to identities you do not manage, so count them.
- Standing admin is a choice you can measure. Track who holds administrative roles permanently versus through time-bound elevation.
- The tool is only healthy if findings close. A CIEM that raises thousands of findings nobody fixes is reporting, not control; measure closure within SLA.
How to use this template
Copy the metrics table and the findings log into your own tracker, then run this CIEM Health Check at the cadence set out below. Collect each figure from the data sources described, score it against the green, amber and red thresholds, and record every amber or red result as a finding with an owner and a due date. Keep each completed review so you can compare results quarter on quarter: the trend matters as much as any single score.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Full nine-metric health check | Quarterly | Cloud identity lead | Cloud service owner and security delegate | Metric workbook, entitlement and activity exports, findings log |
| Standing admin and wildcard snapshot (CIEM-04, CIEM-05) | Monthly | Platform engineering | Cloud identity lead | Role assignment export, policy diff, approvals |
| Cross-account trust review (CIEM-03) | Quarterly and when an account, tenant or partner is added or removed | Cloud identity lead | Cloud service owner | Trust inventory with owner and business reason |
| Access key age check (CIEM-07) | Monthly | Platform engineering | Security operations lead | Key inventory with creation and last-used dates |
| Ad hoc rerun | After a cloud credential incident, acquisition or new cloud provider onboarding | Cloud identity lead | CISO delegate | Same as quarterly |
Metrics
NHI Mgmt Group recommended thresholds; adjust to your risk appetite. Use a 90-day activity window for every "used" or "inactive" measure, and state it in the workbook. Report each metric per cloud provider and in total.
| ID | Metric | Formula (numerator / denominator) | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| CIEM-01 | Unused permission ratio | Distinct permissions granted to identities and not exercised in 90 days / distinct permissions granted to those identities (summed per identity) | Entitlement inventory joined to control plane activity logs | < 40% | 40% to 70% | > 70% |
| CIEM-02 | Overprivileged identity count | Identities whose unused permissions include at least one high-risk action (identity, key, policy or logging changes, data deletion) / total active identities | Entitlement inventory with permission risk labels, activity logs | < 5% | 5% to 15% | > 15% |
| CIEM-03 | Cross-account trust count | Trust relationships that allow an identity outside the account, subscription, project or tenant to assume a role or act in it, without a recorded owner, business reason and review date / total such trusts | Role trust policy and external principal inventory | 0% | Above 0% to 10% | > 10%, or any trust to an unknown external account |
| CIEM-04 | Wildcard policy count | Attached policies granting all actions, all resources, or a service-wide wildcard on identity, key management or logging services, excluding documented break-glass roles / total attached custom policies | Policy document export with attachment data | < 2% | 2% to 10% | > 10% |
| CIEM-05 | Standing admin role holders | Identities holding an owner or administrator role permanently (not through time-bound elevation), excluding break-glass accounts / identities able to obtain that role by any route | Role assignment export and privileged elevation logs | < 10% | 10% to 40% | > 40% |
| CIEM-06 | Inactive cloud identities | Enabled human and non-human cloud identities with no authentication or API activity in 90 days / total enabled cloud identities | Identity inventory joined to sign-in and activity logs | < 5% | 5% to 15% | > 15% |
| CIEM-07 | Access key age over 90 days | Active long-lived access keys and service account keys older than 90 days / total active long-lived keys | Credential inventory with creation and last-used timestamps | < 5% | 5% to 25% | > 25%, or any key on an administrator identity |
| CIEM-08 | Federated role coverage | Human identities that reach cloud consoles and APIs only through the corporate identity provider (federation or SSO) / total human identities with cloud access | Cloud local user inventory and identity provider assignment export | > 98% | 90% to 98% | < 90% |
| CIEM-09 | Findings closed in SLA | Entitlement findings closed or formally risk-accepted within their severity SLA in the quarter / entitlement findings due in the quarter | CIEM or cloud security finding history, ticketing system | > 90% | 70% to 90% | < 70% |
Read CIEM-01 alongside CIEM-02: a high unused ratio made up of read permissions is a tidiness problem, while a smaller ratio that includes unused permission to create keys or attach policies is the material risk (MITRE ATT&CK T1098.001 Additional Cloud Credentials and T1098.003 Additional Cloud Roles). For CIEM-07, a key that is old but recently used needs rotation; a key that is old and unused should be deleted, which also lowers CIEM-06.
How to collect the data
- Entitlement inventory: export every identity, group, role and attached policy for each account, subscription and project, from the cloud provider's IAM APIs or from the CIEM tool's inventory export. Resolve group membership and role chaining so effective permissions are counted, not just direct attachments.
- Activity data: take 90 days of control plane activity logs (management events) and sign-in logs, centralised in the SIEM or log archive. Where the provider supplies last-accessed data per service or permission, use it for CIEM-01 and record which granularity you used, because service-level data overstates use.
- Trust inventory: list every role or identity trust that names a principal outside the boundary: other accounts, other tenants, external identity providers and workload identity federation subjects (CIEM-03). See the Cross-Account and Cross-Tenant Access Guide.
- Credential inventory: export long-lived access keys and service account keys with creation and last-used times (CIEM-07). Short-lived tokens issued through federation are excluded by design.
- Identity provider export: list human users with cloud application assignments and compare with local cloud users that have passwords or console access (CIEM-08).
- Finding history: pull the quarter's entitlement findings with severity, open date and close date from the CIEM tool or ticketing system (CIEM-09).
Run collection with a dedicated read-only identity and record its own permissions in the workbook: the account used to audit entitlements is itself a high-value non-human identity. If any account or subscription could not be read, list it; unreadable scope is a finding, not a gap to skip.
Red flags that need action now
- A trust that lets an unknown or former partner account assume a role in production.
- An access key older than a year attached to an identity with administrator rights.
- Local cloud users with console passwords for people who already have federated access.
- A workload identity or CI pipeline role holding all actions on all resources.
- Standing owner or administrator roles held by more than a handful of named people per environment.
- A sudden rise in the unused permission ratio after a migration or a new team's onboarding.
- Entitlement findings marked "accepted" with no approver or expiry date.
- Accounts or subscriptions the CIEM tool cannot see, which means none of the other numbers cover them.
Where a red flag suggests a credential may already be in use by someone else, switch to the Cloud Credential Compromise Playbook.
Findings log
| ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-CIEM-01 | [Number] cross-account trusts without an owner or business reason | CIEM-03 | [Critical / High / Medium / Low] | [Name, role] | [YYYY-MM-DD] | [Open / In progress / Closed / Risk accepted] |
| HC-CIEM-02 | [Number] long-lived keys older than 90 days | CIEM-07 | [Severity] | [Name, role] | [YYYY-MM-DD] | [Status] |
| HC-CIEM-03 | [Finding] | [CIEM-nn] | [Severity] | [Name, role] | [YYYY-MM-DD] | [Status] |
Suggested severity: red on CIEM-03, CIEM-04, CIEM-05 or CIEM-07 is critical with a 30-day due date; other reds are high at 60 days; ambers are medium at 90 days. Carry open rows forward with their original due date so slippage is visible.
Remediation map
| Finding type | Where the fix is described |
|---|---|
| Unused and excess permissions (CIEM-01, CIEM-02, CIEM-04) | Cloud IAM Review Checklist, cross-cloud checks and findings sections |
| Cross-account and cross-tenant trusts (CIEM-03) | Cross-Account and Cross-Tenant Access Guide; Federation and Trust Relationships Guide |
| Standing administrator access (CIEM-05) | Cloud PAM and CIEM Guide |
| Inactive identities and orphaned service accounts (CIEM-06) | How to assign owners to orphaned service accounts |
| Old long-lived keys (CIEM-07) | Cloud Access Key Leak Playbook; Cross-cloud workload identity federation |
| Local cloud users outside federation (CIEM-08) | Federation and Trust Relationships Guide |
| Findings not closing (CIEM-09) | Cloud Identity and CIEM Maturity Model |
Framework mapping
| Metric | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | MITRE ATT&CK |
|---|---|---|---|
| CIEM-01, CIEM-02, CIEM-04 | AC-6 Least Privilege; AC-6(7) Review of User Privileges | PR.AA-05 | T1098.003 Additional Cloud Roles |
| CIEM-03 | AC-6 Least Privilege | PR.AA-05 | T1078.004 Cloud Accounts |
| CIEM-05 | AC-6(9) Log Use of Privileged Functions; AC-2 Account Management | PR.AA-05 | T1078.004 Cloud Accounts |
| CIEM-06 | AC-2(3) Disable Accounts | PR.AA-01 | T1078.004 Cloud Accounts |
| CIEM-07 | IA-5 Authenticator Management | PR.AA-01 | T1098.001 Additional Cloud Credentials |
| CIEM-08 | AC-2 Account Management | PR.AA-01 | T1078.004 Cloud Accounts |
| CIEM-09 | AU-6 Audit Record Review, Analysis, and Reporting | GV.OV-03 | Not applicable |
In CIS Controls v8.1 the metrics sit mainly in Control 5 (Account Management) and Control 6 (Access Control Management).
Related guides
- Cloud IAM Review Checklist: how to audit cloud permissions policy by policy.
- Cloud Identity and CIEM Maturity Model: the maturity levels these metrics provide evidence for.
- Identity Security Metrics Guide: rolling cloud entitlement review kpis into programme reporting.
- Cloud Credential Compromise Playbook: response when a cloud identity is misused.
- CIEM Buyers Guide: if the health check shows you need tooling you do not have.
References
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
- CIS: Critical Security Controls Version 8.1
- MITRE ATT&CK: Cloud Accounts
- MITRE ATT&CK: Additional Cloud Credentials
- MITRE ATT&CK: Additional Cloud Roles
Related NHI Mgmt Group resources: Cloud Entitlement Statistics, Cloud PAM and Just in Time Access, Cloud Security Maturity Model.