Skip to content
IAM Compared

LESSON 10 · PROVE CONTROL

Measuring identity coverage: the numbers worth reporting each quarter

The short answer

Report coverage as ratios against the number of applications you know about: how many are on single sign-on, how many have automated deprovisioning, and how many have an account inventory matched to people. Add the count of accounts with no owner. Expect the denominator to grow as discovery improves, and say so.

By The Credential Desk · IAM Compared · Published 2026-10-07

2 min read

Why measure coverage at all?

Identity programs often report what they did: applications onboarded, reviews completed. Those numbers rise every quarter even when the gap is not closing. Coverage ratios show the share of the estate under control, which is the question a CISO or an auditor actually asks.

The five numbers

  1. Applications known. Every application in use, from every inventory source you combine.
  2. Applications on single sign-on, as a share of applications known.
  3. Applications with automated deprovisioning (SCIM or a connector), as a share of applications known.
  4. Applications with a current account inventory matched to people and owners, as a share of applications known.
  5. Accounts with no owner, as a count, split into personal, local and non-human accounts.

Why does the denominator move?

Applications known goes up as you add sources: procurement records, sign-on logs, browser or network telemetry, a discovery tool. When it does, every ratio drops even though nothing got worse. Report the denominator next to each ratio and note when a new source was added, so a drop is read correctly.

How do the numbers relate?

Number 2 is usually the highest, because single sign-on is the easiest integration. Number 3 is lower, because provisioning needs a connector. Number 4 is often the lowest, because it needs someone to pull and match accounts inside each application. The distance between numbers 2 and 3 is the set of applications where people can sign in centrally but leave without their access being removed. The coverage gap calculator computes the first three from your figures.

What target is realistic?

There is no standard target, and this site does not publish one. A useful internal rule is that number 4 should cover every application in audit scope, whatever its connector status, because that is the population an auditor will test. NIST SP 800-53 control AC-2 expects account management across all systems in scope, not only the connected ones.

How should you present it?

One table, one row per quarter, five columns, the denominator stated. Add one sentence explaining any change in the denominator. Keep the method the same from quarter to quarter so the trend means something.

Sources

Source: AC-2 Account Management (csf.tools mirror of the NIST catalog) · Read 27 Sep 2026

Next lesson

Back to the identity classroom