Identity security posture management, or ISPM, is the continuous practice of discovering every identity in your environment, human and non-human, and checking its access, credentials and configuration against policy. It is less a single standard than a way of running the identity controls that frameworks like NIST CSF already ask for.
What is it made of?
The term is recent and vendors define it differently, so the useful move is to anchor it in controls you can name. NIST CSF 2.0 has a category called Identity Management, Authentication, and Access Control, labeled PR.AA, which covers how identities are issued, authenticated and authorized. SP 800-53 Rev. 5 supplies detail, with controls for account management (AC-2), least privilege (AC-6) and the identification and authentication family (IA).
ISPM is how you check those controls keep holding, not once a year but all the time.
What does it look at?
Inventory. All identities: employees, contractors, service accounts, API keys, tokens, and AI agents that act on behalf of users. Non-human identities often outnumber people, and nobody reviews them.
Credentials. Age, rotation, storage, and strength. A password that never expires on a service account is a finding.
Access. What each identity can reach versus what it needs. Admin rights granted for a project and never removed are the classic case.
Configuration. MFA coverage, dormant accounts, shared accounts, trust relationships between systems, and misconfigured sign-in rules.
Change. New identities, permission changes and unusual sign-ins since the last check.
A constructed example
A migration project created a service account with full administrator rights in a cloud account. The project ended eight months ago. The account has a password that has not changed since creation, and its owner left the company. An ISPM check flags four things at once: an orphaned account, no rotation, excessive privilege and no MFA possible. Each on its own is routine. Together, they describe the easiest account in the company to take over.
Why do machine identities matter so much?
Humans can be trained and asked to use MFA. Machines hold long-lived secrets and often cannot. Every secret in a pipeline, script or config file is an identity with a life of its own. AI agents add a new kind: software that makes decisions and takes actions with delegated credentials. These need owners, scopes and revocation like any other identity.
Safeguard includes agent identity for this last case, so an AI agent has its own identity instead of borrowed human credentials. It addresses agents and is not a replacement for a full identity program.
How is it different from IAM?
Identity and access management issues and enforces identities. ISPM asks whether the result is still safe: whether the issued rights still match need, and whether the settings still match policy. One is the system. The other is the audit of the system, run continuously.
What is a sensible first month?
Week one, inventory. Week two, assign owners to every non-human identity and flag the orphans. Week three, fix the worst findings: remove dormant admin accounts, rotate the oldest secrets and turn on MFA where it is missing. Week four, set a weekly review and decide which checks will run automatically. Small and visible beats large and abandoned.
How to check or apply this
- Build an inventory of identities from your identity provider, cloud accounts, code hosting, and SaaS tools.
- Assign an owner to every non-human identity, and flag those without one.
- Check MFA coverage and list accounts that cannot use it.
- Find accounts with no sign-in for 90 days, and disable them after review.
- Rank privileged access, and remove admin rights not used in the last quarter.
- Set rotation limits for secrets, and track age.
- Review changes weekly: new admins, new tokens, and trust changes.
Quick check
Is ISPM a compliance requirement?
No framework requires a tool with that name. Frameworks require identity controls, and ISPM is a way to show they work.
Where should a small team begin?
With an inventory and owners. Unowned accounts and unrotated secrets are the findings that matter most.
Sources
Last reviewed: 18 October 2026.
