baselineRFIWhat clouds and identity types does the platform analyze for entitlements — AWS/Azure/GCP IAM, Kubernetes RBAC, and both human and non-human (service accounts, roles, workload identities) — and is coverage at parity across all three major clouds?weight 3
Answer key — what a strong answer shows
Strong answers give a per-cloud, per-identity-type breakdown; a tool that's deep on AWS but shallow on Azure/GCP should say so rather than imply uniform coverage.
baselineRFPDescribe how the platform calculates a permission's actual usage (last-used analysis for individual API actions, not just whole roles) and quantify the reduction in standing excessive permissions achieved with a customer reference.weight 3
Answer key — what a strong answer shows
Look for granular, action-level usage analysis (not just 'this role was used') and a concrete before/after reduction figure tied to a named customer.
baselineRFIHow does the platform right-size overly permissive policies — does it generate a least-privilege policy recommendation automatically, and can that recommendation be applied with one click or does it require manual policy authoring?weight 3
Answer key — what a strong answer shows
Automated least-privilege policy generation with a low-friction apply path is materially stronger than a report listing excessive permissions the customer must manually rewrite into policy language.
baselineRFIWhat is the risk-scoring methodology for a given identity's toxic combination of permissions (e.g., privilege escalation paths, cross-account access chains), and is this a static ruleset or does it model actual attack paths through the environment?weight 3
Answer key — what a strong answer shows
Attack-path modeling (graph-based, showing how permissions chain into privilege escalation) is stronger than a static list of individually-risky permissions with no path analysis.
baselineRFPDetail support for just-in-time (JIT) elevated access as an alternative to standing permissions, and describe the approval workflow and typical grant latency in production deployments.weight 3
Answer key — what a strong answer shows
Look for a real JIT workflow with a stated production approval-latency figure, not a theoretical capability; JIT is the practical alternative to broad standing entitlements this category should offer.
baselineRFIHow does the platform handle non-human identity sprawl specifically (service accounts, CI/CD pipeline credentials, third-party app OAuth grants) which typically outnumber human identities many times over in cloud environments?weight 3
Answer key — what a strong answer shows
Non-human identities are usually the majority of entitlements in a cloud account; a platform that treats them as an afterthought misses most of the actual attack surface.
baselineRFPExplain how remediation integrates with existing IaC/GitOps workflows — can policy right-sizing recommendations be delivered as a pull request against Terraform/CloudFormation rather than applied directly to the live environment?weight 3
Answer key — what a strong answer shows
PR-based remediation matching the customer's existing infrastructure-as-code workflow is stronger than a tool that only makes live, out-of-band changes bypassing change management.
baselineRFIWhat compliance/audit reporting does the platform provide for entitlement reviews (e.g., quarterly access certification for SOC 2/ISO 27001), and is certification workflow (reviewer assignment, sign-off tracking) built in or does it require export to a separate GRC tool?weight 3
Answer key — what a strong answer shows
Built-in certification workflow with tracked sign-off is stronger than a raw entitlement export requiring the compliance team to build their own review process around it.
baselineRFIWhat is the pricing model — per identity, per cloud account, or a flat enterprise tier — and given that entitlement discovery inherently reveals a larger identity population than initially estimated (especially non-human identities), how does pricing respond to that discovery-driven growth?weight 3
Answer key — what a strong answer shows
Same tension as other discovery-driven categories: successful entitlement discovery inherently increases the counted identity population, especially given non-human identities typically outnumber human ones — ask explicitly how pricing handles a large post-onboarding jump.
baselineRFPDescribe incident-response capability for a confirmed compromised over-privileged identity — can the platform quickly assess the full blast radius of what that identity could access, and what is a customer-referenced example of using this during a real incident?weight 3
Answer key — what a strong answer shows
Strong answers describe a fast, specific blast-radius assessment capability with a real customer example, not just preventive posture monitoring.
baselineRFIDetail historical trend reporting on entitlement-sprawl reduction (standing-permission count trend, over-privileged-identity count trend) over time, suitable for demonstrating program progress to leadership.weight 3
Answer key — what a strong answer shows
Trend-over-time reporting is a distinct capability from a real-time posture dashboard — confirm this exists as a maintained, exportable report.
baselineRFPHow does the platform integrate with (versus duplicate) the customer's existing PAM/IAM tooling so entitlement findings feed into the same unified identity risk view rather than a disconnected, separate system?weight 3
Answer key — what a strong answer shows
Look for genuine integration into a unified identity risk view; a standalone CIEM dashboard disconnected from the broader PAM/IAM picture creates real reconciliation burden.
baselineRFIWho within the customer organization gets access to entitlement findings and attack-path analysis, and is there role-based access control given that a complete map of privilege-escalation paths is itself valuable reconnaissance information?weight 3
Answer key — what a strong answer shows
A complete attack-path map is a meaningful target in its own right — role-based access control over the tool's own findings is an often-overlooked consideration.
baselineRFIWhat is the measured false-positive rate on toxic-combination/attack-path flagging (identifying a real exploitable privilege-escalation chain versus a theoretical one that's actually blocked by another control), and what correction mechanism exists?weight 3
Answer key — what a strong answer shows
A high false-positive rate on attack-path flagging creates real alert fatigue — ask for a real, customer-validated accuracy figure and a correction workflow that accounts for compensating controls.
baselineRFPDoes the platform support genuinely isolated, per-subsidiary entitlement views for a multi-entity organization with different cloud environments and risk tolerances, or is there only one flat, shared view across the whole organization?weight 3
Answer key — what a strong answer shows
Genuine multi-entity isolation is materially more useful for a diversified organization than one shared view forcing a one-size-fits-all entitlement posture.
baselineRFIWhat is a customer-referenced onboarding timeline from contract signature to the platform providing genuinely useful, actionable entitlement findings across an existing, large, pre-existing multi-cloud entitlement sprawl?weight 3
Answer key — what a strong answer shows
Strong answers give a concrete, customer-validated timeline for a realistic existing-sprawl scenario (not a small greenfield deployment), and are honest about the customer-side effort required.
baselineRFPO365 Cloud Environment testing: identities and conditional access policies (MS Entra ID), API security assessment, and key data repositories (SharePoint, Teams).weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
