non-person-identity.xml 1 2027-01-04T08:00:00 08:00:00 17:00:00 480 2400 20 7 1 1 Standard 1 -1 1 0 2 1 08:00:0012:00:00 13:00:0017:00:00 3 1 08:00:0012:00:00 13:00:0017:00:00 4 1 08:00:0012:00:00 13:00:0017:00:00 5 1 08:00:0012:00:00 13:00:0017:00:00 6 1 08:00:0012:00:00 13:00:0017:00:00 7 0 1 1 Phase 0 — Inventory 1 1

1

2027-01-04T08:00:00 2027-01-29T17:00:00 2 2 NP0.1 AD service accounts discovered, read-only: traditional accounts, MSAs, gMSAs and dMSAs, classified by type and risk with a suggested target 1.1 2 2027-01-04T08:00:00 2027-01-15T17:00:00 PT80H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b02-identity/09-building-the-entra-target.md#discovering-service-accounts 3 3 X-G0 Program G0 — Ready to Plan: the read-only assessment committed 1.2 2 2027-01-29T17:00:00 2027-01-29T17:00:00 PT0H0M0S 7 1 Steward (backup: executive sponsor; program) Owner or approver: Steward (backup: executive sponsor; program) If decided late: The program's assessment goes to G0 without the service account picture, and Phase 1 is sized without it Source: program-master-schedule.md 4 2027-01-29T17:00:00 2 1 0 7 4 4 X-A03 App registrations, owners, credentials and granted permissions inventoried (Privileged Access plan, A0.3) 1.3 2 2027-01-13T17:00:00 2027-01-13T17:00:00 PT0H0M0S 7 1 Identity engineering (Privileged Access & Administrative Identity plan) Owner or approver: Identity engineering (Privileged Access & Administrative Identity plan) If decided late: The Entra side of the register has no app registration inventory to start from Source: privileged-access.md 4 2027-01-13T17:00:00 5 5 NP0.2 Entra workload identities added to that inventory: managed identities, federated credentials, consent grants; ownerless and secret-holding apps flagged 1.4 2 2027-01-14T08:00:00 2027-01-20T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/05-applications-and-workload-identities.md#a-read-only-inventory-to-start-from 4 1 0 7 6 6 NP0.3 AI seed list: the current AI use-case inventory vintage loaded; agentic, purchased and no-ATO entries matched to agent identities and service principals 1.5 2 2027-01-04T08:00:00 2027-01-15T17:00:00 PT80H0M0S 7 0 Identity engineering, with the Chief AI Officer's staff Owner or approver: Identity engineering, with the Chief AI Officer's staff Source: ../books/b17-ai-identity/03-the-inventory-as-an-identity-source.md#using-the-inventory-as-the-seed-list 7 7 NP0.4 SQL Server engine, login and LDAP-bind accounts tagged and handed to the Data Platform plan 1.6 2 2027-01-18T08:00:00 2027-01-20T17:00:00 PT24H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b06-data-platform/09-what-arc-provides-to-sql-server.md#the-managed-identity-and-the-service-account 2 1 0 7 8 8 NP0.5 One non-person identity register: type, host, workload location, risk and candidate target for every identity 1.7 2 2027-01-21T08:00:00 2027-01-27T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/guides/attribute-driven-migration.md#non-person-identity-track 2 1 0 7 5 1 0 7 6 1 0 7 7 1 0 7 9 9 D-NP1 Source of record for non-person identities 1.8 2 2027-01-15T17:00:00 2027-01-15T17:00:00 PT0H0M0S 7 1 CIO Owner or approver: CIO Options: The owning workload's record (the system inventory or CMDB entry and the application registration) and, for AI, the AI use-case inventory, with the register keyed to them; a separate identity register kept by the identity team If decided late: The register has nothing to reconcile against, and owners and lifecycle have nothing to hang from Source: ../books/guides/attribute-driven-migration.md#non-person-identity-track 2 1 0 7 10 10 NPG0 Gate 0 — Non-person identities inventoried 1.9 2 2027-01-27T17:00:00 2027-01-27T17:00:00 PT0H0M0S 7 1 ISSO Owner or approver: ISSO Criteria: Every AD service account, MSA, gMSA and dMSA, every app registration, service principal and managed identity, and every AI use case in the current vintage in one register with type, risk and candidate target; HIGH-risk accounts listed; stale leads confirmed against sign-in logs, not retired on a guess; SQL Server accounts handed to the Data Platform plan Source: ../books/b02-identity/10-migrating-and-governing.md#phase-4-service-account-modernization 8 1 0 7 9 1 0 7 11 11 Phase 1 — Ownership 2 1

1

2027-01-28T08:00:00 2027-03-10T17:00:00 12 12 NP1.1 An application owner found for every service account; two human owners on every app registration and service principal outside the privileged sweep (Privileged Access plan, A3.4); serviceManagementReference set 2.1 2 2027-01-28T08:00:00 2027-03-03T17:00:00 PT200H0M0S 7 0 Application owners Owner or approver: Application owners Source: ../books/b04-access/05-applications-and-workload-identities.md#ownership 10 1 0 7 13 13 NP1.2 AI accountability: a federal sponsor mastered in HR, a small sponsoring group, a technical owner who isn't the sponsor, and a matching inventory record 2.2 2 2027-01-28T08:00:00 2027-02-17T17:00:00 PT120H0M0S 7 0 Sponsoring offices, with the identity governance officer Owner or approver: Sponsoring offices, with the identity governance officer Source: ../books/b17-ai-identity/05-owners-sponsors-and-lifecycle.md#the-programs-rule-two-named-humans-and-a-record 10 1 0 7 14 14 D-NP2 Orphan rule for identities nobody will own 2.3 2 2027-01-27T17:00:00 2027-01-27T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Options: Disable once the identity governance officer confirms the finding, then 30 days for the office to name an owner or retire it (a non-person identity rule, not Book 04's, which gives the office 30 days and then suspends; applied at once to agents because they can act); retire at once; keep running on a dated exception If decided late: Unowned accounts can't be disposed of, and Gate 1 can't pass Source: ../books/b04-access/06-who-decides-access.md#ownership-changes-and-orphaned-apps 10 1 0 7 15 15 NP1.3 Unowned identities disabled, not deleted, under the orphan rule; each a retirement candidate with a 30-day claim window 2.4 2 2027-03-04T08:00:00 2027-03-10T17:00:00 PT40H0M0S 7 0 Identity governance officer Owner or approver: Identity governance officer Source: ../books/guides/attribute-driven-migration.md#service-accounts-msas-gmsas-and-dmsas 12 1 0 7 14 1 0 7 16 16 NPG1 Gate 1 — Every non-person identity owned 2.5 2 2027-03-10T17:00:00 2027-03-10T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: Every service account has a named application owner; every app registration and service principal outside the privileged sweep (Privileged Access plan, A3.4) has two human owners and a service-management reference; every AI identity has a federal sponsor, a sponsoring group, a technical owner and a matching inventory record; every unowned identity is disabled pending retirement or carries a dated exception Source: ../books/b02-identity/09-building-the-entra-target.md#governing-service-principals 13 1 0 7 15 1 0 7 17 17 Phase 2 — Decide per account 3 1

1

2027-03-11T08:00:00 2027-04-07T17:00:00 18 18 NP2.1 Target set per account from the migration path matrix: app registration, managed identity, gMSA or dMSA, or retirement 3.1 2 2027-03-11T08:00:00 2027-03-31T17:00:00 PT120H0M0S 7 0 Identity engineering, with application owners Owner or approver: Identity engineering, with application owners Source: ../books/b02-identity/09-building-the-entra-target.md#the-migration-path-matrix 16 1 0 7 19 19 D-NP3 Retire, re-platform or keep, account by account 3.2 2 2027-03-31T17:00:00 2027-03-31T17:00:00 PT0H0M0S 7 1 Application owners Owner or approver: Application owners Options: Retire (unused or unowned); re-platform to a managed identity, a gMSA or dMSA, or an app registration with a federated credential or certificate; keep on Kerberos with an SPN, islanded with an end date the authorizing official accepts If decided late: The conversion waves can't be built, and the program's SPN retirement (P4.6) has no list to work from Source: ../books/guides/attribute-driven-migration.md#non-person-identity-track 18 1 0 7 20 20 D-NP4 Workload ID Premium licensing scope 3.3 2 2027-03-31T17:00:00 2027-03-31T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Options: License for the single-tenant service principals classified R1 (Book 04's position); license more widely; don't license, and rely on app management policies and owner reviews, with no workload Conditional Access If decided late: Workload Conditional Access can't be created or changed, and privileged service principal reviews aren't available Source: ../books/b04-access/05-applications-and-workload-identities.md#what-workload-id-premium-adds 18 1 0 7 21 21 NP2.2 Conversion waves sequenced: HIGH-risk accounts first (password never expires, over-privileged); rollback recorded per wave 3.4 2 2027-04-01T08:00:00 2027-04-07T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b02-identity/10-migrating-and-governing.md#phase-4-service-account-modernization 19 1 0 7 22 22 NPG2 Gate 2 — Every account has a decision 3.5 2 2027-04-07T17:00:00 2027-04-07T17:00:00 PT0H0M0S 7 1 ISSO Owner or approver: ISSO Criteria: Every account in the register has a disposition (retire, re-platform, or keep with an end date) and a target from the matrix; HIGH-risk accounts in the first wave; every kept Kerberos account has an SPN owner; waves and their rollback recorded Source: ../books/b02-identity/10-migrating-and-governing.md#phase-4-service-account-modernization 21 1 0 7 20 1 0 7 23 23 Phase 3 — Credential modernization 4 1

1

2027-01-28T08:00:00 2027-10-22T17:00:00 24 24 X-G1 Program G1 — Foundation Complete: groups and AUs drift-clean, Conditional Access baseline enforced 4.1 2 2027-02-26T17:00:00 2027-02-26T17:00:00 PT0H0M0S 7 1 Steward (program) Owner or approver: Steward (program) If decided late: Conversion has no group and policy foundation to land on (Book 02 puts service accounts after group migration) Source: program-master-schedule.md 4 2027-02-26T17:00:00 25 25 NP3.1 App management policy: new client secrets and symmetric keys blocked, certificates capped at 180 days for new apps; app instance property lock on owned apps 4.2 2 2027-01-28T08:00:00 2027-02-03T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/05-applications-and-workload-identities.md#enforcing-the-order-with-app-management-policies 10 1 0 7 26 26 NP3.2 Conversion wave 1, HIGH-risk accounts: workload identities created (managed identity, then federated credential, then certificate); federated token exchange tested 4.3 2 2027-04-08T08:00:00 2027-04-28T17:00:00 PT120H0M0S 7 0 Identity engineering, with application owners Owner or approver: Identity engineering, with application owners Source: ../books/b02-identity/09-building-the-entra-target.md#workload-identity-federation 22 1 0 7 24 1 0 7 25 1 0 7 27 27 NP3.3 Conversion wave 1 parallel run: old and new credentials side by side for 30 days, then the legacy accounts disabled 4.4 2 2027-04-29T08:00:00 2027-05-28T17:00:00 PT176H0M0S 7 0 Application owners Owner or approver: Application owners Source: ../books/b02-identity/10-migrating-and-governing.md#phase-4-service-account-modernization 26 1 0 7 28 28 NP3.4 Remaining waves converted, each with its own 30-day parallel run before the legacy account is disabled 4.5 2 2027-05-13T08:00:00 2027-08-04T17:00:00 PT480H0M0S 7 0 Identity engineering, with application owners Owner or approver: Identity engineering, with application owners Source: ../books/b02-identity/10-migrating-and-governing.md#phase-4-service-account-modernization 27 3 48000 7 29 29 NP3.5 Kerberos-only workloads: MSAs upgraded to gMSAs; traditional accounts, IIS application pools and scheduled tasks moved to a gMSA or a dMSA 4.6 2 2027-04-08T08:00:00 2027-05-05T17:00:00 PT160H0M0S 7 0 Server infrastructure Owner or approver: Server infrastructure Source: ../books/b02-identity/09-building-the-entra-target.md#the-migration-path-matrix 22 1 0 7 24 1 0 7 30 30 X-D08 End dates for legacy authentication and NTLM (program D08) 4.7 2 2027-04-23T17:00:00 2027-04-23T17:00:00 PT0H0M0S 7 1 Authorizing official (program) Owner or approver: Authorizing official (program) If decided late: Kerberos accounts that stay can't be given end dates, so the islanded list can't be handed to the program Source: program-master-schedule.md 4 2027-04-23T17:00:00 31 31 NP3.6 Kerberos accounts that stay: SPN owner and an end date within D08 recorded; the islanded list handed to the program's SPN retirement 4.8 2 2027-05-06T08:00:00 2027-05-12T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b02-identity/10-migrating-and-governing.md#what-still-needs-ad-after-phase-10 29 1 0 7 30 1 0 7 32 32 NP3.7 Rotation in place: certificates in Key Vault, rotated by the pipeline, raised before expiry and approved by the owner 4.9 2 2027-04-29T08:00:00 2027-05-12T17:00:00 PT80H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/05-applications-and-workload-identities.md#governing-app-registrations 26 1 0 7 33 33 NPG3 Gate 3 — Credentials modernized 4.10 2 2027-08-04T17:00:00 2027-08-04T17:00:00 PT0H0M0S 7 1 ISSO Owner or approver: ISSO Criteria: Every HIGH-risk account converted or retired; no account with a password that never expires; new identities authenticate without stored secrets where the host allows, otherwise with a certificate on the rotation schedule; no client secret in production outside a dated exception; legacy accounts disabled after a clean 30-day parallel run with no service disruption; every remaining Kerberos account islanded with an owner and end date Source: ../books/b02-identity/10-migrating-and-governing.md#phase-4-service-account-modernization 28 1 0 7 31 1 0 7 32 1 0 7 34 34 X-DG4 SQL Server's application chain on Entra principals (Data Platform plan, Gate 4) 4.11 2 2027-07-22T17:00:00 2027-07-22T17:00:00 PT0H0M0S 7 1 ISSO (Data Platform Identity Transformation plan) Owner or approver: ISSO (Data Platform Identity Transformation plan) If decided late: The SQL Server accounts handed over in Phase 0 are still on Windows authentication Source: data-platform.md 4 2027-07-22T17:00:00 35 35 X-P46 AD-bound service principal names migrated, retired or islanded (program P4.6) 4.12 2 2027-10-22T17:00:00 2027-10-22T17:00:00 PT0H0M0S 7 1 Application owners (program) Owner or approver: Application owners (program) If decided late: The program measures AD authentication for G4 while converted workloads still hold AD credentials Source: program-master-schedule.md 4 2027-10-22T17:00:00 33 1 0 7 36 36 Phase 4 — Least privilege 5 1

1

2027-03-11T08:00:00 2027-06-18T17:00:00 37 37 NP4.1 Permission sweep: owners review every grant; broad permissions such as Directory.ReadWrite.All replaced with application-specific roles and scopes 5.1 2 2027-03-11T08:00:00 2027-04-14T17:00:00 PT200H0M0S 7 0 Application owners Owner or approver: Application owners Source: ../books/b02-identity/09-building-the-entra-target.md#governing-service-principals 16 1 0 7 38 38 NP4.2 Managed identities' role assignments scoped to the resource and put on the app registrations' review cadence 5.2 2 2027-03-11T08:00:00 2027-03-24T17:00:00 PT80H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/05-applications-and-workload-identities.md#managed-identities 16 1 0 7 39 39 X-A34 Non-human privileged identities owned, off secrets, over-consented apps swept (Privileged Access plan, A3.4) 5.3 2 2027-06-18T17:00:00 2027-06-18T17:00:00 PT0H0M0S 7 1 Identity governance officer (Privileged Access & Administrative Identity plan) Owner or approver: Identity governance officer (Privileged Access & Administrative Identity plan) If decided late: Privileged service principals are outside this plan's sweep, so the least-privilege gate can't pass Source: privileged-access.md 4 2027-06-18T17:00:00 40 40 NP4.3 First quarterly owner review of permissions closed; access reviews for service principals in privileged roles 5.4 2 2027-04-15T08:00:00 2027-05-05T17:00:00 PT120H0M0S 7 0 Identity governance officer Owner or approver: Identity governance officer Source: ../books/guides/attribute-driven-migration.md#service-principals-managed-identities-and-workload-identities 37 1 0 7 38 1 0 7 20 1 0 7 41 41 NPG4 Gate 4 — Least privilege 5.5 2 2027-06-18T17:00:00 2027-06-18T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: No service principal holds a broad tenant-wide permission without a recorded justification; managed identities' role assignments scoped to resources; privileged non-human identities closed in the Privileged Access plan; the first quarterly review cycle closed with its findings acted on Source: ../books/b02-identity/09-building-the-entra-target.md#governing-service-principals 40 1 0 7 39 1 0 7 42 42 Phase 5 — Conditional Access for workload identities 6 1

1

2027-04-01T08:00:00 2027-05-19T17:00:00 43 43 NP5.1 Scope set: R1 single-tenant service principals assigned directly, never through a group; workload egress ranges named; managed identities and multitenant apps recorded as out of scope 6.1 2 2027-04-01T08:00:00 2027-04-07T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b02-identity/09-building-the-entra-target.md#conditional-access-for-workload-identities 20 1 0 7 24 1 0 7 16 1 0 7 44 44 NP5.2 CA015 location restriction and CA037 high-risk block in report-only; service principal sign-in logs read 6.2 2 2027-04-08T08:00:00 2027-05-05T17:00:00 PT160H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/07-the-conditional-access-policy-library.md#wave-4-risk-and-workload-identities 43 1 0 7 45 45 D-NP5 Enforce the workload identity policies 6.3 2 2027-05-05T17:00:00 2027-05-05T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Options: Enforce; extend report-only; enforce with named exclusions, each recorded with its owner and end date If decided late: R1 workloads stay reachable from anywhere with a stolen credential, and Gate 5 can't pass Source: ../books/b04-access/05-applications-and-workload-identities.md#conditional-access-for-workload-identities 44 1 0 7 46 46 NP5.3 Policies enforced ring by ring; block events alerted to security operations 6.4 2 2027-05-06T08:00:00 2027-05-19T17:00:00 PT80H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/07-the-conditional-access-policy-library.md#wave-4-risk-and-workload-identities 45 1 0 7 47 47 NPG5 Gate 5 — Workload identities under Conditional Access 6.5 2 2027-05-19T17:00:00 2027-05-19T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: Every R1 single-tenant service principal assigned directly to the enforced location and risk policies; report-only results reviewed before enforcement; every out-of-scope identity (managed identities, multitenant and SaaS apps) recorded with the control that covers it instead Source: ../books/b04-access/05-applications-and-workload-identities.md#conditional-access-for-workload-identities 46 1 0 7 48 48 Phase 6 — AI agents 7 1

1

2027-01-18T08:00:00 2027-05-07T17:00:00 49 49 D-NP6 AI identity capabilities the program builds on in the agency's cloud 7.1 2 2027-01-15T17:00:00 2027-01-15T17:00:00 PT0H0M0S 7 1 CIO, with the Chief AI Officer Owner or approver: CIO, with the Chief AI Officer Options: Agent identities where generally available in the agency's cloud, with GCC's documented subset; service principals and managed identities under the same governance where agent identities aren't available; preview capabilities as watch items If decided late: Agents are created with no decided identity type, and the production handshake can't be defined Source: ../books/b17-ai-identity/04-kinds-of-ai-identity.md#release-stage-licensing-and-government-clouds 6 1 0 7 50 50 NP6.1 Creation closed: Users can create agent blueprints set to No; agent app registrations routed to the blueprint path; consent baseline applied to agents 7.2 2 2027-01-28T08:00:00 2027-02-01T17:00:00 PT24H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b17-ai-identity/06-credentials-and-least-privilege.md#admin-consent-and-the-scuba-consent-baseline 10 1 0 7 51 51 NP6.2 Production handshake: blueprint, sponsor, consent, Conditional Access coverage and placement confirmed; access through expiring access packages 7.3 2 2027-02-18T08:00:00 2027-03-03T17:00:00 PT80H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b17-ai-identity/05-owners-sponsors-and-lifecycle.md#creation 49 1 0 7 50 1 0 7 13 1 0 7 52 52 NP6.3 Agent credentials: managed identity as the blueprint credential, else federation, else a certificate; no secret on a production blueprint 7.4 2 2027-03-04T08:00:00 2027-03-24T17:00:00 PT120H0M0S 7 0 Identity engineering, with technical owners Owner or approver: Identity engineering, with technical owners Source: ../books/b17-ai-identity/06-credentials-and-least-privilege.md#no-stored-secrets 51 1 0 7 25 1 0 7 53 53 NP6.4 Agent least privilege: access mode chosen first; narrow inheritance, never allAllowed for app roles; no standing privileged role 7.5 2 2027-03-04T08:00:00 2027-03-17T17:00:00 PT80H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b17-ai-identity/06-credentials-and-least-privilege.md#privileged-roles-for-ai-none-standing 51 1 0 7 54 54 X-IG4 Mover and leaver automation proven (Identity Lifecycle plan, Gate 4) 7.6 2 2027-04-23T17:00:00 2027-04-23T17:00:00 PT0H0M0S 7 1 ISSO (Identity Lifecycle & Provisioning plan) Owner or approver: ISSO (Identity Lifecycle & Provisioning plan) If decided late: The sponsor's mover and leaver events have no HR-driven workflow to ride on Source: identity-lifecycle.md 4 2027-04-23T17:00:00 55 55 NP6.5 Sponsorship tasks added to the HR-driven mover and leaver workflows; ten-business-day confirmation; human workflows kept off agents' user accounts 7.7 2 2027-04-26T08:00:00 2027-05-07T17:00:00 PT80H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b17-ai-identity/05-owners-sponsors-and-lifecycle.md#when-the-sponsor-moves-or-leaves 51 1 0 7 54 1 0 7 56 56 NP6.6 Agent Conditional Access in report-only: block all agent identities except those approved by attribute; block high-risk agents (preview, watch item) 7.8 2 2027-03-04T08:00:00 2027-03-17T17:00:00 PT80H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b17-ai-identity/06-credentials-and-least-privilege.md#the-token-subject-decides-which-policy-applies 51 1 0 7 57 57 NP6.7 AI drift checks running: agentic system with no governed identity, shadow AI identity, no accountable human, credential added outside the pipeline 7.9 2 2027-03-04T08:00:00 2027-03-17T17:00:00 PT80H0M0S 7 0 Security operations Owner or approver: Security operations Source: ../books/b17-ai-identity/07-monitoring-drift-and-shadow-ai.md#drift-comparing-what-was-declared-with-what-is-observed 51 1 0 7 58 58 NPG6 Gate 6 — AI identities governed 7.10 2 2027-05-07T17:00:00 2027-05-07T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: Every AI system in the current inventory vintage classified by kind of identity; every agent identity created through the handshake with a sponsor, a technical owner and a matching inventory record; no production blueprint with a client secret; no AI identity with a standing privileged role; sponsor mover and leaver tasks live; agent block policies in report-only with results reviewed; no open P1 AI drift finding Source: ../books/b17-ai-identity/10-evidence-and-authorization.md#the-evidence-an-authorizing-official-needs 52 1 0 7 53 1 0 7 55 1 0 7 56 1 0 7 57 1 0 7 59 59 Phase 7 — Steady state 8 1

1

2027-02-01T08:00:00 2027-12-03T17:00:00 60 60 NP7.1 Register drift scheduled: ownerless, unused or expiring registrations, passwords that never expire, credentials added outside the pipeline 8.1 2 2027-08-05T08:00:00 2027-08-18T17:00:00 PT80H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b02-identity/10-migrating-and-governing.md#git-based-drift-detection 33 1 0 7 61 61 NP7.2 A full review cycle: owners' quarterly permission review, sponsors' attestation, expiry-based recertification of agent access 8.2 2 2027-06-21T08:00:00 2027-07-09T17:00:00 PT120H0M0S 7 0 Identity governance officer Owner or approver: Identity governance officer Source: ../books/b17-ai-identity/05-owners-sponsors-and-lifecycle.md#recertification-expiry-is-the-review 41 1 0 7 58 1 0 7 62 62 X-D11 Provisional target end state: AD retired, or a dated Kerberos island (program D11) 8.3 2 2027-01-29T17:00:00 2027-01-29T17:00:00 PT0H0M0S 7 1 Executive sponsor and CIO (program) Owner or approver: Executive sponsor and CIO (program) If decided late: The gMSA and dMSA reconciliation has no target to reconcile against Source: program-master-schedule.md 4 2027-01-29T17:00:00 63 63 NP7.3 gMSAs and dMSAs reconciled with the provisional end state: moved to a workload identity, or listed for the Kerberos island with an end-of-life date 8.4 2 2027-08-05T08:00:00 2027-08-25T17:00:00 PT120H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/guides/attribute-driven-migration.md#service-accounts-msas-gmsas-and-dmsas 62 1 0 7 33 1 0 7 64 64 X-G5 Program G5 — AD Retired 8.5 2 2027-12-03T17:00:00 2027-12-03T17:00:00 PT0H0M0S 7 1 Executive sponsor and CIO (program) Owner or approver: Executive sponsor and CIO (program) If decided late: A workload still running under a gMSA loses its credential when the last domain controller is demoted Source: program-master-schedule.md 4 2027-12-03T17:00:00 63 1 0 7 65 65 NP7.4 Evidence to the ISSO for AC-2, AC-6(5), IA-4, IA-5 and IA-9, and for M-25-21; the annual inventory vintage comparison scheduled 8.6 2 2027-08-19T08:00:00 2027-08-25T17:00:00 PT40H0M0S 7 0 Identity governance officer Owner or approver: Identity governance officer Source: ../books/guides/attribute-driven-migration.md#federal-requirements 60 1 0 7 61 1 0 7 66 66 NPG7 Gate 7 — Steady state 8.7 2 2027-08-25T17:00:00 2027-08-25T17:00:00 PT0H0M0S 7 1 ISSO Owner or approver: ISSO Criteria: Every service account and service principal has an owner and sponsor, a reason and a target; each is retired, re-platformed to a managed identity or gMSA, or a certificate or federated workload identity; none holds a password that never expires and none is orphaned; drift checks and review cycles running; every remaining gMSA and dMSA moved or in the dated Kerberos island Source: ../books/guides/attribute-driven-migration.md#non-person-identity-track 63 1 0 7 65 1 0 7 47 1 0 7