Okta / Identity Provider Security Posture Kit

Okta does not hold mailboxes or files. It holds the keys to everything else. The M365 and Google Workspace kits ask what a compromised account can reach inside one productivity suite. An identity provider changes the shape of that question: a compromised Okta account, an over-scoped API token or an unreviewed third-party integration has whatever blast radius the downstream app catalogue gives it — M365 or Workspace, Salesforce, Slack, GitHub, and dozens of smaller tools at once. This kit assesses Okta as the front door to that whole catalogue, not as a fourth suite.

Two surfaces weigh more here than in the other two kits, and the kit says why. A long-lived API token typically bypasses MFA on use and often outlives the person who created it — no login, no factor, no session to see. Third-party OIN and OAuth integrations carry higher stakes than the equivalent app-consent rows in a suite, because Okta is the trust root for every app behind it. Both are weighted higher in the scoring tool as a disclosed asymmetry, not padding.

No CIS benchmark exists for Okta, and the kit does not pretend otherwise. Where the M365 and Workspace kits map their hardening baseline to a CIS Foundations Benchmark, file 04 maps to CIS Controls v8 safeguards 5, 6 and 8 plus Okta's published guidance, and discloses the substitution in its README tab rather than quietly faking parity.

The System Log sees the Okta layer only, and the kit says so. It shows the grant, not what happened inside the destination app afterwards. File 06 is labelled "Okta layer only" and instructs pairing it with the M365 or Workspace kit's file 06 for the full attack chain — a limitation stated, not scored around.

What you get

01 Assessment Methodology (DOCX) — why an IdP is not a third reskin, the five modules, run order, cross-links and assumptions.

02 Identity & Access Review Workbook (XLSX) — Authentication Policy (Global Session Policy, per-app step-up, network zones, break-glass), MFA & ThreatInsight (FastPass and WebAuthn for admins, adaptive MFA with no bypass, ThreatInsight set to block), Admin Roles (super-admin count, custom roles, API tokens tied to scoped roles) and App Catalog Governance — 17 weighted controls rolling into one identity posture score.

03 Blast Radius Scoring Tool (XLSX) — the flagship module. Select the tier and add-ons, pull the SSO app inventory first, then answer the control questions across downstream app access, API tokens, third-party integrations and detection, and get one score, a band on the same bands as the sibling kits, and a closure list ranked by risk-weighted points.

04 Control-Baseline Hardening Checklist (XLSX) — Account Management, Access Control Management, Audit Log Management, and Integration & Non-Human ID, scored gap-to-target with a hardening percentage per family.

05 Data Governance Review (DOCX) — the module that departs most from its siblings, because what Okta governs is directory data: Universal Directory attribute sprawl, entitlement and certification evidence, and the non-human and AI-agent identity inventory — a first-class governance surface in 2026, with the same downstream reach as a human account and less oversight.

06 Detection Readiness Matrix (XLSX) — System Log source mapping by tier and add-on, each row stating whether it reaches the downstream app.

07 Executive Summary Template (DOCX) — one page, plus a Downstream footprint table the other two kits do not have: the applications this tenant fronts, their sensitivity, and which kit governs each. A board reader who never thought of Okta as a single point of failure sees it on one page.

okta01.json — scoring bands, tier components, surfaces, the CIS Controls v8 substitution and the module map.

A worked example throughout. Larkspur Underwriting Group, a fictional mid-market insurance underwriter on Workforce Identity Cloud without Identity Governance, fronting M365 and Salesforce — the common case where an unlicensed governance capability with no manual substitute is a real gap.

Where it sits. The M365 Security Posture Kit and the Google Workspace Security Posture Kit are the destination-app siblings; Okta typically fronts one or both, and usually Salesforce too — the Salesforce Security Posture Kit is where the 2025–2026 breach wave actually landed — and the GitHub / GitLab Security Posture Kit covers the pipeline behind all of it. The set of five is cheaper than buying them separately. The IR Runbook Library is the response layer. Implement what this flags with Build Series vol. 06 — Identity & Access; run it against a vendor's IdP with the TPRM Program Kit; hand file 07 to the Director's Cyber Oversight Kit.

Controls are written against Okta Workforce Identity Cloud terminology as of Q3 2026. The structure generalises to other IdPs; the specific controls do not. Not Auth0 / Customer Identity Cloud. Okta re-tiers products and add-ons regularly, so the tier logic is marked verify. Scores are a prioritisation aid, not a certification, an audit opinion or an insurance-underwriting determination. Not legal advice.