CustodyID
Secure Federated Identity Layer
CustodyID is Agency's secure, federated identity layer — centralizing access to all Agency applications while maintaining unified control over your organization's GRC platforms, cloud environments, and security tools. One identity, one access policy, one audit trail. CustodyID ensures that every user, session, and permission across the Agency ecosystem is governed, logged, and compliant.
One identity, one access policy, one audit trail.
Platform · CustodyIDWhat It Does
Identity governance is a critical control domain across every compliance framework. CustodyID provides the centralized identity layer that ties together your entire Agency-managed security and compliance ecosystem.
Federated Single Sign-On — CustodyID provides a single identity layer for accessing all Agency applications and client-facing tools. One set of credentials, one MFA policy, one access governance framework.
Unified Access Control — Access to GRC platforms, cloud environments, security tools, and Agency applications is governed through CustodyID, ensuring consistent access policies across your entire compliance-managed technology stack — including the tools you already trust — Vanta, Drata, CrowdStrike, Okta — with no rip-and-replace.
Complete Audit Trail — Every authentication, session, permission change, and access event across the Agency ecosystem is logged and auditable through CustodyID. Auditors receive a single, comprehensive access record that satisfies every framework's access control evidence requirements.
Least-Privilege Enforcement — CustodyID enforces role-based access with least-privilege principles, ensuring users have access only to the systems and data their role requires — and that access is reviewed and documented continuously.
Automated Access Reviews — CustodyID supports automated access reviews, generating evidence of regular access audits that satisfy SOC 2, ISO 27001, HIPAA, and HITRUST requirements.
Onboarding and Offboarding Governance — When workforce members join or leave the organization, CustodyID manages provisioning and deprovisioning across the entire Agency ecosystem, documenting every access change for audit.
Operational Use Cases
CustodyID supports identity governance, access reviews, least-privilege enforcement, and audit evidence around who has access to what. Agency engineers use it across systems such as identity providers, cloud platforms, GRC tools, and customer-specific applications.
It is useful for organizations preparing for SOC 2, ISO 27001, HIPAA, GDPR, and enterprise diligence where access control evidence must be current and defensible. CustodyID connects access operations to the compliance record.
Implementation Model
Agency maps roles, privileged access, review cadence, and termination workflows into the operating model. Exceptions such as stale access, missing approvals, or inconsistent ownership are routed for engineer review.
Customers get access governance that stays alive between audits. CustodyID supports the workflow, while Agency engineers operate the controls and document the results.
Platform · Forward Deployed
CustodyID supports the workflow. Agency engineers operate the controls.
CustodyID is a client-facing platform. Clients use CustodyID to access Agency applications and manage their organization's identity governance within the Agency ecosystem. CustodyID provides the secure, compliant access layer that connects everything Agency operates on behalf of the client.
Platform Products
Agency AIEnd-to-end cybersecurity and compliance, across the stack you already use. Agency MDRManaged detection and response GRC IntegrationsEngineer-operated GRC platform integrationFind your auditor
Auditnex makes buying audits simpler and more transparent.
Agency implements the controls, collects the evidence, and manages your auditor relationship on top of the GRC tools you already use.
Explore AuditnexCommon GRC Questions
GRC Platform & Virtual CISO FAQ
Answers to common access-governance questions — SSO and MFA policy, access reviews, onboarding and offboarding evidence, and what a virtual CISO actually does for your program.
Read the FAQExplore the Agency Platform
See it on the home pageBuild a Security & Compliance Team Led by Your Own Virtual CISO
Forward-Deployed Engineers + AI that lower costs, increase velocity, and raise the bar — from policy to audit to remediation. U.S.-based forward-deployed engineers, supercharged by proprietary AI, operate your program end-to-end — on top of the tools you already trust.