Identity-First Starter Bundle
Three entry-level identity security kits in one document: callback verification SOPs, service account cleanup, and an AI acceptable use policy — with a 30-day implementation plan a small team can actually finish.
$300One-time payment · Instant PDF download · 9 pages
Get the Starter Bundle — $300See what's insideWho this is for
Small and mid-sized organisations that need the three foundational identity controls in place — without a consulting engagement.
- Finance, HR and help-desk teams who act on urgent requests by phone, video, chat or email
- IT teams with service accounts, API keys and automation identities nobody has reviewed
- Leaders who need clear, written rules for staff use of generative AI tools
- Anyone who wants each kit implemented in weeks, not quarters
What's inside
Each part is a two- to three-page kit. Do them in order; each reduces the risk the next one depends on.
Callback verification SOPs
- The core rule: verify every urgent request by calling back a known directory number — never a number supplied in the request
- Four SOPs: payments and bank changes, credential/MFA resets, sensitive data requests, executive and vendor urgent requests
- Two refusal scripts staff can use word-for-word
- Fields for transfer threshold, directory location and incident reporting
Outcome: no payment, credential or data change on an unverified request.
Service account cleanup
- Inventory guide across directory, cloud consoles, SaaS admin consoles, servers and scripts, and CI/CD
- Inventory worksheet: account, system, owner, purpose, last used, privileges, decision
- Eight-point control checklist: owners, least privilege, rotation, secrets manager, alerting, disable-and-remove cadence
- Four-week action plan
Outcome: every non-human identity has an owner, a purpose and a rotation date.
AI acceptable use policy
- Balanced-tier policy text with seven rules, ready to adapt (approved tools, data classes, intake, review, automated decisions, disclosure, incident reporting)
- Staff one-pager checklist for roll-out
Outcome: staff know what data may go into which tools.
| Week | Callback SOPs | Service accounts | AI policy |
|---|---|---|---|
| 1 | Approve SOPs; brief finance, HR, help desk | Inventory | Choose tier; adapt text |
| 2 | Rehearse scripts; set code phrases | Assign owners; decide | Legal/HR review |
| 3 | Roll out to all staff | Remove, reduce, rotate | Roll out with one-pager and email |
| 4 | First incident-report review | Alerts and quarterly review set | Collect tool requests |
Also included: a 30-day implementation plan across all three kits and a wrap-up action-plan page to capture owners and due dates.
How it works
Secure one-time checkout via Stripe.
Your PDF is available immediately on the confirmation page.
Follow the 30-day plan: SOPs first, then service accounts, then the AI policy.
Use the action-plan page and come back in 30 days to check what moved.
Questions
What format is it?
A 9-page PDF, delivered instantly after payment.
Is this a service or a document?
A document. It is designed for self-implementation by a small team. If you want StonePath to run the work, see our services.
Do I need any tools to use it?
No. The kits reference your existing directory, cloud and SaaS consoles; no purchases are assumed.
What is the next step after the bundle?
The Full Identity Stack covers the three core programmes that build on these controls: anti-deepfake operations, identity-first SOC detections and AI surface hardening.
This material is for education and internal planning. Test any configuration, rule or policy in a non-production environment first. It is not a substitute for a professional security assessment or legal review. Prepared for the purchaser's personal or internal business use; please do not redistribute.