Day-to-day operating brief
What Identity Controller work looks like in practice
An Identity Controller verifies people before creating or changing security identities and credentials. Terms should cover source documents, sponsors, duplicate records, photographs or biometrics, access requests, name changes, lost credentials, exceptions and revocation. The controller should not create identities from unverified email, merge similar people casually or collect additional personal data without an approved purpose. Identity Controller is a security role focused on identity controller work planning, security records, identity controller quality checks, security escalation, identity controller stakeholder updates, identity, controller, site assignment. The contract should describe the role's practical duties, reporting route, records, standards and compliance obligations without importing wording from another industry The Employee is employed as Identity Controller in the Employer's Security business. The role requires reasonable skill, care, accuracy, cooperation with management instructions and attention to the records, risks and standards specific to identity controller work The Employee must follow the security operational controls that apply to identity controller work, including SIA escalation, assignment instructions, access control, incident logs, patrol records and public interaction, accurate record keeping, escalation and safe working requirements The Employee must protect site, incident, CCTV, access-control, assignment, visitor, patrol and investigation records, including any personal data, customer or client information, operational records, pricing, credentials, security information, business plans and role-specific records accessed while performing identity controller duties Identity Controller work in Security must follow SIA expectations where they apply, the Employer's policies, data protection controls, health and safety rules, role records, escalation routes and training requirements relevant to identity controller work planning, security records, identity controller quality checks. Family: security Identity Controller Incident reporting Site awareness Public interaction Credential photographs and names should follow agreed quality and transliteration rules. Dormant identities require review against current sponsorship rather than automatic indefinite retention.
Responsibilities reflected in the contract
- Verify identity and sponsor authority.
- Enrol and maintain identity records.
- Issue replace and revoke credentials.
- Resolve duplicates and data exceptions.
- Preserve audit and privacy controls.
A realistic working scenario
An Identity Controller verifies people before creating or changing security identities and credentials. Terms should cover source documents, sponsors, duplicate records, photographs or biometrics, access requests, name changes, lost credentials, exceptions and revocation. The controller should not create identities from unverified email, merge similar people casually or collect additional personal data without an approved purpose.
Outputs to agree
- verify identity and sponsor authority
- enrol and maintain identity records
- issue replace and revoke credentials
Records and evidence
- The identity populations and assurance levels.
- The evidence and sponsor requirements.
- The biometric and privacy controls.
- The exception and revocation procedure.
- Work records.
- Handover notes.
Reporting relationship
Typically reports to Line Manager or Department Manager. Confirm the employer's actual reporting structure in the builder.
Authority and escalation
- An Identity Controller verifies people before creating or changing security identities and credentials. Terms should cover source documents, sponsors, duplicate records, photographs or biometrics, access requests, name changes, lost credentials, exceptions and revocation. The controller should not create identities from unverified email, merge similar people casually or collect additional personal data without an approved purpose.
- Obtain approval before committing expenditure, changing contractual commitments or making regulated or staffing decisions outside the assigned role.
Tools and systems
- Access control systems.
- Radios.
- Risk assessment records.
Workplace context
- Office, client premises, remote systems or assigned work locations.
Training and certification
- Complete employer-required health and safety training.
Contract priorities
- the identity populations and assurance levels
- the evidence and sponsor requirements
- the biometric and privacy controls
- the exception and revocation procedure
Information the employer should prepare
- the identity populations and assurance levels
- the evidence and sponsor requirements
- the biometric and privacy controls
- the exception and revocation procedure
- the security IT HR and data contacts
Individually written and reviewed against the maintained role record.