1Password access control & privilege security checks
Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.
On 1Password, Black Cat runs 15 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the 1Password connector needs.
Checks (15)
severity: high Suspended User Activity fix difficulty: medium #
Investigate activity from a suspended 1Password user and revoke any residual access
- Navigate to 1Password Admin > People and locate the suspended user
- Review recent activity in the audit log for the suspended account
- Verify the account was suspended intentionally and at the correct time
- Check for any shared vault access that may still be active
- Remove the user from all vaults and revoke any outstanding invitations
- If activity appears unauthorized escalate to the security team
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: low Suspended User Not Removed fix difficulty: easy #
Remove suspended 1Password users after confirming data handoff is complete
- Navigate to 1Password Admin > People
- Find suspended user
- Confirm data handoff is complete
- Remove user from organization
- Revoke any shared vault access
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-308.a3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: medium Dormant User fix difficulty: medium #
Suspend or remove dormant 1Password users after verifying account necessity
- Navigate to 1Password Admin > People
- Filter by last activity
- Contact user or their manager to verify account necessity
- Suspend if no longer needed
- Remove after confirmation period
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-308.a3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: high Failed Sign-in Attempt fix difficulty: medium #
Investigate repeated failed 1Password sign-in attempts and lock the account if brute-force is suspected
- Navigate to 1Password Admin > Reports > Sign-in attempts
- Review the source IPs, locations, and timestamps for the failed attempts
- Contact the affected user to confirm whether they initiated the attempts
- If unauthorized temporarily suspend the account to prevent further attempts
- Reset credentials and require re-enrollment if compromise is suspected
- Consider adding the source IP range to the firewall block list
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-33.1 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: medium Sign-in From Untrusted Location fix difficulty: medium #
Investigate 1Password sign-in from an untrusted location and verify with the user
- Navigate to 1Password Admin > Reports > Sign-in attempts
- Review the sign-in IP address, country, and timestamp
- Contact the user to verify whether they were traveling or using a VPN
- If unauthorized reset credentials and suspend the account immediately
- Consider adding the location to the firewall block list if illegitimate
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: high Failed Sign-in From Untrusted Location fix difficulty: medium #
Investigate failed 1Password sign-ins from untrusted locations and reset credentials if unauthorized
- Review sign-in attempt details including IP and country
- Check if user was traveling or using VPN
- If unauthorized notify user and reset credentials
- Consider adding the country to the trusted list if legitimate
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-33.1 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: medium Service Account Token Created fix difficulty: medium #
Verify the new 1Password service account token was authorized and revoke it if not needed
- Navigate to 1Password Admin > Reports > Activity and locate the token creation event
- Identify the actor, service account name, and intended use case
- Verify the token creation was approved through the change management process
- Confirm the token has least-privilege vault access and an expiration date set
- If unauthorized revoke the token immediately under Integrations > Service Accounts
- Add the service account and its purpose to the access inventory
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: medium Sign-in From Unknown Country fix difficulty: medium #
Investigate successful 1Password sign-in from an unknown country and verify with the user
- Navigate to 1Password Admin > Reports > Sign-in attempts
- Locate the sign-in event with an empty country field
- Check the IP address to determine origin using an IP geolocation service
- Contact the user to verify the sign-in was legitimate
- If unauthorized, suspend the account and reset credentials
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: medium Failed Sign-in Without MFA fix difficulty: easy #
Investigate failed sign-in attempts without MFA and ensure MFA is enforced for all users
- Navigate to 1Password Admin > Reports > Sign-in attempts
- Locate the failed sign-in event without MFA
- Verify whether the user has MFA enrolled
- If MFA is not enabled, require enrollment via security policy
- Monitor for further failed attempts from the same source
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: low Sign-in With No Client Recorded fix difficulty: easy #
Investigate 1Password sign-in with no client application recorded
- Navigate to 1Password Admin > Reports > Sign-in attempts
- Locate the sign-in event with missing client information
- Check whether the sign-in came from an unofficial or unsupported client
- Contact the user to verify the sign-in method
- Review approved 1Password client versions and enforce updates
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: low Sign-in With No IP Recorded fix difficulty: easy #
Investigate 1Password sign-in with no IP address recorded and check for API or automation access
- Navigate to 1Password Admin > Reports > Sign-in attempts
- Locate the sign-in event with missing IP address
- Determine if the sign-in originated from a service account or CLI tool
- Contact the user if the sign-in was interactive
- Review Events API integration configuration for data completeness
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: high Failed Sign-in From Unknown Country fix difficulty: medium #
Investigate failed 1Password sign-in from an unknown country as a potential credential stuffing attempt
- Navigate to 1Password Admin > Reports > Sign-in attempts
- Locate the failed sign-in event with empty country field
- Check the source IP for known anonymizer or proxy usage
- If the source appears malicious, add the IP range to the firewall block list
- Contact the affected user to verify they did not initiate the attempt
- Consider temporarily suspending the account if multiple failed attempts are seen
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: low Resource Created fix difficulty: easy #
Review the newly created 1Password resource and verify it was authorized
- Navigate to 1Password Admin > Reports > Activity
- Locate the resource creation event and identify the actor
- Verify the creation was authorized through normal workflow
- If unauthorized, remove the resource and investigate the actor account
- Document the resource in the asset inventory
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: medium Suspended User With MFA Disabled fix difficulty: easy #
Enable MFA for suspended 1Password user before any potential reactivation
- Navigate to 1Password Admin > People
- Locate the suspended user
- Note that MFA is not enabled for this account
- If the user will be reactivated, require MFA enrollment before restoring access
- If the user will not be reactivated, consider removing the account entirely
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: medium User With No Recorded Activity fix difficulty: easy #
Investigate 1Password user with no recorded activity and verify account necessity
- Navigate to 1Password Admin > People
- Locate the user with no activity
- Determine if the user was recently provisioned and has not yet logged in
- Contact the user or their manager to verify account necessity
- Suspend or remove the account if no longer needed to reduce license costs
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2