An exposure review finds three work addresses that look like variations of one person's name. A spreadsheet turns them into three affected employees. Another analyst merges them into one.
Both decisions can be wrong if neither is supported by the organization's account records.
Treat identifiers as identifiers first
An email-shaped identifier is an observation about a record. It may be a primary work address, alias, shared resource, former address, or account whose current ownership is unclear.
Use the directory and relevant service administration records to establish relationships. Do not guess identity from spelling alone or assume every provider treats address variations the same way.
NIST's identity and access control framework is useful background for managing account identities. The practical worksheet below is an investigation aid, not a claim that a name-matching rule can identify a person.
Build an ownership table
For a fictional organization, the review might look like this:
| Observed identifier | Authorized owner record | Reporting treatment |
|---|---|---|
| [email protected] | Current named account | One observed account identifier |
| [email protected] | Team-managed resource | Shared resource, not one employee |
| [email protected] | Historical address, ownership under review | Unresolved until confirmed |
Preserve the original identifier in the protected evidence view. Add an explicit ownership annotation rather than silently rewriting what the record contained.
A record can be relevant before ownership is resolved. It should simply retain an uncertainty label and a responsible reviewer.
Keep service accounts and recycled addresses visible
A functional address may belong to a workload rather than a person. An old address may also have changed ownership over time.
Ask which date the ownership record describes. A current directory entry does not automatically establish who used an address when historical evidence originated.
Avoid contacting a person named in a record before confirming the organization's authorized communication route. A mistaken identity assignment can disclose sensitive context to the wrong recipient.
Report the unit you actually established
Use “distinct observed account identifiers” when that is what was counted. Use “current employees” only when an authorized ownership review supports that population.
A management report can show confirmed owners, shared resources, and unresolved identifiers separately. Those categories communicate progress more honestly than forcing every row into a person-shaped total.
Read records versus account counts and investigating non-email usernames. Better counting begins with preserving the difference between a string in evidence and a person whose current relationship to the organization has been confirmed.