Care and Feeding of your Identity and Access Governance Program

[amber_miles]

Whether you have onboarded your Cerner solution into IdentiyIQ or not, the care and feeding of your Identity and Access Governance program is something many of your peer organizations struggle with. While your initial implementation of IdentityIQ was a major enterprise level security project that required buy-in from many different parts of your organization, as well as support from the highest levels, the same level of planning and dedication should be applied to the ongoing business of running a full scale Identity and Access Governance Program! In order to onboard more applications and maximize the value of IdentityIQ after your initial go live, it is important to continue to be systematic and thorough by adhering to the following advice

1. Revisit your staffing model – Now that you are live with IdentityIQ, do you have adequate staffing to keep the lights on? If not, you’ll never be able to add on to your existing implementation. If you have great people, ensure they are trained up! Our Advanced Provisioning course can help build the knowledge you need in-house to start onboarding some of those applications yourself. If you do not have properly trained staff, or need refreshers, please reach out to your CSM. 
2. Is your IAM steering committee still meeting? This can be a great forum to get people together to talk about prioritization of applications and functionality. This steering committee should include, at a minimum, compliance officers, security personnel, IT application owners, process owners, executive leadership and any other pertinent stakeholders. Set up regular meetings and continue to seek buy-in from all levels!
3. Don’t let perfection be the enemy of progress. Not all organizations are at a place where 100% of all processes can be 100% automated. In fact, most organizations are not! However, you can start small and build upon that. Even just the creation and disabling of accounts, or a regularly scheduled Access Certification can be a relief to application security teams.
4. Talk to your peers. Odds are, if you are struggling with something another organization has probably had the same struggle. This forum is intended to be a place for making connections and sharing information. We are all better when we work together!

Have you completed your phase one implementation but are struggling with where to go next? Have you built a successful IAM program at your organization and have additional tips to share? Please share your experience below!