The Gaps Between Design and Reality: Common SailPoint Implementation Misses

[alsriva4484]

I am looking for insights into commonly overlooked aspects of SailPoint IdentityIQ (IIQ) and Identity Security Cloud (ISC) implementations, particularly in organizations that lack strong technical teams or are not fully aware of the platform's capabilities. I can think of few 

• Losing sight of the core business objectives, such as strengthening security posture, automating identity and account lifecycle management, streamlining access certifications with automated remediation, and reducing operational overhead and support costs (helpdesk effort).

• Overlooking the adoption of complementary capabilities such as Access Risk Management (ARM), Data Access Security (DAS), and Cloud Infrastructure Entitlement Management (CIEM), which can significantly enhance the overall effectiveness of the identity security program.

What do you think??

[paul_patti]

@alsriva4484 great question and @amy_shillinglaw awesome suggestions!

It's indeed critical that business objectives lead, with technology enabling and supporting them. Too often I've seen the tail wagging the dog, where technology gets followed and implemented for technology's sake without questioning, or incrementally diverging from, the relevance to accomplishing goals of the business.

It seems that may be more important than ever, with AI able to take the lead and provide many opportunities for technological growth. An important foundation of all SailPoint's AI is that the final decision will always be made by a human - and ensuring alignment with business objectives can be a critical part of that consideration.

[amy_shillinglaw]

Hi @alsriva4484 I would add these to your list:

• Some organizations don't prioritize data hygiene and data cleanliness as highly as others. For example, when a department name is entered into HR data and possibly misspelled for several identities, these are 2 different departments. Users may not get the right access automatically assigned to them and the AI peer group analysis will not be able to make accurate recommendations. Data cleanup should be a part of every identity security program. Where this step is incorporated may differ between organizations - before or after data is onboarded to the platform.
• Not leveraging Access Modeling Role Insights for updating the identity security Role program (more capabilities within ISC). Applications and entitlements come and go, and the access model should be updated frequently to accommodate changes. The AI-driven Access Modeling component can help us maximize efficiency of the Role Program with insights into new roles that could be created OR entitlement updates to existing roles that make sense based on the analytics.
• Overlooking the importance of good descriptions everywhere, especially in access items. Identity Security Cloud has a lot of fields for adding descriptions: in certification campaigns, roles, access profiles and entitlements. Logical descriptions help reviewers make decisions faster and intelligently for Approvals and Certification campaigns, especially when the naming conventions of the access items may not be as intuitive OR when users are new to the organization. 
• Cramming too many implementation project objectives into Phase1 can sometimes lead to unexpected delays and missed deadlines. 

Other suggestions from other implementers?