Page Comparison

Identify key IAM stakeholders including but not limited to: Top Management, IT, Security, Compliance, Business Lines, HR, Procurement.

All

Collect and prioritize IAM requirements from the key IAM stakeholders.

All

Assess existing IAM capabilities, define a vision and develop a risk-based IAM strategic roadmap aligned with the organization's goals and obtain top management sponsorship for it. This implies coordination with IT, Security, Compliance and other key the key IAM stakeholders.

All

Embrace Identity and Access Management holistically including all IAM domains: Workforce IAM, 3rd Party IAM, Client IAM, Object IAM, Technical IAM or PAM and Physical Access

All

Assure that the IAM function and program are supervised by and report to adequate governing bodies

All

Design and implement IAM policies that establishes clear requirements and accountability across all IAM domains

All

Develop an IAM technological roadmap to sustain the organization's digital transformation

All

Find, recruit, retain, train, and develop IAM talents

All

Design and implement authorization processes that assure the legitimacy and appropriateness of access permissions

All

Assure coverage of IAM processes over the information system by dynamically integrating IT Asset Management inventories

All

Identify and analyze IAM related risks in alignment with the organization's risk management framework

All

Conduct regulatory and industrial watch to identify regulatory, contractual and industrial requirements and best practices

All

Facilitate and provide evidences for internal and external audits on IAM related topics and manage related findings and recommendations

All

Embed IAM requirements by design in the SDLC, Project, and Change Management processes

All

Effectively implement remediation plans to mitigate IAM related risks and remediate findings

All

Implement and maintain role-based and other access control models in consistency with the organizational structure and due respect for the least privilege and its specialized form the need-to-know principles

All

Design, implement, operate, and continuously improve IAM controls to efficiently and effectively assure compliance with regulatory, contractual and security requirements

All

Design, implement, and continuously improve privileged and technical access management processes and capabilities to effectively mitigate high privileged access risks

PAM/TAM

Mitigate fraud and accidents by deploying SoD and toxic rights controls

All

Deploy authentication mechanisms whose robustness is commensurate with risk

All

Clean the information system from anomalous identities, including orphaned accounts, and access permissions

All

Implement an efficient off-boarding process that effectively mitigates the risk of unauthorized access by former employees

Workforce IAM

•  Add item: Federation with 3rd parties

3rd Party IAM

•  Add item: Recertification

Workforce IAM

•  Add item: Home office and remote access

Workforce IAM, 3rd Party IAM, PAM/TAM

•  Add item: Identity proofing

All

•  Add item: Password and secrets management

All

Reconciliate systems with authorizations to identify and act upon anomalous identities and accesses

All

Assure adequate traceability in IAM processes to fullfill compliance and security requirements

All

In coordination with Security Operations, deploy, maintain, and continuously improve monitoring and analytics capabilities to detect anomalous authentication and accesses to deter unauthorized accesses

All

Use data analytics to identify and respond to anomalous identities, accesses, and behaviors

All

In coordination with the CSIRT / Incident Response Team, continuously prepare and improve IAM response capabilities (including SOPs) to effectively contribute to the containment and eradication of security incidents when they occur

All

Suspend anomalous identities and revoke their accesses in response to security incidents in liaison with the CSIRT / Incident Response Team

All

Based on reconciliation, investigate the root causes of identity and access anomalies and initiate remediation plans accordingly

All

Contribute to contingency planning by leveraging IAM capabilities for the recovery of large scale incidents or disaster

All