Mission
Assure that only the right people and entities have the right access at the right time to enable the organization to securely reach its goals.
Responsibilities
Responsibility | Domain | Category |
|---|---|---|
Assess existing IAM capabilities, develop a risk-based IAM strategic roadmap aligned with the organization's goals and obtain top management sponsorship for it | All | GOVERNANCE |
Embrace Identity and Access Management holistically including Workforce IAM, 3rd Party IAM, Client IAM, Object IAM, Technical IAM or PAM and Physical Access | All | GOVERNANCE |
Assure that the IAM function and program are supervised by and report to adequate governing bodies | All | GOVERNANCE |
Design and implement IAM policies that establishes clear requirements and accountability for IAM topics | All | GOVERNANCE |
Develop an IAM technological roadmap to sustain the organization's digital transformation | All | GOVERNANCE |
Find, recruit, retain, train, and develop IAM talents | All | GOVERNANCE |
Design and implement authorization processes that assure the legitimacy and appropriateness of access permissions | All | GOVERNANCE |
Assure coverage of IAM processes over the information system by dynamically integrating IT Asset Management inventories | All | IDENTIFY |
Identify and analyze IAM related risks in alignment with the organization's risk management framework | All | IDENTIFY |
Conduct regulatory and industrial watch to identify regulatory, contractual and industrial requirements and best practices | All | IDENTIFY |
Facilitate and provide evidences for internal and external audits on IAM related topics and manage related findings and recommendations | All | IDENTIFY |
Embed IAM requirements by design in the SDLC, Project, and Change Management processes | All | IDENTIFY |
Assure adequate traceability in IAM processes to fullfill compliance and security requirements | All | IDENTIFY |
Reconciliate systems with authorizations to identify and act upon anomalous identities and accesses | All | IDENTIFY |
Use data analytics to identify and respond to anomalous identities, accesses, and behaviors | All | IDENTIFY |
Effectively implement IAM remediation plans to mitigate IAM related risks and remediate findings | All | PROTECT |
Assure identity proofing and XXX | PROTECT | |
Implement and maintain role-based and other access control models in consistency with the organizational structure and due respect for the least privilege and its specialized form the need-to-know principles | All | PROTECT |
Design, implement, operate, and continuously improve IAM controls to efficiently and effectively assure compliance with regulatory, contractual and industrial best practice requirements | PROTECT | |
Home office and remote access | PROTECT | |
Design, implement, and continuously improve privileged and technical access management processes and capabilities to effectively mitigate high privileged access risks | PAM/TAM | PROTECT |
Off-boarding and security | PROTECT | |
Mitigate fraud and accidents by deploying SoD and toxic rights controls | All | PROTECT |
Deploy authentication mechanisms whose robustness is commensurate with risk | All | PROTECT |
Clean the information system from anomalous identities, including orphaned accounts, and access permissions | All | PROTECT |
Recertification | PROTECT | |
Remediate anomalous identities and accesses | PROTECT | |
Define and implement a password and secrets management policy | PROTECT | |
Federation with 3rd parties | PROTECT | |
