At the Helm: Identity Compliance –
Some Assembly Required

By Kevin Cunningham President & Founder

As we approach an early Thanksgiving this month, along with the holiday shopping frenzy, I'm looking forward to the fun that comes with the late night assembly of the new toys for my girls the night before Christmas. After a few glasses of homemade eggnog, I enjoy the challenge of piecing together bicycles, scooters, and wagons and placing them near the tree for the next morning.

The one part that I don't look forward to is reading the instructions. I tend to get overly excited, dumping the contents of the box onto the garage floor, and immediately start piecing together the parts that are obviously meant to go together. No time to read directions or take a quick inventory of the supplied parts. Just a quick assembly and voila, there you have it – a glorious bicycle, and a few extra nuts and bolts – oh, and a missing handlebar.

Here comes the stress as we near 2:00 a.m. and it seems that I've constructed a rather dangerous vehicle for my daughter. Did I miss some of the required bolts – why are there extras? And, where is that handlebar? Surely it's somewhere in here.

Unfortunately, this experience is all-too-often analogous to many of the identity compliance projects underway at any large enterprise. We see it everyday: anxious optimism early on followed by a rush to complete the project, resulting in a less-than-desired outcome. So, in honor of the upcoming holiday festivities, I'm offering a few pointers that may just help you assemble a successful identity compliance project.

1. The first order of business is to begin with the end in mind. Be clear on the objectives you want to achieve and how it should work when you are finished. Don't mistake a component for the final goal – for example, you may want roles defined and assigned across the organization, but that's likely not the ultimate goal. Role management is simply a part of an overall identity effort – an enabler, much like a tire is to a bicycle. Are you hoping to automate compliance? Do you want to more efficiently enforce separation of duty and other access policies? Having a clear picture of the end goal is critical to knowing how to assemble it and what's required

2. Next, you need to make sure you have the right tools for the job. You obviously can't put together a bike without a wrench. Same thing for identity compliance projects. Manual tasks and spreadsheets are simply not the right tools for the job. They're not sustainable. What's required today is automation integrated with key identity management tools like risk management and identity analytics.

3. To avoid a frustrating outcome, it's important to take inventory and become familiar with the components you have to work with. You should probably even sort them into groups and make sure they're all there (no missing or extra parts, please). I liken this step to data cleansing and preparing the environment prior to an identity management deployment. Progress can be delayed if you're working with uncorrelated, missing, or inaccurate identity data. It's best to first correlate user identities across systems and applications, identify the areas that need clean up, and then move forward to deployment. If you skip this step, you'll find your deployment stalled or nearly impossible to complete.

4. Of course, it's helpful to read the instructions when assembling a bicycle. Although it may look simple, one wrong turn can really get you off track. With identity compliance projects, this is an imperative, especially when something like an audit deadline is looming. Take due care to get the directions (requirements) from the lines of business, the audit and compliance teams, as well as IT security and operations. Understanding each stakeholder's needs and priorities will ensure a more successful outcome.

5. Finally, once your identity project is in production, don't forget to focus on the all important end user (one of my daughters, in the case of the bicycle). Proper training and adoption is a key step in the project's overall success. Just as I wouldn't expect my daughter to hop on a two-wheeler for the first time and take off without a hitch, the project implementation team should expect that a fair amount of coaching, and even hand-holding will be required to ensure successful adoption of the solution. If users don't use the solution, your work will all be in vain. Be sure your plan includes time to teach, encourage and assure that the technology is being properly used by everyone.

Wishing you a productive and safe holiday season,
Kevin Cunningham