Governance Platform : Policy Catalog

In many organizations, enforcing access policy is complicated: systems evolve and change, new roles and users are continually added and existing users need new privileges as additional job responsibilities are assigned. Unless IT and business managers have an automated, easy way to define and scan for policy violations and validate all new access requests before they are granted, violations will remain or seep back into the system.

The Policy Catalog is a key component within the Governance Platform that provides an easier, automated way to define policies, validate access requests and check for violations. By capturing enterprise governance, access request, and provisioning policies within the platform, IdentityIQ delivers a highly-extensible framework for defining and implementing both detective and preventive audit controls.

The policies supported by the Policy Catalog work together to control how user access is granted, and ultimately provisioned, within the enterprise. Supported policies include:

• Governance policies: Regulate and control the access privileges users are allowed to possess within the organization based on their job function. Common governance policies include separation-of-duty (SoD) rules, privileged account policies, and risk-based policies.
• Access request policies: Control the self-service access request process by establishing the business rules for who can make a request, what a user can request, and who must approve the request.
• Provisioning policies: Define how an access request gets fulfilled in the target IT resource or across multiple IT resources. Provisioning policies define the change fulfillment process (e.g., automated provisioning system, manual change by an IT admin) and what information is required by the target system to process the change request.

Define and Apply Access Policies

A centralized policy repository promotes reuse of enterprise governance, request and provisioning policies across enterprise applications and organizational business processes. With the Policy Catalog, organizations are able to:

• Improve compliance with internal policy and external regulations when granting and certifying access
• Proactively maintain security through automated access request and provisioning processes
• Detect and prevent policy violations and respond appropriately with remediation
• Enable business participation in policy enforcement via easy-to-use tools and rich business context
• Achieve enterprise-wide policy enforcement that spans applications and platforms