Sam Tang, EY, explains how organizations can tackle mergers, acquisitions and divestitures with a cutting-edge identity program.
Natalie Reina: Hello to our viewers at home, I’m Natalie Reina with SailPoint and this is Identity Talks and today we have a very special guest Sam Tang with EY, a leading global SailPoint partner. Today we’re going to talk about how EY why helps organizations manage their identity challenges while working through business transactions such as mergers, acquisitions and divestitures. In 2018 alone, there are more than 1,000 US acquisitions totaling more than $100 million and in a recent EY survey, they found that in the next two years that’s expected to double, which poses a lot of cyber security challenges. So Sam, thanks for being on.
Sam Tang: Thanks for having me.
Natalie Reina: Yeah, so let’s just talk about, let’s just say I’m an organization and I’m going to go through an acquisition. How can I ensure that I’m going to be productive from day one, during an M&A.
Sam Tang: Sure um day one actually has a specific definition in the M&A divestiture business transaction. So we’ve been working with our counterparts in Cisco practices on the business process side that are experts in M&A so we were actually when we were building this solution based on your, the SailPoint IdentityIQ technology. We actually use them as our consultants for for them to teach us as to what to be on the lookout for. And I’m going to throw out a term called TSA because that drives a lot of what the mandates are and what people need to do with an M&A and divestiture. And the TSA stands for transaction, not the airline TSA, it’s actually, it’s transactional services agreement. It’s the agreement from a buyer to seller, it’s usually at the divesting and the agreement, but nonetheless, regardless of the TSA there’s always mandates for what, what, what people consider is day one. And day one is defined as the buyers ability to assume a mis administrative responsibilities. Yeah so what that means is that on day one, that’s the day when the buyer takes over the administrative activities for the people that are coming from the other company. Yeah so and what that means is that you have to coordinate the turning off of access from the seller and you have to turn on access for the buyer for these people that are coming in. So typically, it’s not a a black and white, and you should move all these people over and it’s done. Usually there’s a transitional period as well where you need to grant people access to both environments for a period of time because there is the transition. And that’s why they want is so important when it comes to M&A and divesting because that’s your gauge and that’s your, your evaluation as to how ready you are for the buyer, buying company to be ready to assume the administration of access for these people coming in, yep.
Natalie Reina: In a recent white paper called Securing Sea Changes: Successfully Navigating Top Identity Challenges, EY and you mentioned that M&A and divestitures can be an excellent catalyst for identity improvement. So why is that and how can organizations, make their identity ecosystem more complex and better?
Sam Tang: Yeah, no so um in all of our clients that we’re in with now, that we’re doing a lot of business transactions like these, we focus on agility and the agility, usually in the identity world usually starts with the workforce and the workforce is what I’m talking about is the workforce management side of it. And the reason why that is, is because if you think about M&A and divestiture, a lot of the use cases that we are, we are, first of all. The first question is, how well are you equipped to manage the lifecycle events of an identity. When somebody gets hired are you equipped to do birthright provisioning? When somebody gets terminated are you equipped to remove their access immediately? Risk exposure and everything in between. Job changes, move up, location changes, going on leave, and so on so forth. Yeah, those are well defined and in addition to that, what you, what you see from an M&A and divestiture is that you have an additional use case that that’s much more complex than just the ones that I just mentioned, which typically are the use cases we cover. Is entity, company change so when you move from one company to another company, you need to lose access to one and and gain access to another. And just creating them, a lot of people just approach it by treating one termination here and a rehire over here or a new hire over on this side. But, but that could damage some access because of transitional period. Yeah so, and what I would say here is that the way that people should be taking advantage of the M&A is number one, improve their posture on workforce management and how they deal with lifecycle management and do a move to a cloud strategy first. So as part of the migration move people to the cloud. Yeah, so don’t add more technical debt to the the unfriend and simplify. Simplify the user journeys that you have to deal with, simplify the controls that are in place and simplify the technology implementations that you have. And lastly, embrace automation if you have not done so already. So those are the things that ultimately when it comes to taking advantage of business transaction like this because they do have a chance to improve their posture in their IAM ecosystem.
Natalie Reina: That’s great advice. My last question is what if I’m a company that lacks any kind of resources or identity program whatsoever, how can we make sure those people are successful? What can they do you kind of touched on that, but can you elaborate a little more?
Sam Tang: So let me start by describing the companies that were very successful in an M&A transaction or divesture transaction. The things that they did well yeah first and then we can talk about what people have to do. And those clients that were very successful in adapting to M&A and divesture, those places that focus on workforce management and strategy, they already have a good handle on what the lifecycle events are for the workforce. That they have already done is simplification of user journeys, simplifying the access request workflows, simplifying the automated provisioning workflows, simplify the lifecycle events and that’s what what happens unifying that logic. Embrace analytics and intelligence to create visibility and awareness, knowing what you’re managing is very important. Um, and
A company that’s very mature in their cloud strategy in the movement of cloud strategy. And they have also implemented a solution that started to satisfy these strategies. Yeah, okay but those four things I just mentioned notice that the last thing I said was those companies that have implemented solutions to satisfy those four. Those four things you don’t really need technologies or IAM technologies to do. That start with us, focus on how to manage your workforce and what the logic is or but detecting and how to manage life cycle for these identities. Simple, simplify the process it takes to actually manage the identities, the movement of the identities. Start analytics intelligence, there’s gotta be some technology that they can use to, to really better understand it. Start cleaning up the environment before the M&A happens, the smaller the simpler the, the environment, the easier the M&A. Move to the cloud. So those are the four things that people can do regardless if they have any identity technology.
Natalie Reina: And thank you for your expertise, it’s really eye-opening how identity can be an enabler during complex transactions such as mergers, acquisitions acquisitions and divestitures. This is Identity Talks, thanks for your time and we’ll be back with more.
Sam Tang: Thanks for having me. Bye bye.
Find out how SailPoint can help your organization.