I. Introduction

Managing User Accounts and Digital Identities across company applications and accounts can be tedious and time-consuming — especially given the pressures around meeting compliance requirements and minimizing risk and exposure to the company. Identity Governance and Administration (IGA) programs — as the name states — provide visibility and control over these “administrative” activities.

Most companies today face increasing demands to support and protect systems that contain data critical to your business and users that can access that data. As a result, IT and InfoSec teams spend more and more time and resources on manual, repetitive tasks for managing user accounts and associated privileges while being squeezed by the business to do more with less. By considering the following five (5) ways in which an IGA program can save money, time, and resources, we can help build a business case for investing in such an initiative:

a. Redirect op-ex spend

The efficiencies gained from implementing an IGA solution and related workflows enable an organization to reallocate IT funds (and resources) to other high-priority needs like digital enablement initiatives or sunsetting legacy software. Time-consuming processes such as password reset, recertification campaigns, and user-authorization tasks can be offloaded from the IT staff via standard operating procedures and customer self-service. Additionally, consistent — and easy-to-use — dashboards speed up decision-making, thus saving time and money.

b. Get up and running quickly.

Everyone in the company belongs to a job family with a specific role. Based on the role and corresponding responsibilities, an effective IGA implementation can accelerate internal services and optimize productivity throughout a user’s tenure in their role. For example, roles with predefined access to resources they need to do their job — based on the least-privileged model — can put a new user to work on their first day and reduce risk by knowing who has access to which resources and why. Further, as a user’s needs change, an IGA solution can provide flexibility by providing the ability to request new or different access permissions. It can also offer session-control policies, which start and terminate user access and enable users to perform ad-hoc tasks outside the routine duties. IGA also facilitates self-service password resets, saving back-and-forth time between a user and their help-desk teams.

c. Automate and limit inaccuracies.

To fully leverage IGA benefits, organizations can automate routine and mundane tasks and accelerate access-approval processes. The larger and more complex your organization, the bigger the savings and increase in efficiency. A modern IGA solution will include templated, automated workflows that can accurately reflect your actual business processes. Task automation can also eliminate manual processes that are more prone to human-input errors, making your environment more secure and efficient. Additionally, when someone leaves the company, automated processes can shut down access and keep your user data tidy and your environment safe but adaptable.

d. Avoid compliance fines.

Verifying the proper controls and access for constantly changing requirements, such as PCI, SOX, GDPR, HIPAA, and others, takes a significant investment in time and money. Modern IAM solutions will provide out-of-the-box capabilities to manage and report on the operating effectiveness of identity and access controls associated with each specific regulatory requirement. Further, the ability to implement and execute consistent policies and practices for a repeatable certification process will help streamline the veracity and timeliness of evidence collection to satisfy an external audit. The penalties and fines for not maintaining compliance are high. However, they are not nearly as high as the irreversible cost to your organization’s reputation if a public breach occurs.

e. Identify and prevent insider threats

It’s a scary and unfortunate reality that insider security threats have exploded in the last few years. Insider threats include negligent and malicious insiders who intentionally or unintentionally expose, steal, or leverage vital information and data. Unfortunately, increased security standards have yet to keep pace with the rising risks. Like compliance fines, the cost of an insider threat resulting in an incident could be disastrous for a company’s reputation. However, an effective and operational IGA program can identify excessive permissions and unintentional data exposure to an insider and provide both insights and workflow to limit that access in a timely manner.

II. Conclusion

When showing the value of identity governance to your business, you must demonstrate how your investment will impact three critical aspects — cost, compliance, and risk reduction. To summarize, the business benefits tie back to the following business benefits:

• Increased efficiencies while reducing IT spend
• Enhanced compliance, review, and certification processes
• Improving security via risk mitigation

Incorporating these three elements in a business case requires research and detailed analysis. Work to identify (and quantify where possible) the financial impact, risk reduction scenarios, and expected efficiencies gained from an investment in an IGA program. By speaking the language of the business (cost-benefit analysis, expected ROI, break-even analysis, etc.), your chances of gaining alignment and stakeholder support for an IGA program will increase significantly.

‍