When talking with clients considering an IAM assessment, it seems that many know what they want from a technology perspective, and usually have a good idea on the desired outcome. As we dive deeper into the discussions with them, we find that there is a perception of what needs to be done to embark upon a successful IAM journey, although more often than not, there is little consideration for current state and future state process.
While helping guide these meetings, we make it a point to always bring the topic of process re-engineering to the forefront of the conversation and put the technology aspects on the back burner. As we go down this path, it’s gratifying to observe when there is almost immediate recognition of how something barely considered could have so much impact on the overall IAM outcome. This gratification is derived from seeing people learn and appreciate the information shared, in very early stages of discussions.
It usually has the impact of the client reconsidering how togo about the assessment, and almost immediately, the nuances of the iron-boarding, change, and termination processes bubble up to the top of the conversation. Next comes the recognition and acknowledgement of inefficiencies, bottle-necks, and less than optimal practices. Frequently additional gaps insecurity are identified in these early stage discussions, which then increase the urgency to thoroughly document and evaluate the current state.
Eventually, the discussions will circle back to the technology and solutioning. This is when we feel the responsible approach is to point out that pre-solutioning and technology product decisions are premature.Do you really want to acquire technology and then adapt or bend your process to meet a particular products capability? If so, will the process be optimized to meet the business needs, or be contorted to make the technology work?
Below we’ve outlined the 10 key steps we believe will bring the most successful outcome:
- Thoroughly document and evaluate current state process, highlight inefficiencies
- Gather and document all business requirements
- Re-engineer the process, addressing business requirements and existing inefficiencies
- Draft a high-level design (not based on a particular products capabilities)
- Meet with product vendors to see if/how they can address your re-defined process and high-level design
- Reduce the list down to the top 2 or 3 vendors and issue anRFI or RFP
- Stake-holder review and rating of each response, initiate proofs of concept if necessary
- Make final product decisions and evaluate service options
- Negotiate and acquire products
- Plan and Implement
Please note that it’s important to include all stake-holders in these steps to obtain and maintain the necessary support throughout this journey.
In conclusion, if you are still asking yourself how process re-engineering will help your IAM initiative, consider this:
Process re-engineering can help ensure that your IAM implementation is as effective and efficient as possible. It can help identify potential problems in the current process and provide insight into how the process can be improved to improve security, reduce costs, and improve user experience.Additionally, process re-engineering can help you identify areas where automation can be used to improve efficiency and reduce manual labor.Ultimately, process re-engineering can help you create a more secure and efficient IAM implementation.