APRIL 2022ENTERPRISE SECURITY| | 9examples of such roles (not all inclusive).o Program Owner(s). They are often responsible for decision making on behalf of executives and stakeholders. Some of their duties include leadership, budget management, risk management, and communication. The Program Owner should possess solid leadership and communication skills and their role is to remove impediments so the team succeeds.o Product Owner(s). They are responsible for process, people and technology associated with implementation and day-to-day operations of the chosen IAM solutions. They support the Program Owners and often act as their extension.o Account Provisioning. This team handles day-to-day boarding, changes and deboarding of your user access accounts. The team could be centralized or distributed per business process area. For example, often helpdesk is tasked with these functions while a different team may process access needs for customers.o Role Management. It is critical to understand what roles are needed for your users to minimize risk of over provisioning privileges and access.o Privilege Access Compliance. There are users who need more access than others to perform their job (think of technology teams). It is critical that a team runs periodic access verifications to ensure that those with elevated privileges still need that access.o Access Monitoring. Usually a security function, someone should be tasked with identifying and responding to access violations and incidents.· Process Improvement. This is where the magic happens. Make sure you are continuously looking at your process as that is where you will likely identify areas of risk and innovation. Do this by making sure that you build solid partnerships with those stakeholders that you have identified and that they are listened to.· Organizational Change Management (OCM). You are about to disrupt your users by changing the way they logon to systems (for example by introducing Multifactor Factor Authentication or MFA) in addition to the stakeholders and process identified so far. For example, a few years ago, MFA was the main causes for disruption in this area, but this technology is now mainstream at banks and online shopping among others. However, other technologies such as those that "remove" privileges from your people are often frowned upon and seen as disruptive. Furthermore, processes will change because of this program, which will make people uncomfortable. Partnering with an OCM team will be beneficial to your program because they will help you identify the "What's In It For Me" areas of attention that you will need to communicate often to different stakeholders. OCM will also help you determine what measurements you put in place to monitor and report program progress and status.Your IAM program will introduce significant change to your enterprise. Focus on process and people in addition to technology to deliver solutions that can be applied at all levels of the organization. Finally, make sure that you communicate often and clearly in order to gain and maintain support from key stakeholder to ensure the success of the program. ESMake decisions early on how you will structure the program; who will lead; who delivers; and who will operate the resulting set of solutions and processes
< Page 8 | Page 10 >