How to Establish an IAM Steering Committee

About to embark on a journey in the world of identity? Looking to atone for past Identity and Access Management (IAM) or Identity Governance and Administration (IGA) sins? If so, with an IAM roadmap in place, one of the first steps we recommend is to thoroughly consider what are the appropriate IAM roles and responsibilities. In general, there are five components to create a good identity program, which consists of an IAM advisory committee, IAM project team, IAM core team, business stakeholders and IAM operations.

In this post, we focus our attention on the IAM advisory committee, sometimes referred to as an IAM steering committee  or IAM program committee.

At Protiviti, we’ve been helping organizations deliver IAM programs for over 15 years. Throughout that process, we have been fortunate enough to work with hundreds of companies from beginning to end. One of the key insights that we’ve noticed is: IAM programs are rarely successfully delivered without an IAM program committee.

Define scope for committee decision-making

The purpose of an IAM program committee is top-down decision-making and program governance. Often, IAM programs become plagued with indecision and disagreements, especially where business process changes are concerned, since multiple business units may be affected by the decision. When this happens, it’s handy to have a committee in place to settle disputes, allocate resources and make decisions.

But that’s not the only area of the concern for an IAM program committee, which also:

  • Approves updates to the IAM roadmap: Typically, IAM programs are multi-year endeavors and corporate priorities can and do change. The committee should regularly review corporate goals and review if IAM roadmap changes are warranted.
  • Communicates upstream: Bi-directional communication with company executives, typically the CIO (if the CIO is not part of the committee).
  • Reviews metrics: Tracking IAM program metrics is critical to ensure the program is delivering the intended impact on the organization.
  • Provides financial oversight: IAM programs may have a large budget, and it’s important for an oversight committee to ensure projects stay within budget.

Also document out-of-scope items

In addition to documenting in-scope topics, it is important to explicitly document topics that are out of scope. To prevent IAM steering committee overreach, day-to-day tactical decisions should be made at the IAM project team level (see the middle tier of the diagram above). Here are a few examples of topics that should be out of scope:

  • Technical architecture: The steering committee may require, as part of IT best practices, that the enterprise architecture group to approve the IAM design document. While this is acceptable, it’s a tell-tale sign that the IAM steering committee is overstepping is boundaries.
  • Line-item project plan reviews: The steering committee should avoid spending time pouring over each line of a project plan. Their focus should be at the strategic roadmap level (for example, deprovisioning for these 10 applications is expected to go live by end of Q1, etc.) rather than the level of project plan line-items (for example, the connector for AD is set to be completed in DEV by February 12).

Documenting both in-scope and out-of-scope topics is a relatively painless task for IAM steering committees that can provide invaluable guidance that maximizes the committee’s efficiency and limited time. So why not block off a few hours this week to write your IAM steering committee scope document?

To learn more about our digital identity solutions, contact us.

Ashraf Motiwala

Managing Director
Security and Privacy

Jeff Steadman

Associate Director
Security and Privacy

Subscribe to Topics

Protiviti is happy to announce that Wendy Luebbe has joined as a Managing Director for the Technology Consulting Solution. Based in Orlando and with over 20 years of experience, Wendy will focus on the Enterprise Data & Analytics segment, specializing in financial services.

Join Protiviti's Scott Laliberte and Andrew Struthers-Kennedy for thoughts on how organizations should discuss and evaluate risks and include emerging technologies as part of risk and audit reviews. http://ow.ly/oJ0a50Fx7Hx

#ITaudit #ProtivitiTech #emergingtechrisks #prowebinars

Consumer #privacy is key. Protiviti recommends focusing on three buckets and eleven requirements that cover what an organization must consider when developing personal #data privacy protections and have a relationship with #digital #identitymanagement. http://ow.ly/8BuC50FA5Hj

Protiviti’s Scott Laliberte hosted a panel with three Chief Information Security Officers on July 11th. While all faced their own distinct pandemic-related issues, many common themes emerged during the discussion. Learn more: http://ow.ly/Er9e50FA3Q3

#CISO #ProtivitiTech

Reporting and #analytics are critical for #CIOs because they structure #data to guide businesses in strategic decision making. Learn why companies must harness and use information that propels business goals. http://ow.ly/eGoR50FA2ub

#TechTransformation #enterprisetransformation

Load More...