Avoiding projects in peril – steps to success with identity security

Many organisations understand that identity security is a crucial foundation for cybersecurity, digital transformation, and user experience; not least in Government and the public sector. However, the scale and complexity of some departments and entities can lead to increased risk of projects stalling, or even failing, while non-action is not an option.

How can success be achieved?

Partnership

Key to the success of any Identity project is selecting both an optimum platform and having the ability to expertly deploy into your estate. The Identity project may be part of a larger programme around cybersecurity or digital transformation, and so integration with wider workstreams should be considered.

In addition, use of innovative technology can accelerate processes which were previously labour-intensive, such as manual creation of roles or performing access reviews. Will the selected platform provide these abilities?

Lastly, partnering with a vendor and/or consultant with a track record of proven success will smoothen the overall engagement and transition into an ongoing service.

Planning and Prioritisation

Many identity projects have a large scope with multiple stakeholders. It’s important to define key deliverables and areas of importance from the outset. For example, while a large number of applications or systems may be in use, which are the top five in terms of criticality or risk? These should form part of the starting phase.

Projects where there is no prioritisation often fall victim to inertia or delays, while those where priorities are understood, create a model for success which can be repeated as progress is made.

Executive Sponsorship and Stakeholder Management

Once the scope is agreed, obtaining executive sponsorship to assist with championing the project and driving progress is key to getting buy-in from the organisation/ department, along with securing resource and garnering support. Many projects without a senior sponsor are at risk of de-prioritisation or become starved of staffing and budget.

In addition, understanding and engaging the appropriate stakeholders is crucial. Identity projects typically improve or automate business processes, and so gathering input and challenges from business areas should inform the overall objectives, along with solution choice. Common stakeholder engagement may cover; HR/staffing, application owners, IT, cybersecurity, procurement, and of course the end-users.

Data quality

Prior to commencing the project, review the data which will be used as a source for identity governance – this is typically a HR system. Does it contain consistent data in terms of job titles, departments, or line managers? Are there any other projects planned or in-flight which affect these authoritative systems

Understanding the landscape and quality of source data is key to ensuring smooth operation of an identity project and platform.

User populations

While many Identity projects focus on employees, are there other populations of users which also must be considered? For example, many government departments have a higher concentration of contract resources or third parties. Do these populations also have consistent source data, and can they be managed with the same level of rigour?

Selecting a solution which caters for key user types is crucial to ensure there are no process gaps or audit weaknesses.

In summary; while this article is only intended as high-level guidance, considering these key steps from the outset will greatly improve the chances of your identity project achieving its aims or mission. Initial understanding and planning will avoid the possibility for delays during the project, set realistic business or department-focused outcomes, and show faster returns on investment.

Danny King is manager, solutions engineering UK&I at SailPoint who are a leader in identity security for the cloud enterprise.