Cybersecurity
Identity governance
Access builds up as people change roles and nobody removes anything. Identity governance gives access a lifecycle: who gets it, who approves it, how often it is reviewed and what happens when someone leaves.
The problem this service solves
Five years into a job, a person may hold access from three previous roles. Contractors keep accounts after the contract ends. Reviewers click "approve all" because they cannot tell what an entitlement does. Enterprise applications such as SAP and Workday have their own role models that rarely connect to the central directory.
We help clean the existing access, design roles that people can understand and build reviews that are worth reviewing.
What is in scope
-
Lifecycle processes
Joiner, mover and leaver workflows, triggers from HR systems and contractor handling.
-
Role design
Business roles, technical roles, role mining and reducing entitlement sprawl.
-
Access reviews
Review design, reviewer guidance, scope and evidence for auditors.
-
Segregation of duties
Rule definition for finance and operational applications, with attention to SAP and Oracle.
-
Application onboarding
Connect applications to the identity platform, or document manual processes.
-
Cleanup
Orphaned accounts, dormant accounts, excess privileges and inherited access.
How the work runs
Understand
Map identities and access.
-
1
Inventory
Collect users, entitlements and sources of truth.
-
2
Process review
Document how access is requested, approved and removed.
Design
Make it manageable.
-
3
Roles and policies
Design a role model and SoD rules, tested against real data.
-
4
Review design
Create reviews that reviewers can understand.
Implement
Run it.
-
5
Pilot applications
Start with the highest-risk applications.
-
6
Expand and hand over
Add applications and train owners.
What you receive
- Access inventory and risk summary
- Role model
- Segregation of duties rule set
- Lifecycle workflow designs
- Access review procedures and guidance
- Cleanup plan
- Audit evidence templates
Tooling and technique
We work with these platforms. We are not a reseller.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- HR system data and identity source details
- List of key applications and owners
- Audit findings, if any
What this service is not
- Compliance attestation
- A pure tool configuration with no process work
What changes afterwards
- Leavers lose access promptly
- Reviewers know what they approve
- Excess privileges shrink
Questions people ask
Can you help with SAP role cleanup?
Yes. We have SAP security and GRC experience through our enterprise applications practice, and can combine it with identity governance design.
What causes poor access reviews?
Too many items per reviewer, unclear entitlement names and no consequence for approving everything. Better design fixes the first two.
Related
-
Privileged access management
Design and implement controls for administrator, service and cloud privileged accounts: vaulting, just-in-time access and session control.
-
SAP
S/4HANA implementation and migration, Finance and Supply Chain modules, Fiori, BTP and integration, plus the architects, functional consultants, developers and Basis engineers who do the work.
-
SOC 2 readiness
Prepare for a SOC 2 examination: scope, control design, evidence collection, gap remediation and a mock walkthrough.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response