Transform Identity Security | Powered Cyber, SailPoint enabled

KPMG Powered Cyber enabled by SailPoint provides organizations with a baseline of 32 identity governance processes based on leading practices that dictate how to implement an effective identity and access management program. These functional processes include onboarding user access to new hires, as well as managing transfers and termination processes (joiner, mover, leaver). They also serve as the foundation for a zero trust approach to cybersecurity and inform the other five layers of the model.

Once the organization formalizes their identity approach and process taxonomy, the roles and responsibilities that will support, operate and manage the process must be defined.

Who will ensure the solution is implemented properly and that it’s meeting the needs of the organization? People, roles and responsibilities must be outlined within the model and mapped to specific processes, and those processes must also map to the people. KPMG has a set of predefined roles and responsibilities mapped to identity functions and the processes validated in previous layer. These roles can be modified to meet a client’s specific organization needs, and have been proven to establish clear ownership and accountability necessary for a successful transformation program.

The service delivery model is an organizational structure that organizes people, roles and responsibilities into various teams, and defines the structure of how those teams operate together. The people flow into the service delivery model—which in turn defines roles and responsibilities. Identity and access management programs are often complex in that they span across multiple executives and stakeholders. This layer defines how the role and responsibilities are effectively aligned across the organization in order to establish an effective program with clear ownership and accountability.

The technology layer of the model also aligns to the functional processes with a pre-built configuration of SailPoint Identity Security. The KPMG “gold build” configuration for SailPoint Identity Security maps detailed configuration steps to each of the functional processes and use cases to further accelerate deployment and provide rapid value.

Performance insights and data are predefined metrics centered around key performance and risk indicators that measure the success and value of the program. In this particular case, how well is SailPoint meeting its business needs? Are all users who are terminated from the organization deprovisioned within a defined time period outlined in the service level agreement?

Powered Cyber enabled by SailPoint has a set of pre- defined metrics that map to the leading processes. The potential benefit is an effective approach to how an organization reports on the value of the program—how well it’s reducing risk, improving operational efficiency, and how well it’s meeting compliance objectives.

The last layer of the operating model is governance. You have defined processes, a team that manages those processes, technology that supports and enforces it, as well as KPIs and risk indicators that measure the success.

The governance layer is concerned with how well the solution is being governed. How can you tie the operating model together and ensure there is effective communication, the policies and controls are defined and mapped properly, compliance is adhered to, executives are receiving proper reporting, and that key stakeholders are being informed properly? Often an implementation is focused on the technical deployment and misses out on how to properly maintain the solution. The governance layer clearly defines how to maintain existing controls while adapt to changing business needs and compliance requirements.