The objectives of access governance

The objectives of identity and access governance are to manage risk and ensure compliance in consistent, efficient and effective manner. These objectives are:

• Availability—Business data and applications are available when and where they are needed.
• Integrity—Data can only be manipulated in ways that are authorized.
• Confidentiality—Data can be accessed only by authorized individuals and cannot be passed to other individuals who are not authorized.
• Privacy—Privacy laws and regulations must be observed.
• Accountability—It should be possible to hold people, organizations and systems accountable for the actions that they perform.
• Transparency—Systems and activities can be audited.

Access governance process

Access governance is not just about implementing access governance tools instead of provisioning tools; it is about implementing governance processes. The governance process is composed of three major phases. The initial phase is to understand the business needs and obtain approval for a plan of action. A key objective of this initial phase is to get executive sponsorship, which is critical to the success of any identity and access project. The second phase is to define the organizational needs and to produce a set of metrics and controls. The third phase is to monitor the controls and manage divergence. Governance requires well-described processes, guidelines and books of rules.