I’m pleased to state that in 2010, most organizations that I’ve interacted with that were undertaking an Identity and Access Management (IAM) initiative clearly understood a simple point: IAM is not just about the technology. The next natural question I get is: who should my stakeholders be? The answer: It depends.
Depending on where you are in the lifecycle of your IAM program, you’ll have different stakeholders. I’ve taken liberty to break down the program into 5 phases.
The Bright Idea
At this phase, you’ve had an epiphany that IAM is important stuff. Perhaps because something is impacting your area of the business, or you are responsible to remediate a recent audit gap that was identified. Either way, it’s you by your lonesome. You are the stakeholder. You’re all that’s needed at this phase. But you need some firepower (i.e. knowledge) to make this dream a reality. Education is key at this phase, so its time for #1 (that’s you) to start down the path of knowledge. Here are some key topics to understand:
- What is IAM? (here’s a 101 series to get you started)
- A handful of compelling uses case of why IAM is important for your company
- Who else is doing it and what have they done? (Talk to the likes of Gartner or Kuppinger Cole, they could help out here)
Selling the Idea
Once you’ve educated yourself, it’s time to find an executive sponsor. Why this early in the game? Because of the golden rule of IAM initiatives: No executive sponsor = No Identity. The inability to recruit an executive sponsor will doom your initiative from the start. So start now! Here are some things to look for in an executive sponsor:
- He/She should own their own budget. If the person does not have their own dollars to allocate, you need to go up the totem pole a notch or two.
- The executive sponsor should have resources at his/her disposal to dedicate to the initiative. Or alternatively, he/she should have the ability to get resources to dedicate to the initiative.
- The sponsor should also have good relationships with HR, Compliance and other constituencies within your organization.
A common problem you might face is that you’ve identified a great executive sponsor, but you can’t approach him/her directly for whatever reason. In this case, there’s an additional sponsor to think about: the middleman (this could be your boss). This person could help champion your cause, refine your business case, etc…but most importantly, this person could pitch the Executive Sponsor for/with you. The key characteristic to look for (besides someone you wouldn’t mind working closely with) is if the middleman has a healthy relationship with the Executive Sponsor.
In the next article, I’ll write about the stakeholders in the next phases of the IAM initiative.