Solutions for regulated industries

They need the same rules as employees: a named owner, a lifecycle and regular recertification. AI agents add one more factor, because they decide at runtime which tools to call. Our white paper on agent identity describes what a control model for this looks like. It is free and there is no form to fill in.

We advise against a big bang. If all applications and processes switch over at once, business units, operations and internal audit are overloaded at the same time, and a single error hits the whole organization immediately. We roll out in stages: first the applications with the highest risk, then the rest in fixed waves with testing and sign-off. Each wave delivers an auditable interim result, and operations stay stable.

As a vendor-neutral consultancy, we do not recommend any tool across the board. What matters is what it has to do in your environment: record and analyze privileged sessions, detect unusual behavior, cover cloud consoles and keys, and forward alerts to your SIEM. Based on these requirements, we compare the candidate tools together with you. Our hands-on experience includes CyberArk, see our case study on the PAM transformation.

User recertification and role recertification, which checks whether every role is built the way the authorization concept requires. We also cover role models based on RBAC and ABAC, rule-based assignment of entitlements through RuBAC and birthright roles, policy checks that prevent toxic role combinations (SoD processes), conversion from internal to external and from external to internal, privileged access with just-in-time approval, emergency access (break-glass processes) and connecting new applications to the IGA platform. For non-human identities, ownership and the succession chain are part of it too.

With evidence that comes from the IAM system itself: who requested, approved and confirmed which entitlement and when, and when it was revoked. Commission Delegated Regulation (EU) 2024/1774 under DORA requires, in Articles 20 and 21, governed identity and access management with clear accountability. We map every control to the relevant provision so the auditor finds the evidence directly.

Admin rights exist only for a limited time. Administrators use a standard account for their daily work and receive privileged rights through just-in-time access only for a specific task, only for as long as it takes, after approval and with logging. The rights then expire automatically. In normal operations there are no standing admin rights that an attacker could take over.

There is no general answer. The established systems all cover the core functions, whether SailPoint IdentityIQ, One Identity Manager or Omada Identity Suite: lifecycle, roles, recertification and segregation of duties. That is why the target operating model comes before the selection. It defines who runs the platform, who maintains roles and integrations, and which resources your organization actually has available for this. Only then can the remaining criteria be weighted sensibly, for example on-premises operation or SaaS, connectors for your applications, the complexity of the role model and the total cost over the full lifetime. We carry out this assessment with you before any license is bought.