Understand the need
Map users, roles, applications, access owners and approval paths.
Control who can access your systems.
Make access responsibilities and approvals clear throughout joining, changing roles and leaving the organization.
Identity & access managementWHEN THIS IS USEFUL
The situation
You need a clear view of the current position, accountable ownership and an agreed next step in this area.
The intended change
A scoped plan, reviewable evidence and practical actions proportionate to the business need.
What the service covers.
Define the work
Review access requirements, privileged roles and joiner, mover and leaver processes.
Review and improve
Define improvements, evidence and an access-review and operating approach.
What an agreed engagement can produce.
| Deliverable | What it makes clear |
|---|---|
| Access and ownership map | Roles, applications, accountable owners and approval points. |
| Lifecycle improvement plan | Provisioning, role changes, revocation and review requirements. |
| Operating and acceptance guide | Evidence, exceptions, escalation and review responsibilities. |
Select and tailor the deliverables to the agreed scope, access, responsibilities and acceptance criteria.
What acceptance should establish
- The scope, authorization and accountable roles are explicit.
- Findings and completion decisions are supported by the agreed evidence.
- Limitations, unresolved actions and operating responsibilities are recorded.
Make the work concrete.
A situation to examine
A departing employee has accounts across several applications. Map which owner authorizes removal, who performs it and what evidence confirms completion.
What to measure
Track the agreed findings, unresolved actions, review evidence and demonstrated readiness against the scoped baseline.
Methods that support the work.
The service scope determines which methods, artifacts and review points are needed.
Questions about this service.
What is included in this area?
Make access responsibilities and approvals clear throughout joining, changing roles and leaving the organization.
How is delivery scoped?
Implementation depends on approved access, the selected systems and a separately agreed change scope.
Define the next useful decision.
What business concern should this work address, and what evidence would justify the next decision?