The infrastructure and services used to deliver governance, risk and compliance management (GRCM) are much like electricity or plumbing: you only really notice their absence when they don't work. In a further plumbing analogy, if the 'pipes and pumps' of identity and access management (IAM) stop working entirely or substantially, key inputs and integration points to GRCM fail, and things can get really exciting.
Business leaders are not plumbers, nor should we expect them to be. IT departments should provide not only good plumbing, but the practices to keep it good and to avoid excitement. To do this, they need to better understand the relationship between GRCM and IAM.
IAM complements GRCM by providing an infrastructure and systems to keep business processes and behaviours within specific risk-tolerance ranges. Specific elements of IAM workflow - user provisioning, role life-cycle management, auditing and analytics - contribute to those processes and behaviours. Indeed, a significant part of IAM intelligence is involved in direct support of IT governance, risk or compliance management.
The maturing of IAM has not been fast or easy but, as managers address IAM in a top-down manner as part of governance efforts, this is changing. Businesses can exploit IAM's role in GRCM by recognising the key deliverables from IAM and the work required to produce them. These can be summarised as the 'seven Ps':
Principles: The core vision and mission of the business
Policies: These formalise the key rules, guidelines and directions that the business must take to realise that mission
Practices: These codify the behaviours of the business in delivering policy
Processes: Policies and behaviours as a formal set of actions across the whole of the business, including IT
People: The optimum organisational structure for them
Products: Only after the areas above have been addressed can technologies be chosen to aid their delivery and support
Production: The business can then move into an operational phase that has lifecycle input to each of them
Some parts of Atacama have not received rainfall for 500 years - but a sudden deluge of water upset the Desert's delicate biological balance
Spitzer Space Telescope could not spot Oumuamua, suggesting that it is actually pretty small
Greenland crater one of the 25 largest impact craters on Earth
This long-sought progenitor star was identified in an image captured by Hubble in 2007