How To

How to Make a Business Case for Identity Management

Sure, a good identity management program is great for security and oftentimes necessary for regulatory compliance--but there are productivity and efficiency benefits as well. Kate Walsh IDs five tips for finding and articulating the business case for IDM.

By Katherine Walsh

Human resources should also be involved, since it owns key identity processes and holds important information on employees, says McClain. Similarly, it's important to involve lines of business that own the data and applications that an IDM solution would protect, as well as audit and compliance personnel.

5. Avoid Scare Tactics or Pigeonholing

That's not to say you can't take these methods too far. There are wrong ways to approach the business as well. One of them is the use of fear mongering and scare tactics to prod the business into getting something done, says Gervais. "That's almost like crying wolf. You run out of credibility quickly because you haven't built a business case. You've built an emergency," he says. That isn't to say you shouldn't articulate and communicate risk, but when you fall back on it consistently, you've created a grudging way for the business to accept your solution.

Says Palma, "[IDM] is a big investment, and driving it internally as a compliance initiative might be a tough sell in many organizations as a result of compliance fatigue."

The other no-no is focusing on IDM as a solution to only one problem. If you do that, Gervais says, you artificially limit its business value and pigeonhole the plan. "Because budgets are limited, you have to make a business case for something that is highly leverageable. You need to be agile enough to take business input, iterate over it and continually evolve your program to meet those needs," he says. That means constantly tying the benefits of IDM back to operational efficiency, reduction of redundant infrastructure, consolidation of policies, improved authentication infrastructure, and other benefits of IDM.

Katherine Walsh is a staff writer for CSO. She can be reached at kwalsh@cxo.com.

Other stories by Katherine Walsh

• Email
• Print
• Comments
• Digg This
• SlashDot

• The ABCs of Identity Management
• Identity Management: Implementation Dos and Dont's
• Identity Management: Critical Components
• The Truth About Federated Identity Management
• HSPD-12: United States of Access Control