In many organisations, it is not possible to determine with complete certainty who is accessing which business applications, cloud services or corporate systems, since when, and with what authorisation. Orphaned accounts, excessive permissions and applications operated in silos increase the risk to security and compliance. This problem is exacerbated in the cloud, as access occurs more rapidly and is more widely distributed than existing controls can track. Our white paper ‘Three Steps to Application Access Governance Maturity’, written in collaboration with Saviynt, a provider of cloud-native identity and access management (IAM) solutions, outlines a three-stage maturity model for this: Get Clean, Stay Clean, Optimise.
Get Clean: What are the current access rights?
It all starts with a reliable foundation. To achieve this, organisations consolidate the access data for all key applications and create a unified view of identities, roles and permissions. This reveals excessive permissions and critical combinations of rights – for example, where an individual is able to both create and approve invoices. These conflicts relating to the separation of duties are resolved, and clear responsibilities for roles and permissions are defined.
Ready to talk?
Download the report now (in German only)
Stay Clean: What keeps order in place?
Once a database has been cleaned up, it changes with every new hire, transfer and departure (Joiner-Mover-Leaver). To ensure it remains stable, permissions are automatically granted, adjusted and revoked as soon as a role or employment status changes. Ongoing checks and approval workflows prevent critical combinations of permissions in advance, whilst regular recertification ensures the system remains up to date. This makes access control an integral part of day-to-day operations rather than a downstream task.
Optimise: How can the control system be continuously improved?
With a stable foundation, access management can be controlled on the basis of data. Access requests and role changes are checked for potential conflicts even before approval, using continuous access analytics and role engineering; roles are aligned with actual tasks (least privilege); and the maturity level is made measurable through key performance indicators. On this basis, permissions can be continuously improved and costs kept under control.
The white paper describes the three-stage framework step by step and shows how the ‘Get Clean, Stay Clean, Optimise’ approach can be applied within your own organisation. It explains the tasks for each stage, defines roles and responsibilities, and identifies the key performance indicators used to measure the maturity level.
Interested in our services?
More KPMG Insights
Your contact
Dr. Florian Kohlar
Partner, Consulting - Cyber Security & Resilience
KPMG AG Wirtschaftsprüfungsgesellschaft