Identity and Access Management

IAM describes a complete set of services and capabilities that establish the digital identity of machines and humans, and their lifecycles within enterprises. This cyber security competency provides a governance framework for digital identities and allows organisations to make intelligent, risk-based decisions about who is allowed to access which information assets, when and in what context. As the digital transformation of business models has gathered pace, identity and access management has evolved into two focused offerings:

Enterprise (IAM): Enterprise IAM covers the identity and access management for the modern workforce and is focused on compliance, risk, governance, security, privacy, workforce lifecycle management, and operational efficiency. For enterprises, the proliferation of cloud, social and mobile services have rendered the traditional firewall increasingly obsolete. Collaborative business relationships have also caused organisations to manage an increasing scope with respect to identities for contingent labor and key business partners. Workforce identity has become key to enforcing access controls and enabling secure collaboration. Robotic process automation has added another dimension to workforce identity where robots execute a task on behalf of humans. As a result, IAM has become a major priority for the modern enterprise. Once viewed as an operational back-office issue, IAM is now gaining board-level visibility as a result of numerous high-level breaches that have occurred due to the failure of organisations to manage and control user access effectively. The importance of IAM has been further elevated by an evolving regulatory landscape and trends such as Bring Your Own Device (BYOD) and cloud adoption, which are forcing organisations to re-evaluate how workforce identities are managed.

Customer identity and access management (CIAM): CIAM covers identity and access management functions for customers and the supporting ecosystem such as partners. This branch of IAM is focused on business opportunity, growth, and identifying customer preferences to respond with relevant, timely, highly personalised experiences. Digital consumer identity is evolving into a business enabler - user-friendly, personalised and accessible. Businesses are becoming increasingly customer-centric, and digital identity is becoming a critical customer-experience differentiator. Organisations are elevating their external facing digital identity management approach beyond security compliance to transform the way they deliver value to customers and business partners, with enhanced speed, agility, and competitiveness.

It is common for companies to deploy different systems to manage CIAM and enterprise IAM, due to their diverse functions and requirements. IAM provides many end-user and business benefits, such as enhanced digital identity insights for actionable security and experience, reduced operational costs resulting from streamlined provisioning of access, reduced or single sign-on capabilities, and simple, usable authentication mechanisms, thus decreasing engagement threshold.

Common service elements

Across both competencies, enterprise and consumer, KPMG member firms can provide services focused on the following:

• Assessment
• Strategy and roadmap
• Architecture
• Software selection
• Governance and operating model development
• Solution implementation
• High-value managed services

KPMG member firms have extensive delivery experience and success working in digital identity and have invested in governance models, delivery accelerators, technology platforms and the ability to meet the needs of stakeholder groups in both areas. KPMG member firm professionals deliver timely insights and perspectives aimed at optimizing these critical dimensions of identity for success in the digital age.