How do you evaluate and select IAM tools and vendors?

Defina claramente seu objetivo e como aquela ferramenta poderá contribuir para o objetivo estratégico do negócio. Tenha de forma clara quais requisitos para o problema mapeado e para solu??o almejada. Após isso, fa?a uma análise buscando a solu??o ideal de acordo ao or?amento disponível. A utiliza??o de um caderno de requisitos é um passo importante para análise.

One important aspect that many organizations miss in the process of evaluating what IAM solution to adopt is the simple question of, are you ready to adopt an IAM solution? Do you have the Processes and People needed and defined to have a successful IAM tool implementation?

Evaluating + selecting IAM tools & vendors involves a systematic approach to ensure they align with your organization's needs. Start by defining your requirements—consider factors like scalability, integration capabilities, compliance, and support for diverse environments (cloud, on-premises, hybrid). Assess the tool's features, such as MFA, SSO, provisioning & analytics. Next, evaluate vendors based on their reputation, customer support, and experience in your industry. Look for flexibility in their offerings + pricing models. Conduct PoC trials to test the tool's performance in your environment and engage stakeholders for feedback. Before final choice, consider the vendor's roadmap to ensure they're evolving with emerging IAM trends.

Within your use cases, clearly define the usage pattern and the interfaces of vendors' access to your environment. This will enable clear strategies and methodologies to protect and monitor vendor access to your environment.

First eatablish your actual requirements. You do that like this: - Define and ratify corporate Identity Policies. - Decide what is your number one priority by boiling your requirements down to a single sentence. - Now look for a product that delivers to YOUR priotities. Or Products. Your IGA project consists of many different disciplines, and some of them is most likely achieveable with something you already has. It is not as bad as every vendor sales person try to tell you, that your entire IGA infrastructure is covered by several products. Especially when choosing the best of breed for specific disciplines.

As you explore IAM solutions, remember to ensure they align with your industry's compliance requirements. Consulting with analyst organizations like Gartner can help avoid any hidden vendor biases. Additionally, don't forget to choose a solution that can address emerging threats, including those posed by non-human identities, to keep your security up to date.

You've got to speak to vendors each can provide different perspectives some of which may be better suited to your requirements. Run a short RFI with a wider set of vendors outlining your specific needs. Under NDA provide as much context as possible of your challengses, you will unearth capability that can allow you to create a fuller RFP.

- In researching the market for an IAM tool, its important to consider which tools are widely used in the local geographic area and also which tools provide extensive support for compliance standards that apply to a particular industry. - It is also important to not be biased towards a particular analyst/research organization to avoid any vendor influences that these organizations may have.

Understand your business requirements and categorize capabilities into foundation (core) and advanced level. Create mapping between these two dimension.

Trialing IAM solutions before committing is crucial for assessing their fit. During a trial, companies explore features, customization, user experience, security, and scalability, especially in this space where the human element plays a key role [of the access process]. For instance, we at Apono provide a free version to try the capabilities of Just-In-Time Permissions Management to allow users to see. Some vendors choose a method of Free Trial and some of Free version, but seems that companies understand the importance of giving users a taste of what to expect after they have purchased in terms of product experience at least.

Try and get at least one typical/unique use case as a Proof of Concept. There could be times when the solution might be very good but does not fit your unique case and you might need to look at another vendor.

In addition to everyone else's excellent contributions here, I would add: run a sort of "pentest". Try to spoof or circumvent the authentication methods offered by each IAM provider. For example: - One-time passcodes: assume you have access to a user's text messages or email (easy enough for hackers to accomplish). What access can you gain? - Device-based passkeys: can you deliberately "fail out" of the device's biometrics (FaceID, fingerprint) and then input the device PIN to "authenticate" the passkey? - Biometrics: can you spoof the system with a printed-out photo? Can you get through by holding up a photo on your phone? Can you use a common generative AI provider like Dall-E to create deepfake selfies and get through with those?

Requesting a proof-of-concept (POC) instance is crucial for gaining hands-on experience with the tool. Additionally, organizing a demo specifically for key business stakeholders and the BAU team helps in assessing user interface, usability, and collecting valuable feedback. It is also essential to request a POC for integration with authoritative systems and data transformations to evaluate the performance of user import and provisioning processes.

While vendor delivered demos are very useful and informative, its important for internal teams that will work with the tool to work with a free trial of the tool. Their feedback is very important and personally I feel its beneficial to invest time on a short proof of concept in this phase.

Make sure your finance team is there from the start and any claimed benefit is signed off by the appropriate stakeholder. Be very careful with claimed benefits for other teams especially where this relates to resource efficiency. Have a view of the total cost of change, have a plan to get benefit early with a set of small incremental changes.

It’s important to do a business value analysis when you start to consider a new IAM tool. This will include the monetary returns on investment but also some qualitative aspects which may not have a $ value attached to it. Often those are also critical. For example, having one single identity for users in the company and identity protection should also be given consideration here.

Total Cost of Ownership (TCO) is more relevant than just product pricing because it includes all costs over the product’s lifetime, not just the initial purchase price. TCO covers hidden costs like maintenance, support, upgrades, training, and licensing fees. This long-term perspective helps you budget accurately and avoid unexpected expenses. By considering TCO, you can better assess the value of the IAM solution, comparing its benefits like return on investment and risk reduction against its true costs. This ensures you choose the most cost-effective and beneficial option, making smarter financial decisions.

Getting numbers correct is vital you may be spanning CIAM and EIAM also you may have numerous personas. Do you have a growth model, understand how the contract supports growth. Be open and describe each persona and third parties that may be supported by the product. Realisation late in the day that a particular third party or affiliate can't benefit from the negotiation can be a costly mistake. Get your crystal ball out understand your realistic future end state, and refine it.

Here are several risks to watch out for: 1. Hidden Costs: The contract might not clearly outline all fees, leading to unexpected expenses later. 2. Unclear Scope: If the scope of work isn’t well-defined, the vendor might not deliver everything you need. 3. Missed Deadlines: Without clear timelines, the project could take longer than expected, delaying your benefits. 4. Weak SLAs: Vague service level agreements can result in poor performance without recourse. 5. Dispute Problems: Without clear dispute resolution terms, resolving issues could become difficult and costly. 6. Limited Flexibility: A rigid contract might not allow for necessary adjustments as your needs change.

You will not have a water tight contract but still negotiate well. There are variables almost all the time in IAM projects and you would want to bake them in in the contract - - Custom workflows - Custom code for specific components - Extra connectivity requirements - Delay in timelines

When working on Contract terms - Please include the following 1) Clear SOW 2) Intellectual property rights of anything developed during the project implementation 3)Clear exit strategy for contract termination if things does not work as expected and what to be done during that time 4) Dispute resolution 5) Training and documentation 6) Technical Support and maintenance for upgrade etc 7) License - if it user based or account based, module based , additional costs for support, upgrade , patching etc 8 ) Always Negotiate for DEV, UAT and PROD instance as most of the vendor only provide DEV and PROD.