IAM program scope

The Identity & Access Management (IAM) program addresses multiple key institutional needs and ensures regulatory requirement compliance. The program addresses several factors and principles:

• Complexity of the provisioning/deprovisioning process
• Strict ownership of data
• One person, one identity
• Administrative review and restructuring
• Confirmed assurance levels
• Federation
• Risk reduction
• Compliance with regulations, including:
  • Family Educational Rights and Privacy Act (FERPA)
  • Health Insurance Portability and Accountability Act (HIPAA)
  • Payment Card Industry (PCI)
  • Data Security Standards (DSS)
  • InCommon
  • National Institute of Standards and Technology (NIST)

Deliverables

The IAM program gathers institutional requirements and defines a strategic roadmap that incorporates the following:

• Identity life-cycle management: Manage identity creation, provisioning and deprovisioning, change processes; attribute maps; and authentication (e.g., password policies and synchronization) for risk-based critical applications for end users, generic accounts, and system/service accounts.
• Role mining and role management: Adapt and deliver a framework to manage identity groups by roles, which are typically based on attributes or business rules.
• Authentication:  Verify that a user (or system) is who they claim to be using single sign-on, multifactor authentication, Integrated Windows Authentication (IWA), password management, and identity proofing.
• Federation: Use only trusted connections that allow authorized users, such as nonsystem affiliates, to access university resources, delivering a single sign-on experience for cloud host applications, research collaboration, etc.
• Authorization: Determine whether a user is allowed to access a particular resource using role-based authorization, recertification processes, and exception requests.
• Access auditing and compliance control: Automate compliance processes for user access reviews, including the ability to revoke access.
• Identity business intelligence: Provide real-time and historical reports regarding identity-related data and activities. Provide answers to critical questions about access, improve ability to respond to auditing inquiries, provide information regarding identity regulatory compliance, answer daily IT security operation questions, and provide other information regarding identities associated with the university.