Access Governance is about the governance and management of access controls in IT systems and thus about mitigating access-related risks. These risks include the theft of information, fraud through changing information, and the abuse of IT systems for example in banking for illegal actions, to name just a few. The large number of prominent incidents within the last few years proves the need to address these issues – in any industry. There is an increasing number of tools for Access Governance. However, the implementation has to be well-thought, given that there are many different architectural approaches for Access Governance.
It is no surprise that the vendors of Access Governance tools tend to position their tools as the core element of at least the IT GRC infrastructure. From the KuppingerCole perspective, the role shouldn’t be overhyped. Access governance is important with respect to the high relevance of access risks. However, Access Governance might be accomplished using provisioning tools. And, beyond that, Access Governance is just one element within a larger GRC architecture.
Thus, successful implementations require a holistic view on GRC to ensure that all types of IT controls are covered and well aligned to the business controls. It requires as well a well-thought architecture with respect to existing or planned identity provisioning tools, which aren’t substituted by access governance tools. The report discusses the different architectural options, their strengths and their weaknesses.
