For some time I planned to write a report on the segmentation of the role management market. There are many different offerings for role management which all use the same buzzwords but provide pretty different solutions. But I decided not to write this report - just because there is no role management market. It might appear that such a market segment exists. But in fact it is just a part of a larger market segment, the GRC (Governance, Risk Management, Compliance) market.
The GRC market, on the other hand, appears today as a very fragmented market, with a broad range of solutions and tools. Without telling on everything my upcoming report on the structuring of the GRC market will include, there are at least two levels of distinction between the offerings in the market. The first is around the general level, where you find methodologies, pre-defined solutions (for example rule sets for specific applications and compliance regulations which can't be applied easily to other threats) and tools.
Within the tools, there appear, amongst others, the vendors of role management solutions. I personally define five core functionalities for GRC tools:
- Analysis of entitlements and Reporting
- Attestation - should, by the way, be multi-layered
- Authorization Management, including SoDs (Segregation of Duties) and, in general a policy/rule definition and enforcement for entitlements
- Risk Management, including Risk Modeling and Analytics
- Role Management
Currently there is no vendor who provides the entire big picture on a high level. But it is obvious that many vendors are working on this picture and are delivering more and more parts of the puzzle.
By the way - based on these tools there probably will be a solution market again which provides pre-defined implementations for specific industries or regulations.
This view gives as well an answer to the question whether GRC shall be limited to IAM. No, it is a broader market. IAM delivers to GRC solutions. But GRC is sort of a bracket across the entire IT infrastructure, building a bridge between IT and business. Thus GRC is going well beyond IAM, even while many of today's IAM solutions can (help to) solve GRC threats and even while there won't be a successful enterprise GRC implementation without a strong IAM foundation.