Governance for all data: Get a grip on unstructured data

Over the past decade, many organizations—especially in regulated industries—implemented Access Governance/IGA to satisfy auditors and enforce least privilege. However, standard IGA mainly delivers a coarse-grained, cross-system view and often lacks the depth needed to understand and control complex, system-level entitlements in environments such as Windows file servers, SharePoint, mainframes, and business applications. A central challenge is unstructured data: a significant share of critical corporate information exists as documents, spreadsheets, slide decks, and PDFs distributed across file shares, collaboration platforms, and cloud storage. Data exported from systems like ERP/CRM into files (often routinely and at scale) amplifies exposure, while sensitivity spans intellectual property, pre-release financial information, and PII—where GDPR further increases the need to locate data and support data subject rights.

Specialized administrative tools for file and collaboration systems are typically too technical, siloed, and focused on single environments; they rarely provide the governance workflows, lifecycle controls, and compliance oversight businesses need. Separate “Data Access Governance” tools can help with discovery, classification, ownership, and entitlement management for unstructured data, but deploying them standalone often creates new islands of visibility and control. Business users also resist fragmented experiences for requesting, approving, and reviewing access across disparate systems, reinforcing the need for tight integration rather than segregated toolsets.

Key requirements for governing unstructured data include sensitive data identification and classification, broad repository coverage (on-prem and cloud), effective-access analytics, anomaly detection, change monitoring, recertification, and integrated request/approval workflows. SailPoint’s approach extends IGA with SecurityIQ integrated with IdentityIQ, adding discovery/classification, permission path analysis, owner dashboards, real-time monitoring and policy enforcement, alerting (including ransomware patterns), remediation, and compliance reporting. The recommended path begins with risk assessment and tool gap analysis, then implementation, detailed entitlement/data analysis, owner engagement, and consistent governance across all applications and data.

• Access Governance/IGA solutions have been widely implemented over the past decade, particularly in regulated industries.
• Auditors drove many organizations to implement controls that enforce the least privilege principle.
• Standard IGA often lacks insight into mappings from Active Directory global groups to local groups and related fine-grained Windows permissions.
• A significant portion of critical corporate data resides in unstructured data stores.
• Unstructured data commonly includes text documents, slide decks, spreadsheets, and PDFs stored on file servers and collaboration platforms.
• Regular exports from SAP systems into unstructured file formats are described as the norm rather than the exception.
• PII sensitivity risk has increased significantly in the age of GDPR, including obligations to know where such data resides.
• Data Access Governance tools focus on identifying/classifying data and owners and managing access entitlements for unstructured repositories.
• SailPoint SecurityIQ supports targets including Windows file servers, NAS (such as NetApp), SharePoint/SharePoint Online, Microsoft Exchange, and cloud storage services including OneDrive, Google Drive, and Box.
• SailPoint acquired the SecurityIQ technology from Whitebox Security in 2015 and invested heavily in integration and feature expansion.

• “Access Governance is essential – but it is not sufficient, focusing on a rather coarse-grain cross-system view, not on a detailed view on the specifics of entitlements at the system level.”
• “A very significant portion of critical corporate data resides in what commonly is named ‘unstructured data stores’.”
• “Solutions with administrative focus commonly are too technical and specialized on a single environment, while unstructured data sprawls across a variety of different systems.”
• “Ideally, IGA should be extended to govern access to file storage systems instead of adding another toolset to the environment.”
• “Classification of data and real-time behavior analytics count amongst the features that add real value to Data Access Governance solutions.”
• “SailPoint SecurityIQ is a well-thought-out and advanced solution for governing access to data stored in files”
• “Understand which tools you have; which requirements aren’t yet met; and how to integrate existing and new tools.”