WEBVTT 00:00:00.000 --> 00:00:20.600 Welcome to the KuppingerCole Analyst Chat. I'm your host. My name is Matthias Reinwarth. 00:00:20.600 --> 00:00:26.500 I'm an analyst and advisor with KuppingerCole Analysts. And so is Patrick. Patrick is my 00:00:26.500 --> 00:00:28.442 guest today and he is a lead advisor with 00:00:28.442 --> 00:00:31.000 KuppingerCole Analysts. Hi, Patrick. Good to have you. 00:00:32.200 --> 00:00:33.600 Hi, Matthias. Great to be back. 00:00:35.000 --> 00:00:37.742 Great to have you. And we had a very successful 00:00:37.742 --> 00:00:40.600 episode just a few weeks ago when we talked about 00:00:40.600 --> 00:00:46.200 not everything is IAM, which rang a bell for some of the IAM owners that we're talking to. 00:00:46.200 --> 00:00:48.828 And we want to continue that discussion in some 00:00:48.828 --> 00:00:51.400 shape or form because this actually leads to a 00:00:51.400 --> 00:00:54.400 topic that you have been covering at our Identity 00:00:54.400 --> 00:00:57.400 Fabric Impact Day in Munich just a few weeks ago, 00:00:58.000 --> 00:01:00.511 and which much more importantly is a topic 00:01:00.511 --> 00:01:03.500 which strikes us more and more when we talk to our 00:01:04.600 --> 00:01:08.169 customers, to our peers in the industry. And 00:01:08.169 --> 00:01:11.900 this is the topic of a target operating model, 00:01:11.900 --> 00:01:14.943 which sounds very abstract and very business 00:01:14.943 --> 00:01:18.400 style, but it's really important. So first of all, 00:01:18.400 --> 00:01:22.311 a few sentences. What is a target operating model? 00:01:22.311 --> 00:01:26.300 I would say, yeah, or to keep it in a short summary 00:01:26.300 --> 00:01:29.387 what it is, it is actually a tool which helps you 00:01:29.387 --> 00:01:32.600 to distribute responsibilities in the organization, 00:01:32.600 --> 00:01:34.783 no matter if it's IAM. But IAM is very 00:01:34.783 --> 00:01:38.000 important to do that. It can be applied or is applied in 00:01:38.000 --> 00:01:41.959 various areas. But here it becomes crucial as we 00:01:41.959 --> 00:01:46.000 have so many people, so many organizational units 00:01:46.000 --> 00:01:49.586 involved when talking about IAM, when executing 00:01:49.586 --> 00:01:53.400 IAM. And therefore, yeah, it's a necessary tool to 00:01:53.400 --> 00:02:00.000 actually distribute responsibilities. Yeah, fascinating. And I think that is something 00:02:00.000 --> 00:02:02.191 that many organizations actually are 00:02:02.191 --> 00:02:05.600 struggling with because IAM typically is a technical and 00:02:05.600 --> 00:02:12.500 IT discipline or traditionally at least. So sometimes it's just a kind of learning process 00:02:12.500 --> 00:02:15.782 to say, OK, I think I did that. And the question 00:02:15.782 --> 00:02:19.200 is, why do I need a proper target operating model, 00:02:19.200 --> 00:02:22.427 especially in IAM or to put it the other way 00:02:22.427 --> 00:02:25.800 around? Why does IAM often fail when you don't 00:02:25.800 --> 00:02:29.240 have a clear target operating model? Yeah, from 00:02:29.240 --> 00:02:32.900 my perspective, it is sometimes like either people 00:02:32.900 --> 00:02:36.800 doing things redundantly, for example, designing 00:02:36.800 --> 00:02:40.700 the processes for or designing the same process, 00:02:40.700 --> 00:02:44.900 for example, to join a process because they are not aware someone else is doing it in the 00:02:44.900 --> 00:02:47.312 organization and they have their own 00:02:47.312 --> 00:02:51.600 implementation variation of it. Yeah, because maybe there's also 00:02:51.600 --> 00:02:54.631 no template existing because nobody took care 00:02:54.631 --> 00:02:58.200 about it, for example. Yeah. Or even worse, a process 00:02:58.200 --> 00:03:00.984 is completely neglected or forgotten because the 00:03:00.984 --> 00:03:04.000 organization unit thinks, oh, the other one does it, 00:03:04.000 --> 00:03:07.000 but actually no one does it. So these are the 00:03:07.000 --> 00:03:10.000 two scenarios that can happen. And therefore, 00:03:10.000 --> 00:03:13.000 a target operating model helps you to actually 00:03:13.000 --> 00:03:16.000 shape the responsibility around the things you 00:03:16.000 --> 00:03:18.756 need to do or you want to do. Right. I fully 00:03:18.756 --> 00:03:21.700 agree. And from a notion perspective, it really 00:03:21.700 --> 00:03:25.958 shifts IAM a bit from technical to strategic. 00:03:25.958 --> 00:03:30.500 So you need to take a step back and talk to more 00:03:30.500 --> 00:03:34.289 people to distribute these responsibilities. So 00:03:34.289 --> 00:03:38.400 you talked about that at IFID. And the question is, 00:03:38.400 --> 00:03:41.792 how do you achieve this shift? How do you shift 00:03:41.792 --> 00:03:45.400 an IAM from just being merely a technology task to 00:03:45.400 --> 00:03:48.849 a strategic operational business enablement 00:03:48.849 --> 00:03:53.100 task? Now, that's a very good question. The thing is, 00:03:53.100 --> 00:03:57.600 when we were developing the new or the next generation of the target operating model 00:03:57.600 --> 00:04:00.833 for IAM, we are just collecting the tasks in the 00:04:00.833 --> 00:04:04.200 beginning. And then we started with our experience 00:04:04.200 --> 00:04:09.800 and also with some analysis methodologies to cluster the tasks. And we saw it's not only 00:04:09.800 --> 00:04:12.293 technology when we are talking about IAM. No 00:04:12.293 --> 00:04:14.900 surprise, hopefully. It's also like a business 00:04:14.900 --> 00:04:18.085 perspective coming more and more into the play as 00:04:18.085 --> 00:04:21.400 you want to achieve like business-driven processes, 00:04:21.400 --> 00:04:24.498 IAM business-driven processes and integration, 00:04:24.498 --> 00:04:28.000 for example, with IT security and so on. And we also 00:04:28.000 --> 00:04:30.333 saw, and that should be considered when we 00:04:30.333 --> 00:04:33.000 are talking about IAM, we also need a management 00:04:33.000 --> 00:04:38.400 perspective who is, for example, in an organization collecting the budget, who is 00:04:39.000 --> 00:04:41.884 drawing the architecture, is responsible for 00:04:41.884 --> 00:04:44.900 designing the architectures. We really shifted 00:04:44.900 --> 00:04:48.350 away from the pure technical task of customizing, 00:04:48.350 --> 00:04:51.800 of developing something and had a look at it as a 00:04:52.300 --> 00:04:56.443 full-blown picture of IAM and therefore designed 00:04:56.443 --> 00:05:00.500 the tasks and clustered them across these three 00:05:00.500 --> 00:05:03.859 categories, management tasks, business tasks 00:05:03.859 --> 00:05:07.600 and technology tasks. And they can also be mapped 00:05:07.600 --> 00:05:13.900 more or less to the skill sets you usually have in your organization and can distribute it 00:05:13.900 --> 00:05:16.850 accordingly, knowing that, of course, technology, 00:05:16.850 --> 00:05:19.800 you have more specialization. So it's not limited 00:05:19.800 --> 00:05:22.346 to this, but it gives you a first impression of 00:05:22.346 --> 00:05:25.000 how you can actually slice your responsibilities. 00:05:25.000 --> 00:05:29.800 Right. That sounds like you have a proper blueprint in mind already. I know, but also 00:05:29.800 --> 00:05:35.600 that we are currently refining that way of designing a target operating model based on 00:05:36.600 --> 00:05:41.500 organizations of different industries. But is there a blueprint of how you can slice 00:05:41.500 --> 00:05:44.269 these ownerships, these responsibilities 00:05:44.269 --> 00:05:47.800 across IAM? Is there maybe, I don't know, a logical 00:05:48.600 --> 00:05:52.600 sequence imposed that can be followed by assigning ownerships? 00:05:53.600 --> 00:05:57.239 So the result of our target operating model, of 00:05:57.239 --> 00:06:00.800 the core concept, of the core model is a cube, 00:06:00.800 --> 00:06:09.000 I would say. So as I already said, we have the three different kinds of tasks, these three 00:06:09.000 --> 00:06:15.800 clusters. And then we have different, I would say, perspectives on them. So for example, 00:06:15.800 --> 00:06:18.768 talking about processes, which could be one of 00:06:18.768 --> 00:06:21.800 the tasks, we have three different views on it. 00:06:22.000 --> 00:06:24.804 First view is the design perspective. So we 00:06:24.804 --> 00:06:28.000 are looking at who designs it, who's responsible, 00:06:28.000 --> 00:06:31.300 for example, designing the joiner process. Then 00:06:31.300 --> 00:06:34.600 we have the execution, we define, they are like 00:06:34.600 --> 00:06:38.450 the execution of the process, the actual doing of 00:06:38.450 --> 00:06:42.300 it. And then the last slice, the last perspective 00:06:42.300 --> 00:06:45.580 that we have is actually the content, who 00:06:45.580 --> 00:06:49.500 delivers, or the input, who delivers actually the 00:06:49.500 --> 00:06:52.271 data work. For the joiner process, for example, 00:06:52.271 --> 00:06:55.100 HR could be one of the responsibles here. And by 00:06:55.100 --> 00:07:01.500 this, you are giving a bit more depth to the model, instead of just talking about a task, 00:07:01.500 --> 00:07:04.219 yeah, like design or process, joiner process, 00:07:04.219 --> 00:07:07.300 for example, you are also having like the different 00:07:07.300 --> 00:07:10.131 dimensions and the responsibilities that might 00:07:10.131 --> 00:07:12.900 change because of the different perspectives. 00:07:12.900 --> 00:07:15.004 And that cycles us back to the episode that we 00:07:15.004 --> 00:07:17.200 did earlier, not everything is IAM. And when you 00:07:17.200 --> 00:07:19.787 say input, when it comes to data being 00:07:19.787 --> 00:07:23.600 delivered to an IAM as input, triggering everything that 00:07:23.600 --> 00:07:29.400 is downstream in IAM and in the downstream systems, that is something that if you don't 00:07:29.400 --> 00:07:31.619 have this target operating model, that then 00:07:31.619 --> 00:07:34.200 stays with IAM because they need to clean up data, 00:07:34.200 --> 00:07:37.366 they need to reformat data and design processes 00:07:37.366 --> 00:07:40.600 based on just what they get. So target operating 00:07:40.600 --> 00:07:43.734 model design also means communication, talking 00:07:43.734 --> 00:07:46.800 to the right people, making them responsible, 00:07:46.800 --> 00:07:50.033 saying, hey, HR, what you're doing has an impact 00:07:50.033 --> 00:07:53.400 on us. Please make sure that we work together well 00:07:53.400 --> 00:07:58.900 so that it gets to a proper process. So is communication one of the key starting points 00:07:58.900 --> 00:08:06.900 in getting to a target operating model? Yes, of course. So I think the core thing that 00:08:06.900 --> 00:08:10.183 this model helps you with to get the people at the 00:08:10.183 --> 00:08:13.400 all around one desk, yeah, around one round table 00:08:13.400 --> 00:08:19.000 and to discuss actually the responsibilities. And of course, this fosters communication. 00:08:19.000 --> 00:08:21.790 So I see the target operating model that we 00:08:21.790 --> 00:08:25.100 developed more as an aid to start the communication 00:08:25.100 --> 00:08:27.388 and to start discussing about 00:08:27.388 --> 00:08:32.200 responsibilities, actually. Of course, it aligns with the IAM 00:08:32.200 --> 00:08:34.774 reference architecture we have here at 00:08:34.774 --> 00:08:38.500 Kuppinger Kohl. So it also continues the models that we 00:08:38.500 --> 00:08:41.438 have. So you can actually utilize the reference 00:08:41.438 --> 00:08:44.500 architecture to refine the target operating model 00:08:44.500 --> 00:08:51.700 and to add more specific tasks for your organization. So and by this, you start 00:08:51.700 --> 00:08:55.659 the communication and you make the split between 00:08:55.659 --> 00:08:59.700 responsibilities explicit. Also, you were talking 00:08:59.700 --> 00:09:02.555 like about HR already, but it comes what can 00:09:02.555 --> 00:09:05.800 also come to play are like third parties, external 00:09:05.800 --> 00:09:08.329 parties like managed service providers, for 00:09:08.329 --> 00:09:11.800 example, that need to be considered here, for example, when 00:09:11.800 --> 00:09:14.859 utilizing identity as a service solution or 00:09:14.859 --> 00:09:18.700 similar sourcing models. Right. So IAM is getting more 00:09:18.700 --> 00:09:21.100 complex, which is a good thing and which is a 00:09:21.100 --> 00:09:23.500 complex thing. So it's really challenging for 00:09:23.500 --> 00:09:26.681 organizations to deal with this new picture of 00:09:26.681 --> 00:09:30.000 IAM. So also the IAM teams are moving out of the 00:09:30.000 --> 00:09:35.600 machine rooms or no longer somewhere in the basements, but really aligning with corporate 00:09:35.600 --> 00:09:38.706 goals and maybe that as a final thought to think 00:09:38.706 --> 00:09:42.200 about. You've mentioned these reference architectures, 00:09:42.200 --> 00:09:44.476 these reference models that we talked about from 00:09:44.476 --> 00:09:46.800 the identity fabric to the reference architecture 00:09:46.800 --> 00:09:49.223 from a capability perspective. You've mentioned 00:09:49.223 --> 00:09:51.800 several dimensions or two types of dimensions when 00:09:51.800 --> 00:09:54.831 it comes to structuring the target operating 00:09:54.831 --> 00:09:58.000 model. If we take that step back, how does the 00:09:58.000 --> 00:10:01.132 target operating model and in the end IAM service 00:10:01.132 --> 00:10:04.200 delivery fit into the bigger picture of business 00:10:04.200 --> 00:10:06.494 evolution of service delivery within an 00:10:06.494 --> 00:10:10.200 organization? Will this help there as well to get more clarity? 00:10:11.200 --> 00:10:14.632 Of course it will. Yeah, because it makes 00:10:14.632 --> 00:10:18.900 things explicit and scalable. You are, for example, 00:10:18.900 --> 00:10:23.500 when talking about outsourcing, when you're talking about achieving your business goals, 00:10:23.500 --> 00:10:26.812 you actually have here a powerful tool which 00:10:26.812 --> 00:10:30.500 helps you to organize the organization along what 00:10:30.500 --> 00:10:33.184 you want to achieve. So if you are, for 00:10:33.184 --> 00:10:36.900 example, designing your IAM architecture alongside the 00:10:36.900 --> 00:10:40.506 reference architecture, then you have now a 00:10:40.506 --> 00:10:44.700 tool which translates the strategic view also in a 00:10:44.700 --> 00:10:48.015 target organization, target operation model and 00:10:48.015 --> 00:10:51.400 I think therefore it is a powerful tool that can 00:10:51.400 --> 00:10:54.949 actually help to organize your daily operations 00:10:54.949 --> 00:10:58.800 and to ensure that nothing is forgotten and nothing 00:10:58.800 --> 00:11:01.903 made redundant or executed redundant. 00:11:01.903 --> 00:11:06.600 Absolutely, and so we are back to traditional tools like 00:11:06.600 --> 00:11:10.629 Rocky matrixes and KPIs, KPRs, SLAs. So the way 00:11:10.629 --> 00:11:15.000 to formulate that will end up in these more or less 00:11:15.000 --> 00:11:18.101 tools that we are used to. Somehow you can take 00:11:18.101 --> 00:11:21.400 this or the input you have then generated from the 00:11:21.400 --> 00:11:25.161 target operating model also or from this picture 00:11:25.161 --> 00:11:29.000 that you then gain also to RASI matrices. You can 00:11:29.000 --> 00:11:32.569 also utilize it for defining your KPIs, your 00:11:32.569 --> 00:11:36.300 SLAs, your OLAs, whatever you want and make it 00:11:36.300 --> 00:11:39.552 contractual. So it is actually then the next 00:11:39.552 --> 00:11:43.100 step. It is the bridge, I would say, between the 00:11:43.500 --> 00:11:46.597 methodologies we have here and the well-known 00:11:46.597 --> 00:11:49.900 tools to bring the business perspective together 00:11:49.900 --> 00:11:52.885 with the IAM perspective. I think, yeah, it is 00:11:52.885 --> 00:11:56.000 a bridge. Right, before we close down, typically 00:11:56.000 --> 00:11:58.473 when I moderate a panel at an event, I usually 00:11:58.473 --> 00:12:01.000 have one question that I give all the panelists 00:12:01.000 --> 00:12:03.089 to give. For example, what is your first 00:12:03.089 --> 00:12:05.700 recommendation for achieving something? You are my 00:12:05.700 --> 00:12:08.298 only panelist, so I give you three questions. 00:12:08.298 --> 00:12:11.300 What are the three things an IAM leader should do in 00:12:11.300 --> 00:12:15.800 moving towards a proper target operating model? This will not happen within a week, 00:12:15.800 --> 00:12:18.880 but what are good first steps to take? Three 00:12:18.880 --> 00:12:22.100 ones. Yeah, first thing I would say is lead by 00:12:22.100 --> 00:12:25.052 capabilities, not tools. Ensure that you are, 00:12:25.052 --> 00:12:28.200 as we are doing with the reference architecture, 00:12:28.200 --> 00:12:30.821 we are starting with the capability, not the 00:12:30.821 --> 00:12:33.800 tool, and not build our organization around a tool 00:12:33.800 --> 00:12:36.680 rather than building it around the capabilities. 00:12:36.680 --> 00:12:39.500 Then fill the grid from your perspective. Yeah, 00:12:39.500 --> 00:12:43.955 take the three dimensions that I have per task, 00:12:43.955 --> 00:12:48.600 design, execution, input, and start alongside the 00:12:49.600 --> 00:12:51.966 reference architecture to understand what is 00:12:51.966 --> 00:12:54.600 done, what needs to be done. Write down the task, 00:12:54.600 --> 00:12:59.500 take the reference architecture as input, and describe what you have already. And then you 00:12:59.500 --> 00:13:01.875 might realize already where's the gap, yeah, or 00:13:01.875 --> 00:13:04.300 where you have the redundancy. So you can do it, 00:13:04.800 --> 00:13:11.500 do it on your own, and yeah, then you're actually also able to standardize and, yeah, 00:13:11.500 --> 00:13:19.000 kind of utilize the cross-application or cross-tooling capabilities, for example, 00:13:19.000 --> 00:13:24.500 in the management direction for designing integrated architectures. Yeah, so utilize the 00:13:24.500 --> 00:13:30.500 tool to actually start talking with also not your IGA or focus on IGA, focused on PAM, 00:13:30.500 --> 00:13:33.239 focused on access management, your IDP, start 00:13:33.239 --> 00:13:36.100 to like build a bridge also between these tools 00:13:36.100 --> 00:13:39.233 by the capabilities and to have a holistic view 00:13:39.233 --> 00:13:42.300 on your landscape and your tooling. Right, and 00:13:42.300 --> 00:13:44.940 one thought that just came up in the back of 00:13:44.940 --> 00:13:47.700 my mind, you've mentioned that earlier, and it 00:13:47.700 --> 00:13:50.120 was someplace hidden also in what you just 00:13:50.120 --> 00:13:53.000 said, it's a contract, right? You're making people 00:13:53.000 --> 00:13:55.226 responsible. It's not only saying, hey, we have 00:13:55.226 --> 00:13:57.500 a nice structure and we will work with like this 00:13:57.500 --> 00:14:00.513 starting tomorrow, but there is reliability, 00:14:00.513 --> 00:14:03.800 there's liability, there's responsibility hidden 00:14:03.800 --> 00:14:06.188 in that. So it's a contract. So if you do 00:14:06.188 --> 00:14:09.100 this, then let's do that. Am I getting that right? 00:14:10.000 --> 00:14:12.583 Yes. So based on this, you can actually then 00:14:12.583 --> 00:14:15.400 formulate contracts if it is necessary. External 00:14:15.400 --> 00:14:19.609 providers take the explicit split and then put 00:14:19.609 --> 00:14:24.000 it into a contract and take this as a foundation 00:14:24.000 --> 00:14:26.762 to negotiate also the terms of the corporation, 00:14:26.762 --> 00:14:29.700 for example, also with other organizational units, 00:14:29.700 --> 00:14:33.272 utilize it for defining their responsibilities 00:14:33.272 --> 00:14:37.000 and assigning them. Right. So I can only deliver 00:14:37.000 --> 00:14:40.600 IAM capabilities when I have proper HR lifecycle 00:14:40.600 --> 00:14:44.200 processes behind. So this is really a one-to-one 00:14:44.200 --> 00:14:47.168 connection. So that would be a starting point. 00:14:47.168 --> 00:14:50.200 If you do your job adequately, I will do my job 00:14:50.200 --> 00:14:55.500 adequately. So it's clearly a contract. It's an agreement that you can just phrase 00:14:55.500 --> 00:14:58.880 and put down and say, okay, this is the basis of 00:14:58.880 --> 00:15:02.400 how we collaborate. That's an interesting thought. 00:15:02.400 --> 00:15:09.000 So it makes things much more reliable with an organization. So it's no longer just an IT 00:15:09.000 --> 00:15:12.183 capability that's just there, but it's something 00:15:12.183 --> 00:15:15.300 that serves a purpose and it does that based on 00:15:15.300 --> 00:15:19.500 proper rules, based on the contract. Final thoughts from your side before we close down, 00:15:19.500 --> 00:15:21.779 what will be the next step within Kupinger 00:15:21.779 --> 00:15:24.600 Coal? How will we evolve the target operating model? 00:15:25.400 --> 00:15:28.289 Yeah. So as I said, I have presented the 00:15:28.289 --> 00:15:31.900 first version on IFIT. So now it gets out into the 00:15:31.900 --> 00:15:36.400 world. Yeah. And we are applying it in our organization, testing it actually. And yeah, 00:15:36.400 --> 00:15:43.600 I'm also planning to put some or write actually articles about it. So yeah, be curious, 00:15:43.600 --> 00:15:46.404 be keen about what might be published in the 00:15:46.404 --> 00:15:49.400 near future on kupingercoal.com and have a look 00:15:50.200 --> 00:15:52.817 if you have thoughts about it, reach out to 00:15:52.817 --> 00:15:55.800 us. I'm happy to discuss this topic with you. And 00:15:55.800 --> 00:16:00.000 if you need assistance there, of course, I'm also lend a helping hand. 00:16:01.400 --> 00:16:05.700 That sounds great. So watch this space. If you have any questions regarding this podcast, 00:16:05.700 --> 00:16:10.100 regarding everything we do at Kupinger Coal, please leave a comment for this episode. If 00:16:10.100 --> 00:16:12.104 you're watching this on YouTube, just in the 00:16:12.104 --> 00:16:14.200 comment section or send us a mail, send a mail 00:16:14.200 --> 00:16:19.400 to Patrick and or me. We are happy to reply and we will reply. We are keen on getting in 00:16:19.400 --> 00:16:22.384 touch with you. Let us know. And Patrick, you 00:16:22.384 --> 00:16:25.500 will provide more research, more input based on 00:16:25.500 --> 00:16:27.641 the advisory work that we're doing in the 00:16:27.641 --> 00:16:30.200 near future. So thank you very much, Patrick, for 00:16:30.200 --> 00:16:32.693 being my guest today. I think this will be a 00:16:32.693 --> 00:16:35.300 topic that we will follow up again until then, 00:16:35.300 --> 00:16:38.800 looking forward to having you soon as a guest in this podcast. Thank you. 00:16:39.800 --> 00:16:49.100 Thanks a lot.