All ContentDemonstrating a robust ISO 27001 information security management system with identity governance
Demonstrating a robust ISO 27001 information security management system with identity governance
“One Identity
solution enables
you to mitigate
risk for your
organization;
control user and
privileged access;
govern identities;
secure data; and
get more done
with less.”
reports. Plus, the One Identity
IAM solutions provide a separate
database of activity records
that you can use to substantiate
security policy violations, such
as when providing support of
personnel sanctions.
system, and business-application
user governance mandates
while also providing foundational
IT security measures. One
Identity IAM solutions enable
organizations to achieve such
governance by:
One Identity’s IAM solutions
enable you to consolidate multiple
user identities to establish
unique user accounts across
disparate platforms, establish
access policies, manage user
entitlements, monitor for data
access policy violations and
maintain related history across
all system components that lack
access management, thereby
filling a fundamental security
gap in traditionally weak
infrastructure controls. While
these solutions will not replace
your network monitoring tools,
when regularly used as part of
an information system security
program, they can greatly reduce
a host of unauthorized access and
system changes, thus preventing
numerous policy violations before
they happen.
• Consolidating and unifying user
identities across the enterprise
• Automating the enforcement of
access management, including
requests, reviews, approvals,
denials, attestations and revocations
• Identifying risk factors to track
users with access to account data
and assign risk levels based on risk
criteria: e.g. days in current role
(without role change) and policy
violation history
• Responding to management and
audit inquiries with reports that
demonstrate historical compliance
with many information security
policies and procedures
• Monitoring and reporting on active
and historical privileges granted,
including those with reporting
period, system clock or time stamp
edit privileges during sensitive time
periods or outside the course of
normal business operations
• Substantiating evidence of policy
violations, such as those involving
conflicts of interest.
Simplifying identity
governance and
streamlining compliance
For a proper controls reliance
strategy, organizations need to
unify user identities across all
applications that grant access
to confidential or personally
identifiable information (PII),
and they must also supplement
application-based security
features with access controls that
protect environments subject
to compliance regulations. And
given the complexity of those
regulations and the ever-changing
threat landscape, organizations
need to simplify identity
governance and reduce risks
related to user privileges.
One Identity IAM solutions
automate many of the network,
3
A more complete and
effective solution
In short, One Identity IAM
solutions are designed to
unify user identities, simplify
the user provisioning and deprovisioning process, and provide
privilege governance (through
authorization, attestations and
privilege history across enterprise
applications to the platforms
and environments that support
critical applications and house
sensitive data. In doing so, they
fill a critical security gap for
traditionally weak IT controls.
In addition, the solutions equip
organizations to identify sensitive
data and enforce security policies
that control access to that data;
and they apply user-risk rankings
based on data sensitivity,
granted privileges and policy
violation history.
While not a replacement for
governance, risk and compliance
tools, when regularly used as part
of an information governance
program, One Identity IAM
solutions can help organizations
achieve IT governance. It can do
this by detecting where account
data resides and identifying highrisk users, and by enforcing access
authorization, which will eliminate
unauthorized access to sensitive
data and unauthorized systemconfiguration changes — and
thereby preventing policy violations.
By ensuring controlled access
based on need-to-know and
providing detailed history of
when authorizations to access
account data were granted and
by whom, One Identity IAM
solutions help organizations
control user access to enterprise
applications and unstructured
data in their production operating
environments and ensure that
critical access controls are
applied to security architectures
in all phases of the system
development lifecycle.
One Identity IAM solutions
included in this paper are:
4
1. Identity Manager
2. Identity Manager Data Governance Edition.
Identity Manager
Organizations need to mitigate
risk by identifying sources of
controlled data, securing that
data (from entitlement creep,
outdated user access, etc),
meeting uptime requirements,
satisfying compliance obligations
and increasing productivity by
giving users faster access to
the data and applications they
need to do their jobs—and
nothing more. Identity Manager
streamlines user provisioning, deprovisioning and access-approval
processes. This One Identity
solution enables you to mitigate
risk for your organization; control
user and privileged access;
govern identities; secure data;
and get more done with less.
With it, you can be the security
“Risk Mitigator” that your
organization needs.
Using One Identity solutions, IAM
can finally be driven by business
needs, not IT capabilities. With
Identity Manager you can
unify security policies, meet
compliance needs and achieve
governance while improving
business agility with a modular
and scalable Identity and access
management solution.
Identity Manager Data
Governance Edition
Identity Manager – Data
Governance Edition protects
your organization by giving
access control to the business
owners who actually know who
should have access to which
resources. So, the people who are
familiar with roles and business
needs now are empowered
to grant access to sensitive
data, and analyze, approve and
fulfill unstructured data-access
requests to files, folders and
shares across NTFS, NAS devices
and SharePoint. Identity Manager
– Data Governance Edition helps
data owners (not IT) determine
who should have access and
automates the request-andapproval workflow, keeping your
company from being the next
security headline while reducing
the burden on IT.
How One Identity IAM Solutions
map to ISO 27001 requirements
This section provides a detailed
mapping of the controls listed in
ISO/IEC 27001:2013 Annex A to
the capabilities of One Identity
IAM solutions. You can use this
mapping to proactively identify and
address gaps in your ISO ISMS
with One Identity IAM solutions.
Please complete the form to gain access to this content
