How to set up your IAM organization

Identity and Access Management (IAM) is positioned as one of the most critical yet underestimated responsibilities in a CISO’s portfolio because it sits at the intersection of data protection, productivity, and compliance. Traditional IAM capability models are increasingly strained by complicated permission landscapes across devices and applications, alongside relentless privacy and regulatory demands. Many IAM programs fail to meet management expectations, largely because requirements are gathered and implemented in a reactive, demand-driven way—often initiated by governance, risk, or compliance—triggering isolated projects whenever a request becomes large enough.

This pattern commonly produces a vertical, technology-centered IAM organization built around silos (pillars) such as access management or identity governance, each spanning strategy, development, and operations. Such structures obscure end-to-end visibility, complicate coordination of dependencies and roadmaps, and trap knowledge inside individual teams. Limited cross-team communication encourages duplicated solutions, missed reuse opportunities, and uneven requirement coverage.

IAM’s historical growth has also pushed IT into managing core business functionality rather than focusing on infrastructure operations. The situation is worsened by “planning the unplannable”: incident-driven security work that frequently diverts resources and derails objectives without clear prioritization and processes.

Usability emerges as a decisive success factor. IAM is often perceived as inefficient and confusing, especially when users must navigate inconsistent portals and opaque processes; password resets remain a persistent pain point even in otherwise mature environments.

A capability-based, horizontal service architecture is recommended: define capabilities, map them to building blocks, identify gaps and duplications, and orchestrate reusable services into an “Identity Fabric.” Success depends on enterprise-level ownership, future-proof architecture, comprehensive user coverage (employees, customers, partners, technical users), and a strong service organization focused on user-centric processes and self-service.

• IAM services protect organizational data, systems, and applications from unauthorized access.
• Requirements are often initiated by governance, risk management, or compliance functions.
• Large individual demands commonly trigger new projects to find a technological solution.
• Technology-oriented IAM structures make it difficult to coordinate resources, strategy, dependencies, and roadmaps.
• In siloed models, communication between teams typically occurs only when a technical integration is required.
• Lack of awareness about existing solutions can lead to duplicated implementations.
• IAM expanded over time from administrative needs to additional governance and compliance-driven requirements.
• Unplanned security incidents commonly cause organizations to reassign resources from existing mandates to address issues.
• IAM is frequently perceived as inefficient and designed without sufficient attention to user experience.
• Password management is one of the top user issues in almost every organization.

• “Not every Chief Information Security Officer (CISO) knows that IAM is possibly the most critical component in their portfolio.”
• “Management’s expectations of Identity and Access Management (IAM) programs are rarely met and CISO’s face the challenge of outlining the benefits of IAM investments for an organization.”
• “This often results in a vertical organization.”
• “The overview is missing.”
• “The knowledge is available, but only in the individual silo.”
• “The historical and iterative growth has been leading to the consequence that core business functionality is managed by the IT department.”
• “Planning the unplannable”
• “Usability is key”
• “Things that should seem simple often appear overcomplicated or designed without user engagement.”
• “Sometimes a step back is a step forward.”