IAM from a CISO's Perspective

Identity & Access Management (IAM) should be a core aspect of every company's cybersecurity approach. At the same time, IAM remains one of the most complex aspects of cybersecurity to implement. This guide helps you understand the different disciplines in IAM and the security controls you should adopt to cover your bases.

✅ Learn why you should care about IAM
✅ Master the three major disciplines of IAM
✅ Cover all your bases with the must-dos for securing IAM

Why IAM Matters for Cybersecurity

Over the past decade, trends such as cloud, SaaS, bring-your-own-device, and working from home have rendered the perimeter-based security model obsolete. The only piece that still connects all parts of your IT environment is identity — your user accounts and their accesses.

Because of this, identity is a central part of almost every hack. Whether you look at renowned breaches such as the Uber hack or the Okta hack, the modus operandi always involves a user's credentials being stolen or misused. Taking control over who can access which data and applications is therefore essential for cybersecurity.

Cybersecurity is not the only driver for IAM. There is also a clear link to compliance, as all major cybersecurity standards require organisations to prove control over access to critical data and systems. And from an operational perspective, proper IAM can bring down the time-to-work for new employees from months to days, decrease helpdesk burden for password resets, and lower licence spending.

The Three Disciplines of IAM

From a high-level point of view, IAM consists of three disciplines: Authentication, Identity Governance & Administration (IGA), and Privileged Access Management (PAM). From a cybersecurity perspective, this is an and-story — you should cover your bases on all three, not just one.

Authentication

Authentication covers how your users log in to your systems. This discipline focuses on password management, single sign-on (SSO), multi-factor authentication (MFA), passwordless authentication, and user provisioning. It is the most technical of the three disciplines.

Identity Governance & Administration (IGA)

IGA covers managing the lifecycle of user accounts in an organisation — from the moment an employee joins to the moment they leave. Identity governance focuses on the digital identities themselves. Access governance covers what those identities can actually access, including processes for requesting, approving, and reviewing access entitlements.

IGA is typically regarded as the most complex discipline because it involves much more than just IT — HR, the business, and compliance all play a role.

Privileged Access Management (PAM)

PAM is a specialisation of IGA and deals with highly privileged users — Windows administrators, root users on Linux, admin users in databases, etc. These accounts are especially critical to cybersecurity. PAM tries to avoid dangerous situations such as hard-coded passwords or shared admin accounts, which increase both the likelihood and the impact of admin credentials being compromised.

The Must-Dos for Each Discipline

What is best done will largely depend on your IT environment and the IT maturity of your organisation. From a cybersecurity perspective, the best approach is to work risk-driven and optimise for maximal risk reduction at lowest effort.

Authentication Must-Dos

• Enforce Multi-Factor Authentication (MFA) for all users, especially for remote access and admin accounts
• Implement Single Sign-On (SSO) to reduce password sprawl and centralise access control

IGA Must-Dos

• Enforce a leaver process: removing access when someone leaves is the most critical step and often the most overlooked
• Introduce fundamental access governance — periodic access reviews of who has access to what
• Ensure visibility: know which accounts exist, which are active, and which are over-privileged
• Once you have a governance foundation, introduce processes to request and approve access — start with existing tools like Jira or ServiceNow before adding dedicated products

PAM Must-Dos

• Identify all privileged accounts and apply fundamental governance to them
• Avoid shared or hardcoded passwords — this is how attackers become admin in your systems
• Educate sysadmins on safe credential practices and consider a secure password vault

Conclusion

IAM is a specific and complex field within IT, but critical to any company's cybersecurity. This guide explained the different disciplines of IAM and the basic controls you should apply for each of them. Proper IAM will not only improve cybersecurity and compliance, but also operational efficiency and licence spend — making it a very good business case.