1. Info-Tech Research Group1 1 Info-Tech Research Group, Inc. is a global leader in providing IT research and advice. Info-Tech’s products and services combine actionable insight and relevant advice with ready-to-use tools and templates that cover the full spectrum of IT concerns. © 1997-2016 Info-Tech Research Group Inc. Select and Implement an Identity and Access Management System You’ve got to know who’s who in the zoo.

2. Info-Tech Research Group2 2 Use this blueprint to support your IAM selection and implementation Launch the IAM Project and Collect Requirements Phase 1 Launch the IAM Project and Collect Requirements Phase 1 Not everyone’s connection and integration needs are the same. Understand your business’ integration environment and the unique technical and functional requirements that accompany it to create the criteria and select a best-fit IAM solution. Use Info-Tech’s IAM Vendor Landscape contained with phase 2 of this project to support your vendor reviews and selection. Refer to the use-case performance results to identify vendors that align with the requirements and solution needs identified by your earlier project findings. Select Your IAM Solution Phase 2 Select Your IAM Solution Phase 2 Use the project steps and activity instructions outlined in this blueprint to streamline your selection process and implementation planning. Save time and money, and improve the impact of your IAM by leveraging Info-Tech’s research and project steps. Benefits Plan Your IAM Implementation Phase 3

3. Info-Tech Research Group3 3 This Research is Designed For:This Research Will Help You: This Research Will Assist:This Research Will Help You: This Research Is Designed For:This Research Will Help You: This Research Will Also Assist:This Research Will Help Them: Stop! Are you ready for this project? You are interested in an identity and access management (IAM) solution and need guidance on your possible options and the procurement process. Your current IAM solution is not offering the features, performance, or usability you need. You have purchased an IAM solution and are looking for best practices for implementation. I am deciding if an IAM solution fits my needs. I will be implementing an IAM solution and I am determining which vendor’s solution is best for my organization. I have an IAM solution and I am deciding if I should stay with my current vendor or switch to a new player. CISO / IT Security Leaders System Administrators / Service Desk Management Organizations looking to improve their overall security posture and identity and access processes Understand the costs and options for IAM implementations. Identify the most appropriate IAM use case. Select the best-fit IAM solution. Avoid implementation pitfalls. Plan for effective system operations and management.

4. Info-Tech Research Group4 4 Resolution Situation Complication Info-Tech Insight Executive summary IAM is for everyone, but a holistic solution is not (right now). There are two categories of IAM: broad IAM solutions that offer suite-like options and niche players that have point solutions (e.g. offering a separate password management solution or separate MFA solutions). Not everyone will need or be able to afford a full-fledged IAM suite; however, all organizations should be working toward that and keep that future goal in mind as they begin to evaluate vendors. Look for vendors that can grow with you and allow you to add capabilities. Identity and access management is a fundamental security aspect that must be addressed by organizations of all sizes, moving beyond the simple blocking and tackling of system administration. Current solutions aim to elevate workload on the help desk and IT and enable the business through improved user experiences. The primary focus is to increase the security of both identity and access. IAM solutions offer a wide range of features. Some focus on point solutions for MFA, PAM, and SSO capabilities, while others offer full- fledged IAM suites. You may struggle to determine which solution makes sense for your environment. The ultimate goal is to balance high ROI, low initial cost, high IT/operational benefits, and high business alignment – a challenging task that will require some compromises. Before you invest in IAM, consider how thorough your solution needs to be. There may be IAM alternatives that would work for you, you may need individual point solutions, or you may need a full IAM suite. Determine which use-case scenario you align with most closely, whether you need improved operational efficiency, optimized user experience, or a full identity governance solution. Based on your requirements, use the Vendor Landscape evaluation and tools to narrow down the list of vendors. Plan the implementation of the IAM solution, ensuring that the schedule is future-proofed. Whether you’re starting from on- premise and eventually moving to the cloud or starting with point and eventually moving to broader IAM, you need to establish where your organization will go with IAM before you can start.

5. Info-Tech Research Group5 5 Consulting “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.” Guided Implementation “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.” DIY Toolkit “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.” Workshop “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.” Diagnostics and consistent frameworks used throughout all four options Info-Tech offers various levels of support to best suit your needs

6. Info-Tech Research Group6 6 Best-Practice Toolkit 1.1 Market overview and introduction to IAM 1.2 Structure your IAM selection project IAM Procurement Project Charter Template 1.3 Gather and analyze your IAM requirements IAM Use-Case Fit Assessment Tool 2.1 IAM Vendor Landscape IAM Vendor Shortlist & Detailed Feature Analysis Tool 2.2 Select your IAM solution IAM Vendor Demo Script Template IAM System RFP Template 3.1 Prepare for implementation 3.2 Collect metrics Guided Implementations Identify organizational fit for the technology. Create the project plan. Plan requirements gathering steps. Discuss the use-case fit assessment results and the Vendor Landscape. Contract review. Create an implementation plan. Discuss rollout of processes and handover to operations. Onsite Workshop Module 1: Launch of Your IAM Selection Project Module 2: Plan Your Procurement and Implementation Process Phase 1 Outcome: IAM selection project launched. The organization’s IAM requirements. Phase 2 Outcome: Selected IAM solution. Phase 3 Outcome: Plan for implementing the selected IAM solution. 1. Launch the IAM Project and Collect Requirements 2. Select Your IAM Solution 3. Plan Your IAM Implementation Select and Implement an IAM System – project overview

7. Info-Tech Research Group7 7 Measured Value for Guided Implementations (GIs) Engaging in GIs doesn’t just offer valuable project advice, it also results in significant cost savings. GIMeasured Value Launch Your IAM Project Time, value, and resources saved using our guidance to determine if an IAM is right for your organization: 1 FTE*1 day*$80,000/year = $320 Analyze IAM Requirements and Shortlist Vendors Time, value, and resources saved using our tools and Vendor Landscape for determining your IAM requirements and shortlisting vendors: 1 FTE*5 days*$80,000/year = $1,600 (if done internally) Time, value, and resources saved using our tools and Vendor Landscape for determining your IAM requirements: 1 consultant*3 days*$2,000/day = $6,000 (if done by third party) Select Your IAM Solution Time, value, and resources saved using our guidance and RFP templates: 2 FTEs*3 days*$80,000/year = $1,920 Time, value, and resources saved using our guidance and RFP templates: 1 consultant*3 days*$2,000/day = $6,000 (if done by third party) Time and effort spent right-sizing the solution to prevent under- or over-engineering the solution = reduced due to our RFP/quote review process. Plan Your IAM Implementation Time, value, and resources saved using our best-practice guidance on implementation and transitioning to an operations team: 2 FTEs*2 days*$80,000/year = $1,280 Total Savings $5,120 (internally) OR $13,600 (third party)

8. Info-Tech Research Group8 8 Day 1Day 2Day 3Day 4 PreparationWorkshop Day Working Session Workshop Preparation Facilitator meets with the project manager and reviews the current project plans and IT landscape of the organization. A review of scheduled meetings and engaged IT and business staff is performed. Morning Itinerary Facilitation of activities from Section 1 and Section 2, including project scoping and resource planning. Conduct overview of the IAM market landscape, trends, and vendors. Afternoon Itinerary Begin conducting an inventory of the organization’s integration environment. Map integration scenarios. Identify integration patterns. Morning Itinerary Complete IT inventory assessment. Afternoon Itinerary Document architecture environment. Make critical architecture decisions. Document high level solution requirements. Morning Itinerary Perform a use-case scenario assessment. Review use-case scenario results; identify use-case alignment. Review the IAM Vendor Landscape vendor profiles and performance. Afternoon Itinerary Continue review of IAM Vendor Landscape results, use-case performance results. Create a custom vendor shortlist. Investigate additional vendors for exploration in the marketplace. Workshop Debrief Meet with project manager to discuss results and action items. Wrap up outstanding items from the workshop. Procurement Support The facilitator will support project team to outline the RFP contents and evaluation framework. Planning of demo script. Input: solution requirements and use- case results. IAM selection workshop overview Contact your account representative or email Workshops@InfoTech.com for more information.Workshops@InfoTech.com

9. Info-Tech Research Group9 9 Use these icons to help direct you as you navigate this research This icon denotes a slide that pertains directly to the Info-Tech Vendor Landscape on IAM technology. Use these slides to support and guide your evaluation of the IAM vendors included in the research. This icon denotes a slide where a supporting Info-Tech tool or template will help you perform the activity or step associated with the slide. Refer to the supporting tool or template to get the best results and proceed to the next step of the project. This icon denotes a slide with an associated activity. The activity can be performed either as part of your project or with the support of Info-Tech team members, who will come onsite to facilitate a workshop for your organization. Use these icons to help guide you through each step of the blueprint and direct you to content related to the recommended activities.

10. Info-Tech Research Group10Info-Tech Research Group10 Fischer International implements IAM in 5 weeks at American college by getting clear on process and objectives CASE STUDY Industry Year Education 2014 “Jefferson College becomes the new model for identity management roll-out.” – Educause.edu PhaseFocusResponsibility Phase IProject logistics and meeting structureClient Phase IIRequirements gatheringClient Phase IIIPlatform installation and configurationClient Phase IVNetwork configurationClient Phase VApplication tier install/configuration Client & Vendor Phase VISolution construction Phase VIIUser acceptance testing Phase VIIIProduction migration Phase IXSolution presentation Phase XSolution turnover Success follows similar formula Info-Tech recommends requirements gathering and other preparations in advance of any vendor selection or even technical determinations like network configurations. Phases reprinted with permission from Fischer International