Taking Inventory Of IAM: Identity And Access Governance Best Practices For The Retailer

By Jay O’Donnell, president and CEO of N8 Identity

Retail IT teams face employee access management challenges on a scale unlike any other.  Employee turnover rates can often be in excess of 70 percent, meaning that a new employee might get hired, onboarded and leave the organization all before HR (or even IT) ever learn of the employee’s hire in the first place. With thousands of employees subject to this dizzying cycle, enabling compliance with evolving regulatory requirements – including those that cover identity and access management (IAM) – can be a major headache for retailers.

Retailers are saddled with a wide range of regulations – such as Sarbanes Oxley, PIPEDA – that have changed IAM from a niche problem into a business-wide issue. Knowing who has access to what information within an organization – and whether they should have that access – is compounded by retail’s employee churn, the federated relationship between corporate and multiple store locations and types, and the challenge of managing IAM on a massive scale. 

Yet, to improve identity governance with retail-specific best practices the company must first determine which department is responsible for managing IAM. On first glance, it may seem as though IT should assume full responsibility for IAM.  This approach makes sense on a superficial level as identity information is stored on many islands of databases across departments and business units that are administered and managed by the IT team.  In addition, employee network access is usually enabled and revoked by IT.

However, when it comes to effectively managing a retail identity governance program, looking at the issue from the perspective of IT alone paints an incomplete picture.

Please log in or register below to read the full article.