It's like me playing Grand Theft Auto. They're sure there's a main story and a main quest or whatever you want to call it, but I just happen to just randomly drive around and find random things to work on. So I need like something that's a little more on rail sometimes. Right. And it's like if we achieve the scope of getting $35,000, we can get a better car in the game. That's really what I think. It's the difference between the word objectives and goals. I agree with you, they probably
mean about the same thing. I think objectives implies that there's some kind of metric driving like we want to get 10% more efficient or we want to improve our security platform by some metric and that ought to be the objective. So you see, the objective is like the measurable result of a goal. I think. So OK, I mean I can argue it both ways, but I don't, I don't want to argue. This is identity at the center if it has anything to do with IAM.
This is the go to podcast now your hosts Jim McDonald and Jeff Stedman. Welcome to the Identity at the Center podcast. I'm Jeff, and that's Jim. Hey, Jim. Hey, Jeff, how are you? Oh, not so bad yourself. I think we're having the Internet as you're saying, we are best on this episode, but we'll just. It's very laggy, that's for sure. I feel like there's like a delay, like I'm saying something and then the gears are turning in your brain like, oh, processing, processing.
OK, now we put out voice. I'm responding as soon as I hear your question mend. That's all I can tell you. But minimally tell, we're doing our best to stay on track of recording an episode and publishing one every Monday. That's our commitment to our loyal listeners. And hey, sometimes it's going to be a shit show.
Yes, very well, maybe. So I'll do my best at this and make it sound natural, but if there are unnatural delays in between things that I just can't do cleanly or make it sound at least somewhat normal, I might just leave them in and just, yeah, deal with it. Hopefully the conversation and the topic makes up for it. And yes, this is the the joy of being an identity consultant and living in out of hotels. This time you're in the hotel and I'm actually at home.
So that's a little bit of a role reversal there. Big time and well anyways I had meetings in Austin, TX very cool city, great food and and what I learned was that I dated Concentric stickers are in fact currency. You can use them for people who are die hard this years. We had a few at company called towels. They do B to BCIAN and as they're in my role as a consultant for RSM, that's my day job. We partner with them. It's a good relationship.
I was there with Chad and Fletcher from our team. And again, they talk about the podcast like they just love it. And it's amazing, Jeff, because people keep asking like, why didn't you guys start doing this podcast? You know, five years ago, podcasts weren't even a big deal. And it's pretty cool. Just, I mean, the story's pretty, pretty lame. It's like, yeah, Jeff asked me to probably just start the podcast and like, yeah, I guess so.
Like what else are we doing? Yeah, all you have to do is just speak into a microphone, right? It's that easy. Which one of these? I mean, you know. Well, except, except when we're dealing with weird Marriott Internet foibles. You know, that's the one thing that I think hotels have really missed the boat on is just black luster Wi-Fi all over the place. It's just not good. Yeah, totally. And even enhanced Internet is enhanced of a what over horrible Internet that operates at the
speed of like flip phones? I don't know. Well, you're tethered to your phone, so we'll give it a shot. Why don't we get into a couple of the conferences that we want to make sure people are aware of. We can talk about Identity Week in Asia. We were just at the DC conference, which was a lot of fun about Asia still taking place October 22nd and 23rd. And if you use the code IDAC 30, that gets you 30% off. We'll have a link in our show notes for people to check that
out. But before that, we've got the authenticate conference that you and I are going to be at October 14th through the 16th in Carlsbad, CA IDAC 15 gets you 15% off of your registration and I am very much looking forward to that conference. We've got some exciting plans for what we're going to be doing there. As part of sort of the official agenda, if you received an e-mail asking you to fill out a survey with a bunch of identity questions, please do so because that's for us.
And it's something that Jim and I are working on and we need as much participation as possible from people listening. So if you're attending the final conference, whether it's remote or in person, hopefully you have an e-mail. If not, check your spam folders and look for that survey so that we can collect some information from folks and turn into what we hope will be a really fun session at the conference itself. That will be in person, and I believe it's going to be streamed too.
So it'll be a lot of fun, but we need your help. So that's my tweet. Everyone has register register using our code. Yeah, of course. So you save money, we get a, we get a little bit of of credit as far as like, hey, you know what, we want to partner with you guys again because we were able to drive some some folks to attend. So that's how that works. Yeah.
So conferences and I think today's is kind of be about conversations that you and I have both been having and sort of our real jobs around IM programs. I'm kind of like thinking about this like, all right, so you want to start an IM program, Cool. Now what, what do you do 1st and maybe kind of take a high level approach here from a, from a strategic perspective, say, OK, here's how we want to go about building out an identity and access management program. And I think this applies to
really any organization. If you have an IM program, great. Take a look at it and let's see, you know, if there's anything that we mentioned here that you might want to incorporate. If you haven't started 1A, better time than now to start thinking about, OK, how do we want to get things kicked off? So why don't we start there? And I think the first thing that you probably want to start to think about is what is your IM program want to be when it grows up? What are its goals, its hopes,
its dreams? What is the scope? You know, what is it your program is meant to address? Is it internal enterprise workforce, you know, employees, is it customer, is it both? Should you mix both into the same program? You know, I think there's, there's different options there's but what do you think about starting there? Jim is like, hey, let's, let's figure out what we want to be before we start to design this
thing. Yeah, I think golds and scope are obvious two things that you need to define. I think sometimes you have to work backwards into that. In other words, what are the drivers? What are the outcomes that you're trying to achieve? When I think about these drivers and the outcomes, a lot of times it's it boils down to improved efficiency, reduced cost and improved security and a rich reduced risk, improved
compliance results. So if you have those objectives in mind, that helps and certainly helps you drive your scope because if all these things require that you're doing a workforce saying customer I am, that may be the scope of your project. You may know those things are scope of your program, you may know those things going in. But either way, I think it's important to define what are the drivers, what are the outcomes that you're looking to achieve
within your program? I feel like we're saying the same thing. We're setting goals, we're saying outcomes. So I think we're on the same page and I think those goals and outcomes are very different based on your scope. So if your, if your remit within the organization is you're in charge of employees, that's going to be a very different, you know, set of outcomes that you're trying to put in place if it, you know, compared to customers, right, true customers.
And maybe maybe organization is more in the middle where it's like B to B is more like partners and other vendors and things like that. Think of like like a dealer network, right? Or insurances like that too, right? We have a lot of different kind of B to B partners that are, are doing things. So certainly figuring out those initial things starts to take the, the, the universe, right, and make it a little bit
smaller. And I think that's, that's helpful because if you have a tighter scope and a tighter vision of what's of what you're trying to do, that helps narrow the focus and say, OK, here's the path you want to follow.
Because otherwise, you know, it's like a, it's like me playing Grand Theft Auto. They're sure there's a main story and a main quest or whatever you want to call it, but I just happen to just randomly drive around and find random things to work on. So I need like something that's a little more on rail sometimes. Right. Maybe it's like if we achieve the scope of getting $35,000, we can get a better car in the game. That's really what I think. It's the difference between the
word objectives and goals. I agree with you, they probably mean about the same thing. I think objectives implies that there's some kind of metric driving like we want to get 10% more efficient or we want to improve our security platform by some metric and that ought to be the objective. So you see, the objective is like the measurable result of a goal. I think. So OK, I mean I can argue it both ways, but I don't, I don't want to argue. Yeah, no, not.
Let's just call it that for now, yeah. That's how it feels, obviously that's how it feels at the moment. OK, so we've got our objectives, we've got our goals and scope. What do you think is the next step that we that we want to start to think about? Well, normally what we do and we engage in this process with the client is we start with an assessment. And so it's very helpful to have people who have perspective.
So either maybe people on your team have a good deal of experience of working at different organizations within your industry and have some background in how I am is being done at different places. Or you engage with the third party and which I've experienced with seeing what works well, what doesn't work well from an identity perspective.
And then designing, well, really performing an assessment of where you sent, how mature are your current processes compared to other organizations in your industry and a world at large. Yeah, I think about it as, all right, I want to build this Lego car, spaceship, boat, whatever it may be. What Legos do I have that will help me get to that end state of whatever it is I'm trying to building? And more importantly, what Legos am I missing? Do I need, Do I have the right people?
Do I have the right processes, the right technologies? So I think about it from an inventory perspective to say, OK, here's what we've got, here's where we're trying to go, what's working, what's not working? What are the parts that are missing? What are other people doing to solve for maybe some of these gaps? Maybe there's a unique Lego shape and there's only three of them in the world and you're not going to have access to it, so you've got to come up with an
alternative. So I think working through that process of assessing and saying, OK, these, these are the things we have to play with. What does our toolbox look like? Are the tools we have good enough or do we need to buy new tools or upgrade our current tools or train our current tools right? Or maybe learn to use our tools in a different way through a business process or something that makes things more efficient?
So I'm totally with you right there is like, OK, goals, let's set them up. Let's set our objectives now let's assess and see what we've got to play with and where we want and how are we going to get there with the tools we've got. Does that make sense? Yeah. And it it makes you think of an example. So one of the areas that we talked about in this one of these Lego boxes is what is the system of record for your
identities? Normally companies do a very good job of having all their employees in a single HR system. They have a good search system of record for who works. Sierra Star's employees, contractors, It's really hit or miss. Some, many organizations have spreadsheets or databases of contractors without having the perspective of what is best practice, what are other organizations doing Startsheet good enough databases could not.
I mean, generally the answer is going to be no. But how would you know such things? So I think having some experiences because trying to think about the identity management, it's experience based and you know from a consulting standpoint it's experience based. It's not like you go into each client organization and come up with the Whizbank solution, coming up with the solution based on what you've seen work in other places and what you've seen where it's caused major
problems. You want to avoid major problems. So that example I just used, a major problem is an organization where we've got a spreadsheet for every country and they may or may not have the contractors in that spreadsheet. We may or may not have all the identity identities in the system of record. That is not going to be a good starting point for an IGA implementation. Yeah, if you're trying to go down the IGA route, you definitely are.
The goal is to become more data-driven in that aspect is you want good timely quality data sources to drive that automation. But let me take the alternative here. If contractors are only 1% of your total users, is it worth saying, OK, well, we haven't won the battle yet to put him in our work day or whatever, you know, ADP, whatever the identity source of truth is for for employees. Can we get away with. Yeah, you know what, that's going to have to be a
spreadsheet for now. And maybe it's a little bit of a Field of Dreams approach where we say, well, we're going to build it and we're going to hope there comes the employees will be taken care of and people are going to start to wonder why contractors don't have the same experience and they are more of a hassle. Well, here's why, because we've we've got the tools, we've got the business processes in place
to manage our employees. But for whatever reason, non employees have, you know, don't have feature parity, right when it comes to those business processes. And so that's an option, you know, I guess.
So I'm just. One example, but I think it's good that you bring up the devil's abdicated approach because I think the scenario you brought in was a very edge use case where the company has, let's say thousands of employees and only 1% of those employees are, I should say a thousands in the workforce and only 1% of those are non employees. That's I, I almost goes as far as to say I've seen that very
rarely or maybe never. It's almost always a greater percentage, always almost always dealing with hundreds or even thousands of contractors. In those cases, you need to have a system record. When you're talking about a couple dozen individuals, you may be able to come up with a a more simplified way to manage to choose. Ultimately, you do need to come up with a solution. That's just one example of many identity use cases. Yeah, I mean, I agree with you. I, I, you know, there's there's
no magic number, right? 1% of 1,000,000 is a lot of people. So I think it really is kind of let's take into context and say, OK, well how big of a problem is this? And do we, do we stop progress because 1% of our population is not going to be addressed and addressed very well? I'd argue no, unless that 1% is like critical to the business and causes a outsized amount of risk that you're unwilling to take, then OK, let's figure it
out. Ideally you've got everyone covered, but I think in the real world, you have to make sacrifices sometimes. And that might be a battle that you, you know, push down the road a little bit rather than just waiting for everything to be perfect before you start, because that's it's, it's never going to happen.
You got to start somewhere. But I'm with you on that because a lot of times these programs we start to think about this is like, hey, this, this advice you're, you're saying Jim and Jeff sounds, you know, pretty, you know, common sense like duh. Well, some of it is, yes, but people aren't doing it. It's like, OK, well, why aren't you doing it? Why aren't you setting a structure around this? You know, who owns identity and access management, right? Things like basic questions like that.
And so sometimes it doesn't sound so innovative until you get further down the road and say, oh, yeah, we needed to like, build the base, you know, before we started to add in all the fancy stuff that that we really were thinking about getting to. But if you had tried to do, you know, let's put AI on top of it right now, terrible time. You're, you're, you're not going to enjoy it. The data will be suspect and you'll wonder why you ever did
this in the 1st place. So I, I'm a firm believer in and thinking about that firm foundation. And that's where that assessment part comes in. It's like, OK, what do we have to play with? What's realistic? I see. The other thing about an assessment is that you're going to find where are your big gaps, Where is it that you really need to have a mature, stable process and you're underwhelming. And I think probably most practitioners intuitively know
where those gaps are. But putting together a bar chart of like we're here in terms of maturity, we need to get there or where we are, where we are heading, I think that's an important exercise. I think it's important. I don't place as much. I mean, it's a bar chart and you know, 50% of all stats are made-up. So you know, it's kind of like, OK, maybe that's what you need to get executive buy in because ultimately you're going to need executive buy in to get this thing going.
And so maybe, you know, your executives are very big on charts and you need to quantify everything or as much as you possibly can, but sometimes those metrics might be a little bit subjective and you have to kind of explain. OK, well, you know, the Active Directory team is doing a great job, but AWS stinks. So how do you try to combine things into like 1 bar chart might be a little bit challenging. So I think you have to kind of understand as part of that assessment process to say, OK,
here's what we're doing. Well, here's where we need improvement and let's figure out how to get this together because unless you've got executive buy in, you're going nowhere where you're going to have a very difficult time.
This is not a grassroots campaign that you can typically stand up and all of a sudden you've got, you know, whatever investment people or technology that you need to get things started and certainly not you don't have the support to do business change, which is really, really hard. That's probably the hardest thing of us, if it's the change and you need the executives to be part of that, that process.
Yeah, I think that's one of the reasons I love interviewing chief information security officers on the podcast is that they speak the executive speak, but understand cybersecurity. So they're able to put investments and return on investors in terms that executives get. Why would I spend money to reduce risk? I could spend that money to improve my business in other
ways. So it's important to make that that business case, that return on investment case for investing in identity and access management, investing in an improved user experience or improved security posture. Yeah. And so you need the people who get that, who understand that and are good at making that case or you're going to be running around and doing IM on, you know, pocket change. That is no fun.
Not only is it no fun, but it's hard to be effective and you're going to constantly be chasing your tail. Yeah, I think one thing that I've seen a a big improvement over the years in talking with CSO's and others at the executive level is their ability to articulate why something
needs to be done. Because a lot of times the pain and suffering is hidden because there are heroic IM people running around doing things that are beyond the scope of their role or going above and beyond to fix things just out of the they know what's the right thing to do. And a lot of times that stuff gets hidden and covered up. Well, nothing's broken. Why do we need to fix it?
Well, let's open up the the covers and look at this, you know, engine that is like a bunch of popsicle sticks and a hamster. Like that's not, you know, that's that's not where you want to be and it's it's a risk, right? If one of those popsicles has a break, the whole thing kind of falls down. Or if the really important hamster leaves, who's going to
drive this engine? So I think, I think that a lot of the executives that you and I both talked to have gotten better and articulating that of here's why the investment is important. Now ultimately the business is going to decide. And I think it's the CSO's job or whoever's in charge of making that, that case really needs to understand the risk component for it and be able to articulate that out to others to secure the other buying.
Because it's not like CSO's can do this all on their own either. Typically they have to go out and get support from their peers and other executives right within the organization. So it's important that that executive buy in is in place, not just in information security or wherever the IM program is going to live, but across, because you're going to need people across the organization to make this thing happen.
You're going to need a cross functional team, which is really where you start to say, OK, we've got our our goals. We've started to think about what we have in place. We've got executives saying, yes, you know, proceed, let's start to figure out what's next, and let's put together A-Team because you talked about those conversations that you have with a whole bunch of other people as well.
It's not just information security as part of an IM program, it's infrastructure, it's the help desk, it's the business themselves. So you really want to make sure that you pull enough people together, but not too many people to be able to have insight and windows into the different parts of the organization so that whatever it is you're designing works for as many people as possible. Yeah. And suddenly pulling that information in Billy Evangelist in the cross functional area.
So HR and other parts of IT or other departments, they can go out and talk to their teams about how I am is coming with the strategy, how it's important to align with the strategy, adopt the shared services. I always like to talk about the 360° view of IM conference. And we worked with a guy named Ben and he's like, oh, gag. Like 360. Like that's so cliche. And I don't think it's about 7/27/20 is like make your head spin on.
But I think about the 360 is like looking at bulb on and communicating what the IM program is contributing to the company and getting feedback about what the business is doing and how the IM team can support that. It's, you know, working down with the IM implementation teams, with the operation teams, the project management office and understanding how things are going with the DJ on the ground.
It's also working laterally with the business and with other technology teams to make sure that the services you're creating as an IM team are effective, that business can use them, that the business understands them, and that from a technology perspective, they're fitting in with what the needs are. If you're doing all those things, you're going to build evangelists and the people are going to say, hey, the sign in program is not so bad.
And you're getting results out of it and things are happening. And it's not just, you know, a committee for committee sake, that kind of thing. Here's why I don't like the 360 term. I get where your, your head is at makes sense. But to me, 360 is 2 dimensional. And it's, it's more like it needs to be like a sphere or a globe And to be able to say, oh, we are, you know, we're, we're communicating at in all directions. I don't know if 360 gets that three-dimensional aspect to it.
Does that make sense? Well, definitely, I mean in terms of the mathematics of the 360 is definitely 2 dimensional, so I get that. I don't know what the sphere would include that the 362 D view doesn't when what are you thinking there? Let's. Let's just go with it. Yeah. I mean, let's let's go with it because I think, I think the concept makes sense and I don't want to, I don't want to get into a geometric discussion, but I do want to ask you what's at the core of that 360 at the center?
Would that be the I am program manager? So I always think of the I am steering committee as kind of the core body that pulls all together. But if you go even more central to the core, yeah, like now you're in that little ball and center of the earth. This is the I am program manager. I don't think it's just one single role. I think that person holds it together that the IAM architect,
they become a team. It's like the business person and technology person and really the IAM program manager running around who doesn't get the tech is going to have a problem being effective. The person who gets the tech but doesn't understand the business is going to have a hard time getting around. So usually it's two different people. I guess there could be one person who really guess both aspects of it, but it's both
sides ahead. And then the third leg of the stool, there is one is the executive who's kind of saying, all right, this is what the business needs to buy in. So it's not Even so much conversations upward because they're so hard to have. You don't get that much time from executive teams, so if you have somebody who's from that that world who is part of your core, they can tell you like this what the business is expecting from the program.
And they might be part of the steering committee or something like that. But I'm with you. I think there's like this, this core I am team that kind of sits in the middle. And there will be other resources that kind of spin in almost like planets orbiting or moons orbiting a planet, right? That kind of situation, you know, maybe HR is really important for this first phase because you mentioned IGA, we need HR to be there because we're going to be using their data to drive automation.
Once that's done, maybe they spin out into a further orbit where they're, you know, not as I want relevance, not the right word, but they're not the focus. You know, maybe now we're pulling in IT infrastructure team because we're doing
privileged access management. They become much more in focus and then OK, we fix that and they kind of slowly drift into a further orbit and then, you know, you've got these other components that are coming in. But I think I'm with you in that like you've got a program manager. I'm going to tell you, a good program manager is really hard to find someone that can communicate and understands the
technology are exceedingly rare. If you are one of those people, be sure you're taking advantage of that, of those skills and really driving your organization. If you're, and if you're a, if you're a techie and you're really not great at communicating, work on it.
I mean, start to work on the communication and if you're a good communicator, but you understand the tech, you know, watch videos, get more involved with that stuff and kind of learn it. Because I do see that that Unicorn of a single program manager that understands the vision of the program can communicate why that's important and what people are going to get out of that in layman's terms, terms that everyone's going to be able to understand, but also
understands the technology. They don't need to be a developer. They don't need to be, you know, in the guts of the applications configuring things, but they need to understand the capabilities that are there and have the resources at their disposal to enact those things. Engineers, analysts, you know, whatever that looks like for the tools. Yeah, I mean, let's try the most important role in the program overall. You brought the cross functional team line is thinking about
that. You know everything we just described would work as well for a workforce IM program or customer IM program. Oh, you think about that important role of the program manager. How often have we talked to folks who've made their way through I to become the identity program manager, You know, essentially the the chief practitioner of IAM for their organization and how many different paths people can take
to get there. I usually find that it's people who understand the business, know how to make the case for return on investment, and have enough technology understanding that they know what the parts of pieces are or more. You know, I don't think that just because you're not technical, you should use as an excuse to say I don't need to learn that or I don't want to learn that. I think be a sponge. I think if you're technical, learn as much as you can about business.
They can only help you in whatever position you take. Yeah, I totally agree. I think once you've got that team in place, now you start to think about the tools you're going to do battle with, right? What are the capabilities you want to bring in? Do you need an IGA tool? Do you need privilege access? Do you have single sign on and MFA? Have you got all that, you know, figured out already and now you need to do something with ITDR or some other analytics? Or maybe you're on the customer
side. You're like, hey, we don't really have a good way for our customers to manage their profiles or maybe their their data consents, especially if you're in Europe or other places where you have, you know, laws like GDPR, for example. So I think really understanding what the technology fits are is important because these are typically long term decisions that you're making, right? You don't buy Octa and say, OK, well, we'll get rid of it in a
year. These things are generally too expensive to like turn over that quickly. They're not disposable in that way. And that can be really challenging because there's a lot of really good products out there, products that are like in your face and everyone knows about and ones that just for whatever reason struggle with awareness and, you know, presence in the market. And they're new or upcoming or, or maybe they're big in Europe, but they're not big in the US or
vice versa, right? Things like that. So I think understanding the technology landscape is very helpful because it almost always comes down, in my experience, to the details. You're going to buy an IJ tool. Guess what? They can all do provisioning. They can all create an Active Directory account, you know, remove it, add permissions and run an access review.
It's all the details around it that are typically the differentiators at this point for a, for a, for a technology that's that mature, you know, up and coming things maybe like an ITDR or some sort of, you know, AI enhancements as we're seeing now, maybe there is a little bit something there. It's like, OK, you know, there is a little more maybe meat on the bone that we need to kind of chew on.
But I think the, the right technology is, is really key because you're going to be stuck with that for probably, well, at least three years if it's SAS, cause three-year subscription's basically right, but probably longer because people are going to ask you, well, why did we spend all this money implementing this tool only to RIP it out three years later? That's a really tough pill to swallow. Yeah. Well, I mean, that's the question is like what should be the horizon that folks should
look me at? It almost seems like to say 10 years is like a little bit polyamic or unrealistic. At least five years I kind of feel like is the minimum where you start to really get your money's worth. You're ripping it out at five years and having to rebuild. That's a major reinvestment. There's a tough decision. I think one thing is just saying this company is the leader now and assuming they're going to be the leader in five years.
Well, if history is any teacher, that's not always the case. In fact, it's rarely the case. I don't know if history is the right teacher for this. I mean, you look back on this industry 15 years ago, you have said you choose Oracle or CA or IBM. None of those companies are really relevant in this space anymore. Maybe IBM, but CA and Oracle are not relevant in their identity space anymore. They owned the identity space. They were the only choices really.
And now you look around and the other incumbents, will they be around 5-10 years down the road? I think they it feels like they will. It's choosing the right technology is is not easy. No, because there's so many good choices. And the truth is you could probably be successful with almost any of them if you're willing to adopt their business process that they bring to the table. That's sometimes a challenge for
organizations. You know, you bring up this this idea of like, will the company be around in five, 1015 years? I think that's real important. You know, IBM and you know, the CAS and the Oracles, they've been around for a long time. And yeah, they kind of had their heyday in the IM space, but they
were around for a long time. I mean, it wasn't like they were only an IM for like 5, you know, 5 minutes, five years, whatever that is. It was decades, you know, that they were kind of the the only real players in that enterprise market now. They let, you know, upstarts like Sale Point and others, you know, come up and kind of steal
the market away from them. But there will be other vendors that come up. But when do you make the investment in a small player versus an established player is always interesting 'cause I think a lot of that has to do with the risk appetite of the organization. If you're a small organization, maybe a little bit more nibble
in your choices. Maybe you are willing to go with, you know, somebody who's new where it doesn't have the track record, Maybe they don't have, you know, that's the fancy training portals and kind of all that stuff. But you feel good about their technology and you've gotten maybe some insurances from leadership over there, right, The CEO or people who are maybe more hands on maybe than than
another organization. Or maybe your organization is a little more adverse to that type of risk and wants to have an established partner. And those are the types of organizations that will say, well, give me the Gartner Magic Quadrant. Let me just look at the upper right. I don't. Think there's anything wrong with that? I it might be, but maybe that's just the profile of the
organization. They're not willing to look at a smaller company until they've grown and gotten through that, that hump of hey, we're in the market, We've been around now for 5-10 years and we have a bunch of customers and there's less of a concern that they might die overnight, for example. I can get that. I get the risk. I understand it. I don't agree with just saying look at upper right of Gartner and even Gartner will tell you don't look at just Gartner upper
right. That doesn't mean as much. But there are organizations that do not want to play with the smaller fish. They're looking for the more established fish in that case, and I get it. I think that's just something that you have to think about. You have to think about it. So you know, as you've been talking, I was thinking I just talked about Oracle CA and IBM. People are saying I think you probably, yeah, that ancient
history in terms of identity. They were replaced by Octa paying for Jack. No, they were replaced by Gigya and January. Those companies basically don't exist. They're bought by Akamai and SAP and they pulled back those capabilities so much that I mean when was the last time they've either seen SAP or Akamai and an identity conference. So these things run in cycles. There's acquisitions that can take place and then companies can deemphasize the portfolio. Can you take that and like glean
me the operation from it? No, I just think it means that you're saying the right technology is even harder than you think. Yeah, I agree. OK, So we've got our program, we are, we've got our goals, our scope, we've done our assessments, we've got our buy in from the executives. We've got a team kind of put together. We've, we've muddied through the process of, OK, we figured out the technology we're going to use. Now how do we get it
implemented? And typically you'd probably want to do this in a phased approach versus a Big Bang. Because Jim, I'm going to go off and build this thing. I want you to give me $3,000,000 and I'll see you in three years. Are you going to give me that money? No, I might give you a loan to the first phase. Right, so I need to show wins right along the way. You didn't need to show wins. I think my feeling on implementation has been maturing. So I'm going to tell you where it's at.
Today I came up as a wonderful guy. I have a PMP and I learned that PMBOK and it's waterfall based project management. It's create phases. You start a project, get into project. At the end of the project, you have a bunch of functionality that you defined and built requirements for and designed in the beginning of the project. Today things are shifting more towards agile project methodologies where you do
sprints and they're very short. They're almost like many projects where you do requirements design, implementation or I'm sorry, development, testing and then implementation all within a two week time period or something very short. That's the way I think the industry is going. I don't think that approach works well for initial deployments.
MVP deployments are called them where you say, OK, today we have some legacy technology that's barely supported anymore and it's doing automated provisioning or it's doing some basic capability within the identity space. I still think that. You know, defining a project and saying we're going to RIP and replace, that's the way to do
that. But then when it comes to integrating more applications into your environment, when it comes to enhancing functionality or rolling out new functionality, I think that agile approach works really well. I think 1 is a little bit more difficult is taking that approach and communicating it to the executives because ultimately they want to know what they're going to get for their money.
And you can't say, well, every two weeks we're going to decide what we're going to work on. So I'm still kind of struggling with that. And it's not like I learned about Agile last week. I've been struggling with this for a decade, you know, since I've really kind of like brought my head around it. I think that in a way you're kind of like layering phases and layering non pure agile on top of agile to say, all right, we're going to do 8 sprints.
At the end of the 8 sprints we're going to deliver this set of features and functionality. But within those sprints you decide what to work on when. So that's kind of how I feel like, you know, the approach to the implementation plan, realistic reality being thought. Right now, I feel like to some degree you're almost bound by whatever your organization tends to do for projects. Some organizations are waterfall, some are agile, and some are somewhere in between.
But I think a lot of times, especially if you're in a big organization, you know, large enterprise, they probably have a program management office or project management office, and they have a defined set of criteria that every project goes through. And sometimes it's not a great match, but you still have to do it anyway because that's just the way the organization works. I do think the phase approach
generally makes sense. I think if you're implementing a technology, almost always the first phase looks alike no matter what technology vendor you pick in a certain area. So I'll pick on IGA again. If you're going to deploy IGA, you're probably going to connect it to identity source of truth, right? Your, your HR platform, you're probably going to connect it to Active Directory and or your Intra directory or Azure Active Directory.
And maybe you're going to connect it to service now or some other ITSM tool, your ticketing system, that might look like phase one for any IGA platform because they generally all will kind of start in the same area. Then from there, it might iterate based on, well, we are a financial organization, so we have socks and other things that we need to be aware of. So maybe financial apps come next because you need to do that, right? Or maybe they're included as part of phase one.
But guess what? The real phase one is still probably AD first, then the other financial apps, right? And maybe that's the same for you. If you're doing an authentication, you're putting it into IDP, what you got to connect it to is probably going to be whatever your new directory is. Your first step is hopefully going to be enabling MFA and then you're going to talk about, OK, what are the applications
that we want to connect to that? And so I think a lot of times these, even though it's like the same pattern, it's really the technologies are really going to start in the same spot. What what the variation ends up being is what are the objectives that you've already defined to say, OK, well, we're doing this because we need to be compliant because we failed our socks on it. OK, well, let's start planning. So this time next year, we have those applications under
management in our new platform. They're going through a new access review process and we'll feel more confident that we'll be in a better position to be more compliant. Or maybe it's our cyber insurance is going to be due for renewal and they charge us an arm and a leg because we didn't have MFA or we couldn't get insurance because they didn't have MFA or because they're starting to ask questions around privilege access management. And we don't have good answers
to that yet. Let's not be in that position next year. Let's start with the phased approach to get there. And let's start with the priorities to say, OK, what do we need to get cyber insurance MFA mandatory? OK, now we know what our first
phase is for an IDP. And I think you can take that same logic and apply it to any technology that you're looking to deploy, especially in a core identity solution or identity situation, Your authentication, your life cycle management and your privileged access, like those three things are generally going to kind of start in the same ballpark. And then Spira from there based on your business use cases or things that you want to address. Does that make sense?
Yeah, I, I'm wondering if you're from running to folks in the business who say, all right, you're, you're building a plan for the company that we are we're planning to triple in size over the next five years. You know, really that plan to me, I mean, my, the initial log that comes to my head is crawl, walk, run. In other words, you can't go, you're crawling today. You're doing things in a certain way that you're saying we just, we want to run, teach us how to
run. Like feel like we need to teach you how to walk first? Right. You ever, you ever been sitting on your foot and your leg falls asleep and then you try to get up and run, you're going to fall over and look like a dummy. Yeah, you know, and sometimes after you know, that's what needs to happen is like, hey, you know what if if you could run, wouldn't you be doing it already? But you're not because there's problems. You've got to solve some of
those root issues first. I don't know any organization that's like, hey, we're going to plan, we're going to be smaller in five years. No, no, no company does that. Every company is looking to get bigger. There's nothing unique about that. Every company is the goal is to make more money, grow larger, blah, blah, blah. Right. So yes, you want to design your program to meet the future, but every program has foundational building blocks.
No matter how big or small you want to be, if you don't have those foundations in place, you're going to struggle. You're going to have, you know, dead leg and you're going to fall over and look like a fool. That's, that's my $0.02 on it. I love it. All right, so we've got our phased plan, we'll call it, or at least you're starting to figure out like what chunks that you want to do from an implementation standpoint for technology.
I don't think you didn't want to ignore the user experience because you can have the best technology in the world, but if nobody can use it, guess what? Nobody's going to use it and you'll use your ROI and you got unhappy campers literally all over the place. So when you're designing the implementation of these tools and you're evaluating which tools you want to use, you should be looking at what is the end user experience. Does this make sense?
Does it look like a program that was designed in the last 10 years even, right. I mean, I think you and I have seen a lot of products where it's like, well, that was a great interface for the year 2000. You know, here we are in tier 2024 and nothing has changed and
it still looks like that. Does that give me confidence that the user experience is going to be good maybe for a certain part of our workforce that understands that, but maybe that part of the workforce is aging out and moving on in our in our newer workforce totally doesn't get it and they think it's a terrible user experience. So I think you've got to focus
on your constituents, right? Who are the scope of your of your programs, whether it's employees, partners, customers, whatever may be, really pay attention to that user experience. Nail it because that's going to be the first impression that your IM program makes for a lot of people. The first time you have to go in and reset your own password if it's a total hassle. This thing stinks. What do you mean I have to call somebody? Can I just do this on my own
right? A lot more self-service, a lot more agency. Where the where the Amazon points of things where it's self-service. I want to go to a portal, buy the thing that I need or request it and never talk to a person and just have it magically appear on my doorstep in two days or even better yet, same day. If I live next to a Prime, you know, warehouse or something like that. That's the sort of mentality I think is if you treat I am like a product for your organization, think about that.
User experience is such an important part that I feel is getting better. I feel like a lot of people I'm talking to recently are thinking about that user experience, but it hasn't always been that way. And I think it's something that we should always be vigilant for as identity people is take a step back, you and I get identity. Maybe there's somebody out there that's like, yeah, I I'm an Azure expert. I totally get it.
But we sometimes get lost in this, you know, self delusional spot where it's like, yeah, I get it. What do you mean you don't understand why my SAML connection isn't working? And I gave you an error message saying open ID connect not configured. No, normal humans going to be under be able to understand that. So you've got to think about that from, you know, Jim's dad's perspective. Can Jim's dad use it? All right, now we're on to something. What do you think?
Yeah. Well, I, we had an interesting conversation about this today and I'm going to answer this question off of you. So I think customer identity and workforce identity, this topic needs to be treated differently. But I want to ask this first question is from an executive owner perspective, workforce identity and customer identity generally owned by different executives CX OS within the organization. What? What have you seen mostly? I think typically they are, they
may have some shared teams. I think historically marketing or some other customer kind of facing department might have been in charge of it, e-commerce, whatever that looks like for whatever position. I think it's two different mindsets. And I think now you get into, you're trying to find an IM program manager that knows how to do talking and talk tech. And now you want them to talk both on the enterprise workforce side as well as the customer side. Yeah, that Unicorn just became a
lot harder to find. So maybe it does make sense to have a couple of people. Maybe my focus is enterprise and your focus is customer or vice versa, right? Whatever it may be. I, I guess it's, it's the consulting answer of depends, which I kind of hate to say, but I think it's difficult to find one person who really understands everything about both sides and can talk all that
technology and be that good. And I'm sure there are people out there who are like, yeah, I can do that no problem. Great, cool. I think it's a unique skill set and it becomes more unique the more requirements you pile on that role. And that's just another set of
requirements. So I can certainly see information security, for example, owning the enterprise workshop or the enterprise IM program, but I can also see the the information security team telling or advising some other group to say, hey, we know you're working on customer identity. Here are some services that we have that you might be able to use.
But more importantly, here are the guidelines or the governance or the policies that you need to make sure are in place so that the risk is at the level that our organization is willing to tolerate. I don't have to own it, just make sure you put MFA on every account, right?
Or something along those lines. I think everything you said there was spot on. So I think what you normally see is that the C so is responsible for workforce I am and then the question or then this statement doesn't become prioritized user experience. In other words, it's more important than security. It's don't forget the user experience. So in other words, like 10 years ago, or maybe it was longer, but it was like the user experience for workforce I am doesn't matter.
These people work here. I don't do what we tell them to do. I think companies and that was a terrible mindset, but they, I think it was the predominant mindset, at least where I worked at once, right? I was, you know, going back before I got into consulting. I think the industry's matured. Companies have matured to say not only is cybersecurity important, but giving our employees a good experience with their IT is important so they can be productive and so they don't hate working here.
On the customer identity side, I think it's kind of important. I think on the customer identity side, you're right. It's often times the chief marketing officer or some business executive, VP, let's say, who owns the customer portal, let's call it. It could be whatever, but it's customer I am and I've heard things like and I'm not kidding about this Jeff, like we need to have 8 character passwords, preferably would be 6 and ain't no way we're rolling out MFA.
When I hear that I tell whoever I'm talking to they are wrong and you can tell them that Jim McDonald told them they're wrong. That is just terrible. I'm I understand that the user experiences paramount when it comes to customer IM. And if you're going to put 6 chart capacitors, 8 chart capacitors, you're basically putting their data at risk and it's your fault. It's not their fault if those accounts get breached. And so for them, I'm not going to say prioritize the user
experience. They already are prioritizing user experience. It's almost like don't forget about security or don't de prioritize security. I think you know at least SMSOTP is ubiquitous. So if you have a low insurance use case, at least do SMSOTP. Don't rely on 6 and 8 character passwords and if you start getting longer, there's a passwords or password change frequency. I mean you're making that user experience worse. Start using multi factor authentication. Move to, you know, unfishable
multi factor authentication. I'm not saying you should mail Ubikeys to all of your customers but have no authenticator apps. I mean, it's these things aren't that far out anymore. I feel like yes, you, you kind of said something there about like they're, they're focused on the user experience versus security. I'd argue they're not focused on the user experience because they're not doing a good job of helping the user protect themselves from themselves.
And I think this is a spot where, again, you know, maybe it's a program manager, maybe it's executives. They really need to articulate why that's a bad idea to not have MFA in place. OK, you don't want MFA in place. Well, what if I told you there was easier? What if we just didn't have passwords at all and we went passwordless? Tell me more.
Right. I think this is where if you're staying current with the market and identity space, hey, passkeys might be a solution here that everybody wins. So I think there's options there. But I think sometimes you're totally right, not sometimes you're totally right, but sometimes you do have to draw a line in the sand. Like look, that's just not acceptable. And I'll flat and I'm with you.
If you do not have MFA on your IDP today, you are asking for it and I want it in writing that I told you this was a bad idea. And when you get breached, it's not going to be me that's going to, you know, be rolling out the door. It's going to be the, you know, someone else. Sometimes it's CYAI hate to say it, but there are politics in every organization and you're not going to win every battle.
The best you can do, especially sometimes if you are not at the level where you've got the juice right to be able to kind of direct policy is look here. This is This is why this is important. I want you to real understand the risk that you're taking if you do not follow this advice. But I think you also have to be able to work with your business partners. OK, I get it. We don't want to have 16 character totally randomized, you know, can't use the same, you know, character more than
once, right? Some of these, you know, we've all been in the end of that password policy. It just is like impossible. Like how am I supposed to go with the password for this? Like it just doesn't work. Come up with alternatives. Look at modern authentication ideas, you know, use web auth, then use pass keys.
I think there are enough options out there now that hopefully this trend starts to lessen because it's almost like you kind of talk there about the employee experience is like, well, they work for us. We can tell them what to do and it doesn't matter. I think the products have gotten better in that space also. So it's not just that we're getting better. The products are getting better because we've been asking them to get better.
Hey, I want a better user experience, even though I'm just an employee in quotation marks, right? I'm still a customer of the services that my organization's providing. And it it can and it should be better products have caught up. But yeah, when I I'm with you, I will, you know, tell them, tell them Jim and Jeff said you're wrong. I'll add my name to that petition as part of that process. Oh, your slot language? Yeah.
All right, let's keep it moving. I want to combine this idea of like governance and policies and like metrics and measurement because I feel like they kind of go together. But I think that's what the other part of this program is to think about, OK, what are our policies? What are our standards? Are they realistic? Do you even understand what a policy is versus a standard versus a procedure? Maybe it's time to rethink how you, you know, define what those things are.
My mind a policy is, hey, you should have multiple forms of authentication. Great. How I do that might be an IT standard or a corporate standard or a security standard that says, OK, The policy says we have to have multiple forms of authentication based on our risk tolerance as an organization. And we've talked to the executive about it. We've kind of established this is the minimum bar that you need to be at.
We're going to allow SMS, we're going to allow push notification, and we're going to allow you the key. And maybe that changes on a row. But those are the three we're going to do for now. Now you've got your standard, here's our standard process for that, or sorry, our standard for the implementation or application of that policy. And then the procedure is how you do those types of things.
I think sometimes I see a lot of policies that are like trying to jam standards into it. And depending on the organization, maybe you can change policies really easy, maybe you can't. Maybe it requires a board approval or something that doesn't happen very often and you get stuck kind of behind the times and you're not able to really kind of push, yeah, the security of a certain policy or a certain standard that you want to put in place.
So I feel like the governance, the policies that go around that, the standards, but then also the monitoring, the measure goes with that as well as OK, well, OK, we got this. I am program. How do we know if it's successful? What are some of the metrics? You know, can you just stick your head out the window and say, well, it feels a little bit warmer today. So I think we're doing good, you know, yeah, customer satisfaction surveys will certainly be important.
It's like, hey, our people, you know, they think this is a good experience, but there should be hard metrics as well, right, Jim? It's like how many automations did we are we able to do for onboarding, for off boarding? How many, you know, bad sessions were we able to block from authenticating entire environment, right.
There should be some ability to drive some metrics that makes sense to your organization to kind of demonstrate it because at the end of the day you need to show value and a lot of times. Especially in the IM world, that value is almost invisible because it's like, well, I just typed my ID and password or I did a prompt on my phone and I was in like, what's security? You're right.
OK, Well you know, I've said this before, like look in your Microsoft account and go and look at your access history and I'm sure you will see tons and tons of things where people were trying to get into your Microsoft account and Microsoft to their credit, blocked it. They're giving you a log and say, hey, these roads again, but they didn't service it to me because it never rose to the level where they felt confident
it was me logging in, right? You need to be able to demonstrate those sorts of wins and publicize those wins, make people aware of it. Continuing about what the value is that you're bringing to your organization, whether it's efficiency, risk reduction, you know, hey, we saved X percent on our premium this year because we had our strong privilege access management, you know, platform in place.
Hooray win. You know, maybe it paid for the privilege access management, investment always be looking for those things to to promote the wins and to measure the success of the organization. What do you think? I think you you know that there were a few points I wanted to add on to. I think when you have Carl's you framework and you say you shall have every access shall require multi factor authentication. It's Cuba simple. What are you doing to monitor that?
So let's say you have 700 entry points and 500 of them are connected into your IDP that has multi factor authentication. Maybe you're doing adaptive, so that's green check box for those 500. What about the other 200? Are you? Are you keeping track of whether or not they have met all the policies? If not, you don't know whether or not you're complying with your own policies as an organization. And so I think that's very important.
I think also having a very formal exception process because you'll have legacy applications that say our application is like dumb tube, you know, in other words, it's a telnet section and MFA is not possible. OK, maybe it is, maybe it isn't, but let's just say it isn't and they have a a technical reason why it won't work. Whatever software they're running won't integrate with whatever solutions you can come up with. That's fine.
You have to file a formal exception and somebody in the business, some business person, even if it's an IT executive has to own that risk. That's to me. And, and by the way, this has nothing to do with identity. This is how you run a good cybersecurity department is yeah, policies the organization has to policies and standards they are. They're not optional. It must be complied with by everyone. And if they can't be complied with, a formal exception needs
to be applied for and approved. And in order for that to happen, a senior executive needs to sign off on it. And usually it's an ink signature, but you know, a workload tool would probably be fine as well. But what I'm getting at is that, you know, that's a risk management exercise that's above and beyond identity. I should include really all of your cybersecurity policies and standards. So I think that's important. We also talked about, you know, clear roles and responsibilities
for your program. I, I, I think you may be into that, that I think that, you know, identifying those up front is going to be very important, evolving those overtime who's responsible for what decisions within your program, spending money or changing policies, things like that. Who, who's got that responsibility within your program? Yeah. So I think those things are very important.
I think that the basis of your IM program is your policies, your shared services should be called your easy button to comply with those policies. So, you know, teams that are, you know, maybe have some autonomy over their application or they're saying, hey, our application is too important to rely on your creaky IM system, so we're just going to do our own IM. That's fine, whatever you know, maybe executives have said just leave them alone, that's fine.
They still need to comply with the policies or if they're not going to apply someone you're saying the race as to see. So that's the personality. Yeah, I agree with that. I think that idea of, you know, basically conducting a certification campaign right against things that are not within compliance of whatever policies you set out makes sense. Maybe it's OK, Yeah, telnet example for example, that you mentioned. OK, yeah, they, they can't comply.
All right, let's check back again in a year and see if things changed or six months or whatever the right time frame is. Yeah, maybe it's time to move on from a technology that doesn't meet modern standards. You know, maybe there's a company out there, and I think we've mentioned this in prior episodes, like there's this website, right, SSO tax or SSO dot tax or something like that, where companies charge for basic security things like enabling
SSO. Maybe they're not the right choice if they're going to charge for basic security concepts like that. Yeah, maybe they're a good product and you know, maybe, you know, they, they, there are no other choices, but I think that's part of that same, same ideas like, hey, what are we doing to get better? Track what you've got, measure it. And yeah, some things are going to be a compliance, especially when you're just starting out. Nobody is 100% compliant 100% of
the time. There are always accepted risk somewhere that someone of the appropriate authority level or, you know, signing authority has said, OK, I'm willing to accept that risk. If something happens, then we'll deal with it. That exists. Plan for it and you won't be surprised. You also mentioned one of the thing that I've got to cover which was around monitoring or measuring user experience and how much of your ROI they committed to you're achieving.
So you're asking the company to invest in identity. I think the thing you should do with being a program is really have a well thought out plan of what are the dials that you're going to improve. Snap a line, where does those
dials exist today? Whether it's in terms of things that are easily measured within the tools that you have, you know, longer password resets, things like that, or things that you have to go out to the business to measure with survey data, for example, like user experience. But either way, you need to be able to show improvement over time. Six months, a year, year and a half, two years to show, hey, remember I asked you for $1,000,000. I said I could do all these
great things. I did all these great things. User experience improved by 50%. That's huge. This shows you're a good bet, right? And if you can deliver on that, you're guess what? You're probably going to be more apt to find funding for future projects that you want to work on as well or to keep things going. And I think This is why it's so important to be communicating. You know, throughout this entire process. I don't think you can
communicate enough. I do think you need to give some thought into the communications that you are doing. Know your audience. Who are you talking to? What is relevant to them and what do they care about? Try to think about it from their perspective and tailor that communication to them, but always be thinking about, OK, how do I explain this? I get stuck in an elevator, you know, with somebody. Can I explain what my IM program is doing on the 15 second write up?
Or can I, hey, you know what? We just rolled this thing out and you should check it out, you know, and and and and have that dialogue going with people, both part of your program, but also to your customers of your IM program, whether it's workforce or, you know, customers in AB to C type scenario. So the communication is super important throughout any time you get to celebrate a win, celebrate the win. Draw attention to it, highlight it. If there are issues, address them as well.
Hey, this is not working and let's not be afraid to go back and rethink how this is implemented or the business process is designed or whatever it may be. It's OK to be wrong. And I think sometimes we struggle with what we have to be perfect every single time.
It's just not realistic, right? We're humans, we're going to make mistakes, but be willing to admit the mistakes and think about it and maybe you think it's great, but your customers hate it. Hey, I'm sorry, as much as I love it, I'm going to have to redo that and and come at it from a different angle. And that's fine. It's OK to get smarter. And I think sometimes we lose that as well. I think lastly, the most important thing I think is to stay current.
A lot of times we see investments in, hey, we're going to stand up on IM programs could be awesome. We gave it like 2-3 years and we were really kicking butt. And then it just kind of like died on the vine and just kind of coasted and didn't keep up with the world and the environment. And now here you are four years later, five years later, six years later, and it's like, wow, what happened? Like we used to have a really kick butt IM program and services, but we didn't keep up
with things. We didn't stay current. And I think it's really important, you know, we had, I kind of had this conversation earlier today was there's peaks and valleys in an IM program. If you're not doing it right, you want to smooth those peaks and valleys out as much as
possible. If you're behind, you're going to have to invest to catch up. And invest means money, people, time, whatever that is. But there's going to be a spike to get up to a certain level and then you're going to have to keep a certain level of investment going to maintain and
to keep current with things. What typically happens is if you look at, you know, a budget for an IM program over 10 years, if you're not doing it right, is you'll see a spike in year 1 and then it drips down to like, you know, year three-year 4 and then another spike and it kind of drips down.
If you had just kept current, it would have been a lot cheaper and you would have been a lot better positioned from a risk and a usability standpoint, most likely, if you had just maintained and kept current with where the market is. And I think that's really important for people who's like, great you put in technology and what's next? What should I be thinking about? What did I see at a conference? What did I hear on the world famous Identity at the Center
podcast, right? What are the things that I need to be thinking about for, you know, skating to the puck and hockey. You don't skate to where the puck is, you skate to where it's going. The business is like that. Your IM program should be like that. And if you're not doing it, guess what? The puck is still going, you're just going to be further and further behind. So you want to make maintain your cadence and your ability to keep up with the world from an IM perspective as well as the
business side of things. Yeah, I think, I think organization can fall back, fall behind for a few reasons. One is they have to shake up people and maybe the people who were responsible for the IM road map moved into all through things. Priority shifted and that role never got back filled. So it just became continue to operate. And that's something that we say I am. It's not a project that's program. So you take your eye off the
road. We just you have the things the car keeps moving, but you're not paying it to to the road and bad things can happen. I think the other thing is I've seen this happen for a few clients over the years. They get signed up in the MSSP doing indemnity as a service, but they build that MSSP around what we do today.
They have to take into account that they're going to want this system enhanced, but I think probably the best way is to set some money aside or have some flexibility to be able to perform enhancements in the system themselves, one or the other. Usually they don't have any staff left, right? They outsource the management of their IM. They need to put some money aside for enhancements because what you have today is not going to serve you three years on the rig.
I don't care who you are, I can almost guarantee three years on the rig. You're going to require enhancements along the way because if it's going to change, you're going to have new applications, a new HR system, say it's there. So you need to take that into account. Even if you're outsourcing the maintenance of your IM system, which may make total sense to your organization, may make total sense for you.
Just remember to put some money aside or build it into your budget, build it into your bill to get that system to have tickets or whatever their process is for enhancing that system. Yeah, I think that's a really good tip. I think the other thing I'll add to that is there's a lot of vendors out there and fewer
partners. If you are working with, you know, an MSSP or or something on those lines, whatever managed service, look for a partner, look for somebody who's you know, got your, is interested in helping you involve in helping you get the most out of things and has a plan to say, hey, you know, this thing is what it looks like right now. It's going to change and that's OK, that's fine. That's natural. Here's how we're going to keep
up with that, right? And maybe it's as simple as, hey, there's going to be a version upgrade because we're a partner with so and so company and we're using our technology. We know this is coming. This is something you want to plan for or hey, I saw this neat thing called pass Keys at a conference last year. Have you guys thought about that? If you have a good partner, it makes a world of difference for your experience with any type of
managed service. And I think a lot of times, you know, it's unfortunate, but money rules sometimes. And those partners tend to be a little bit more expensive upfront, but maybe they pay off in the long run because you're in a much better position and, you know, maybe you've developed a better relationship with those partners.
So I think it's also something to think about as, you know, if you're going to outsource, really consider who you're working with and make sure that you had a really good comfortable feeling with it. People are going to change, right? I mean, you and I might go from one company to another like we have, and those relationships, you know, will probably carry along from there.
But you really want to make sure you understand the company that you're getting, you know, to partner with and making sure that they're the right fit for you strategically. Because hopefully you hope that. It's a long term relationship. Thank goodness it any better believe you they're I keep hearing the same company names also working.
I'm not not going to repeat them on the podcast, but you know, they leave a Trail of Tears that they go in off at the lowest price and then change order you to death. And and to avoid all the change order issues, basically sit pad and have a system that gets older and older. It's not a good situation. Yeah. OK. I think this might be a record for our longest episode ever, so why don't we leave it there? I'll just kind of recap real quickly. I just realized we have 10 steps here.
One, define your goals in the scope. 2, conduct an assessment. 3, get that executive buy in. Four, put together your your IM team and it should be a cross functional kind of core team. Not everybody a core team. Make sure you're picking the right technologies. Number six, think about what your deployment is going to look like, whether it's phased, some sort of implementation plan. How are you going to make this thing digestible for the organization?
Don't forget about the user experience. Make sure that that's a priority. Think about your governance and your policies and your standards and your measurements and how you're going to monitor all that and then stay current and communicate this sort of like weaved kind of threw out there. So but it's 10 if we don't count communicate because you should be doing that the whole time. So that's the kind of sum it up. You know, I didn't really think
of a lighter note question. You got any ideas? Have you done? Anything. What was your last trip? My last work trip was DC. You were there. I mean, we were in DCI think before that. Or was I? You know, someone said to me the other day, it was like, you know, you travel a lot, but you don't remember where you've been. And I feel like that's where I'm at. I guess my last personal trip was that trip I took to Texas for my friend's 50th surprise birthday party, which was a lot of fun.
And that was good times. You know, that was it was a great time to reconnect with some folks I hadn't seen in a long time. And it was great to just kind of, you know, do a nice thing for somebody who, you know, as a friend of mine and, and kind of bring joy to their life. And I think more people should do that. What about you? What's the last personal trip you've taken? Personal trip I've I'm in
Austin, TX right now. One thing I've noticed is like everybody I talk to is like it's great here. They love living here. It's too hot. I mean, it, it's mid-september and it went up to 100° today. So I'm assuming that's too high. I can't do that, way too high. But everybody seems to love it. But everybody complaints about how expensive it is to live here. And I think that's the thing. It's like if some place becomes awesome to live, other people find out about it and everybody
wants to live there. They jacked up the real estate cost and then you can't afford to live here anymore. So I don't think many people who live here, like living here, are planning to sell their homes and move to a new house anytime soon. They're they're kind of stuck until 20 forever. Well, that's a real positive story, so thanks for that. Well, no, I mean it's supposed to be lighter. Come on man. It's a cool city, people. Love, it's a cool.
City and the only downside is the cost of rules leader thing and the heat. Yeah, well, I just read the other day, you know, I'm in the Asheville, NC area and we're no longer the most expensive place to rent in for the state. That honor now goes to Charlotte. So Asheville has typically been one of the more expensive places because it's a very desirable location, very touristy and the weather is great pretty much year round. But now we're #2 and that's, I think that's a good thing.
So I'm I'm happy about that. Yeah, that's really good sign. All right, Jeff, we do against the hours to be like a 15 minute episode, but no advice. Yeah, we try, We try, but we just talk and talk and talk and we have so many Nuggets of wisdom that we want to share with people. So hopefully people get it and understand it and they're able to put up with our our weird delays with, you know, cell phone connections and and bad hotel Wi-Fi. But I think it was good episodes.
I've got a challenge. Yeah. We've been recording this long. If anybody is still listening, comment on Jeff's YouTube or I'm sorry, LinkedIn post about this episode and say where you were on your last trip. That'll be interesting. That way we'll know where our last five minute Drew is. Yeah, on LinkedIn or on the YouTube video, either one's fine. Yeah, give us a like and subscribe wherever you're listening. idacpodcast.com is our website, idacpodcast.tv.
We'll take you to our YouTube channel and yeah, connect us to LinkedIn. If you were listening this long, thank you very much. Tell us your last personal place, personal travel, not business travel that you went on. And yeah, we'll keep the conversation going. So with that, we'll leave it for this week. Thanks everyone for watching or listening and we'll talk with you all in the next one. You've been listening to Identity at the Center.
We hope you've enjoyed the show. Make sure to like, rate and review, and we'll be back soon. But in the meantime, hit the website at identity@thecenter.com. See you next time on Identity at the Center.