Identity and access management: Five steps to securing board approval

1.) Connect the technology to your mission

Your board will want to know ‘why?’

 

Their primary job is ensuring that resources are effectively stewarded in pursuit of the organisation’s mission. To that end, explain how an investment in IAM can support this.

 

Remember, you are in the perfect position to pitch these new processes, because (unlike an external consultant) you are already familiar with your organisation’s values and goals. You understand and value your shared mission.

 

Focus your pitch on this. Identify your board’s objectives. How do these align with your shared mission? Position IAM as a set of tools to help your charity achieve them.

 

For example, do you have a wide base of volunteers? Or perhaps a number of staff working remotely or across multiple devices? IAM solutions like single sign-on and multi-factor authentication reduce friction whilst ensuring the security of sensitive information and vital organisational systems.

 

 

2.) Start small

 

Board members and stakeholders will want to see a demonstrable return on investment. Your pitch will be more effective by proving the efficacy of the concept on a small scale.

 

If appropriate, start by piloting the technology with a team that’s willing to tolerate the change, take a risk, and provide feedback. Think of your pilot like a science experiment: identify the hypotheses to be tested, make a prediction, and record the results.

 

You can also use employee engagement technology to collect qualitative data that will resonate with financial decision-makers. Find out how people within your organisation are working, and whether implementing these processes would increase efficiency. This ensures that any proposals are actionable, benchmarkable and measurable.

 

This attention to detail will pay dividends. You’ll learn a lot and your board is likely to reward your measured approach. Seeing the pilot team up and running will also make securing buy-in from team members an easier proposition when the time comes. Organisational change is a cultural issue. By helping team members to take ownership of this change, you empower them to become digital champions for IAM.

 

 

3.) Have a plan

 

Show stakeholders an action plan of how the outlined benefits will be realised. Provide a detailed timeline of activities with clear milestones.

 

This is an opportunity to manage expectations. Head off any objections by outlining potential pitfalls and showing what will be done to avoid them.

 

Mature vendors will often have resources to help you here. Ask your account manager (if you have one) or do a search for templates and toolkits. Okta’s end-user adoption toolkit is a good example.

 

At this point, it’s important to take a temperature check. You may be faced with a lack of understanding or confidence. Or, if enthusiasm is high, board members may have unrealistically high expectations. Both are important to address.

 

It is crucial to the success of this change that you adopt an iterative approach, and clearly explain that development will happen organically and over time. Tell stakeholders that a process of trial and error is necessary to some extent. Clearly state this will be a necessary part of the process, as it will provide your organisation with valuable lessons, and will help you to tailor your strategy to your own unique needs.

4.) Demonstrate ROI

 

The return on tech investments can be measured in three categories: hard savings, soft savings, and strategic value. Hard savings occur when your new investment enables you to actually save money elsewhere. For example, some organisations are able to retire their VPNs after implementing IAM solutions. These are the simplest examples of ROI to quantify.

 

Soft savings are realised when an investment creates new capacity in your organisation that can be repurposed to other tasks. This may occur, for example, when any manual task becomes automated. You can quantify these “soft savings” by multiplying the cost of people’s time by the amount of time they used to spend on those manual tasks. This kind of ROI doesn’t directly affect your balance sheet, but it’s often just as valuable as financial savings.

 

Consider the strategic value of your investment in identity and access management. A good place to start is with the reduction in the risk of a data breach. How much might that be worth to your organisation? This can be very hard - perhaps impossible - to quantify, but it may end up being the most compelling return on the investment.

 

To see an example of this in practice, take The Norwegian Refugee Council - a humanitarian, non-governmental organisation that works to protect the rights of people affected by displacement. In this webinar, NRC share the results of their efforts to quantify the value of their investment in Okta.

 

Among the benefits the NRC experienced were the following:

 

• 2,235 fewer hours spent on password resets
• 8,940 fewer hours spent locked out of applications
• 26,000+ fewer hours spent responding to MFA prompts
• $324k+ annual cost savings on legacy technology

 

They also identified a number of typical security benefits and savings:

 

• Avoided cost of a security breach
• Reduced cost to handle unexpected patches
• Reduced cost of security administration
• Reduced cost of cybersecurity insurance

 

In the slide pack for the webinar, Okta and the NRC outline a set of questions that help organisations to establish the value that they hope to realise by implementing Identity and Access Management. By working through these questions, you will have the foundations of your pitch.

 

 

 

5.) Preach to the converted

 

Don’t go into the meeting alone.

 

Your enthusiasm will shine through, which will make your pitch all the more convincing. But it will be easier still to win over stakeholders if you make the pitch in tandem with a colleague who has already been convinced of the benefits of IAM.

 

Perhaps a team member has expressed similar concerns or has highlighted how their work can be improved or made more efficient through implementing the technology. Or maybe one of the people from your pilot scheme would be happy to share what they’ve learned. This demonstrates to your board how this new technology can be applied by people within your organisation.

 

Remember, that the ultimate aim of your pitch is to convince stakeholders that your proposal represents what is best for your charity - and that everything you are suggesting is designed to help achieve your common mission. If you’ve done your homework, and gathered data to back up your points, then you will make a compelling case.