Solid ROI Metrics Support Case for PIAM

• By Don Campbell
• Jun 03, 2016

ROI metrics, both tangible and intangible, are commonly used throughout organizations to justify the need for new expenditures or support for an existing program. More recently they have become increasingly important in organizations’ security divisions as those departments transition from cost centers to revenue centers. While conventional technologies such as video surveillance and even video management systems can be more easily valued, newer technologies such as Physical Identity and Access Management (PIAM) may have fewer case precedents to rely on but are no less critical for improving security’s effectiveness.

By definition, PIAM is an end-to-end solution that manages identities, compliance and events across disparate physical security systems. PIAM software allows the creation of a single identity for each individual across all physical security systems throughout the organization. It automates key processes and simplifies control of employees, visitors, vendors and other third-party identities to ensure each has the appropriate access only to the correct areas and for the right length of time. In the access control space, PIAM takes risk management and mitigation far beyond the capabilities of traditional access control systems.

Operational metrics designed to illustrate the value of, and support fo, a PIAM solution can be divided among three main categories – security, business value and best practices. Each stands on its own as a solid ROI metric but when combined, the three offer an inarguable case for adoption.

Security

PIAM is designed to manage identities as opposed to simply managing access. With that, organizations can take a more intelligent approach to security from the perspective of understanding who should and should not be authorized to enter specific areas and applying analytics to the related access data. For example, if an individual whose work hours have remained constant suddenly starts accessing a facility late at night or very early in the morning, the PIAM solution will detect that anomalous behavior and analyze it within a larger context using data from other systems. At the same time, the system alerts appropriate staff for investigation. The change in behavior may be innocuous, such as a special project that requires the employee to be on-site at odd hours, or it may indicate potentially malicious activity, including insider theft.

Where traditional systems can generate alarms to alert security staff of incidents in progress, PIAM solutions go much further. Information from thousands of endpoints such as door readers, access points, alarms and related personnel as well as data from other integrated security systems can be collected and analyzed within the PIAM solution to assess organizational risk and potentially prevent incidents before they can occur. This capability significantly enhances the effectiveness of security operations.

Business Value

Technology exists to add value to an organization, either by increasing revenue or decreasing costs; PIAM solutions have been designed to do both. In addition to risk identification which can help eliminate vulnerabilities and loss, PIAM with predictive analysis has the potential to deliver significant business benefits, including increased efficiency and agility, better business alignment and improved reliability. First, the automation of tedious onboarding processes immediately drives down personnel costs while improving efficiencies and reducing the risk of costly errors. Beyond this, the analyzed data can help improve resource management, boost employee productivity, optimize staffing levels, improve service levels to the organization and even ensure compliance with company policy and industry or government regulations. Each of these factors contributes cost savings and a clear business value.

For some organizations, the option of setting up their PIAM as a cloud-based solution offers substantial cost savings by eliminating the need for their IT staff to deploy and implement on-site systems. In the SMB (small and medium sized business) market, this option creates new opportunities for PIAM by offering identity management as a service rather than an on-premise application. The software as a service model also provides users with the flexibility of “pay as you go” pricing, which can be an attractive option for organizations to avoid high upfront costs.

Best Practices

PIAM software systems can streamline time-consuming and inefficient processes, from issuing ID badges to managing databases to assigning access privileges across multiple physical access control systems. Any activity, event or status at any point in the identity lifecycle is reportable and auditable. If a vulnerability is identified, security management can review and take the necessary action to rectify procedures or activities.

In larger/global organizations, management of identity is strategically becoming management by identity as businesses adopt new ways to meet challenges while maintaining adherence to established policies and procedures. 

It has been said that numbers are the language of business. If this is indeed the case, then a well-documented ROI (Return on Investment) profile of a PIAM solution – including realized benefits of security, business value and best practices – can be a powerful management tool to accomplish this task.