Access control is required for most IT assets, and many of the access rules must be managed by nontechnical business users. The work of managing access controls (“access governance”) involves both identity and access management (IAM) and data protection disciplines such as information classification and data governance.
IAM and data governance are vital for reducing breach risk and complying with privacy-related regulations. IAM alone represents three of the control domains from Chapter 6’s list of 20 control domains. IAM is technically complex and highly ...
