1 Risk Challenges

2 Foundations

3 Risk Practices

4 Results

Managing risk is a complex and never-ending endeavor, under the best of situations. As global events and business processes are rapidly changing how we conduct business, organizations are re-evaluating their current risk posture to accommodate a more fluid and dynamic workforce. As a first step towards better understanding your organizations current risk status, RSA invites you to assess your current risk level using our Identity and Access Management Risk Intelligence Index calculator.

In just 10 minutes, you can measure the maturity and effectiveness of your current identity & compliance risk management practices. The organization's processes are measured based on what is being performed today, and the scale and coverage model of those practices. Organizations can use this index as a benchmark when evaluating their overall risk strategy.

For a more detailed analysis of your processes and practices, contact RSA.

Start

Identity and Access Management Risk Intelligence Index

Risk Challenges

This series of questions highlight the different factors to consider when evaluating your organization’s overall challenge in implementing effective and broad risk management practices.

Compliance Environment Complexity and velocity of regulatory and/or industry obligations, number of audited resident-security-systems, frequency of audit, regulatory change, number of managed entitlements and managed users

Minimal
Moderate
Somewhat Complex
Complex
Highly Complex

Geographic Distribution Physical and logical locations of managed / protected data (including supply chain, service providers, business partners, and internal / external user data stores).

Single Location
Multiple Locations within single area
Multiple Areas
Multiple Countries
Large international footprint

Complexity of Business Business model and strategy, breadth of users and services, industry standards / controls, complexity of regulated access policies / controls, extent of external user communities, customer based ease-of-use expectations, etc.

Simple
Moderate
Somewhat Complex
Complex
Highly Complex

Size of Organization Number of users with access (employees, contractors, partners, customers, auditors), financial, physical presence, logical presence, managed entitlements / sensitive data / IP repositories

1 - 2500
2501 - 10,000
10,001 - 100,000
over 100,000

Technology Profile Complexity of IT infrastructure, usage of cloud/third party providers, outsourced IT infrastructure

Minimal
Moderate
Somewhat Complex
Complex
Highly Complex

Remote User Workforce Population size with remote access requirements - including; Direct employees, contractors, partners, service providers, etc.

1 - 2500
2501 - 10,000
10,001 - 100,000
over 100,000

Identity and Access Management Risk Intelligence Index

Risk Practices

For the questions below, use the selections listed on the right to rate your Effectiveness and Organizational Coverage.
Effectiveness refers to the maturity of the process related to the questions. Organization Coverage refers to the level of adoption across organizational boundaries.

Effectiveness

Organizational Coverage

Operational Risk Management

How well does your organization have visibility into and understand its access controls and responsibilities for people, information, processes and technologies, their interrelationships, and when those criteria change?

Effectiveness

Organizational Coverage

How well does your organization monitor and report on operational access and provisioning related risks?

Effectiveness

Organizational Coverage

Regulatory and Corporate Compliance

How well does your organization understand and fulfill compliance obligations?

Effectiveness

Organizational Coverage

How well is compliance to corporate policies and standards measured, managed and reported?

Effectiveness

Organizational Coverage

IT Security Risk Management

How well does your security function have visibility into data-assets, access privileges, and understand the identity-context business usage of IT assets?

Effectiveness

Organizational Coverage

How well are security deficiencies including access vulnerabilities identified, reported and remediated?

Effectiveness

Organizational Coverage

How well are IT / Identity attacks detected and resolved?

Effectiveness

Organizational Coverage

Third Party Governance

How well does your organization identify and assess third party identity and access risk and performance?

Effectiveness

Organizational Coverage

How well does your organization engage affected stakeholders in risk-based third party identity approval and risk mitigation?

Effectiveness

Organizational Coverage

How well does your organization monitor and report on third party risk and performance?

Effectiveness

Organizational Coverage

Audit Management

How well does the internal audit organization understand the universe of identities, entitlements, access-lifecycles?

Effectiveness

Organizational Coverage

How comprehensive and dynamic is the audit organization’s identity-based audit planning process?

Effectiveness

Organizational Coverage

How well does the audit organization execute their audit engagements and manage audit findings?

Effectiveness

Organizational Coverage

Contact RSA

Risk Challenge

Minimal

Moderate

Significant

Serious

Overall Risk Intelligence Index

The Risk Intelligence Index is a measurement of the current Identity and Access risk management practices. The Index is segmented into four quadrants based on Results and Reach. Learn more about reading this chart.

Domain Risk Intelligence Indices

Foundation
Operational Risk Management
Regulatory & Corporate Compliance
IT Security Risk
Third Party Governance
Audit Management

Domain Coverage

Foundations

The Foundation score (max 20) is an indicator of common elements necessary for a sustainable risk management strategy and program. Management commitment, culture, clear goals and expectations and overall organizational accountability is necessary for an organization to mature for any enterprise program. Risk Management requires the discipline within the organization to take responsibility for identifying, understanding and managing risks. These Foundations are an indicator of the level of dedication to improving risk management practices.

Capabilities Risk Intelligence Indices

Capabilities

Operational Risk
Regulatory & Corporate Compliance
IT Security Risk
Third Party Governance
Audit Management

An enterprise Risk Management program involves many different elements. RSA Governance & Lifecycle Risk Intelligence model is comprised of six major Domains. Each Domain includes multiple capabilities needed to effectively manage risk. This report includes each Capability and the results of the questions on the Risk Practices worksheet representing the capabilities. Scores are calculated using the average of the answers provided.

Contact RSA Save as PDF Start Over

RSA Identity Governance & Lifecycle provides full access visibility to detect identify risks.

Learn more

See RSA Identity Governance & Lifecycle in action!

Request a Demo

Want to learn more?

Fill out the form and an RSA expert will contact you soon.

RSA Security LLC (“RSA”) provides the Identity and Access Management Risk Intelligence Index ("Tool”) as a free tool to help potential customers analyze potential Identity-related practices / activities / disciplines that could benefit from RSA's Identity Governance and Lifecycle solutions. The estimates provided by the Tool are provided to help a potential customer determine whether it desires to further investigate options with RSA. THE TOOL ONLY PROVIDES ESTIMATES. SUCH ESTIMATES ARE NOT A GUARANTEE OF SAVINGS. SUCH ESTIMATES ARE NOT A GUARANTEE OF ANY PRICING DISCOUNTS AND IN NO EVENT WILL ANY REFUND BE GIVEN IN CONNECTION WITH AN ESTIMATE OR THIS TOOL.. A NUMBER OF OTHER FACTORS MAY AFFECT ACTUAL SAVINGS, AND ACTUAL SAVINGS MAY DIFFER. Please carefully read all of the terms of this Disclaimer. By viewing and utilizing this Tool, you acknowledge that you have read, agreed to, and understand this Disclaimer.

RSA PROVIDES THE TOOL "AS IS" AND WITH ALL FAULTS, AND MAKES NO EXPRESS WARRANTIES WRITTEN OR ORAL REGARDING THE TOOL, AND HEREBY SPECIFICALLY DISCLAIMS ALL WARRANTIES AND CONDITIONS, EITHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING BUT NOT LIMITED TO ANY IMPLIED WARRANTIES OR CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, QUIET ENJOYMENT, OR NON-INFRINGEMENT, AND ANY WARRANTY ARISING BY STATUTE, OPERATION OF LAW, COURSE OF DEALING OR PERFORMANCE, OR USAGE OF TRADE.

IN NO EVENT SHALL RSA BE LIABLE FOR ANY DAMAGES, INCLUDING CONSEQUENTIAL, INCIDENTAL, DIRECT, INDIRECT, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES ARISING OUT OF OR IN ANY WAY RELATED TO THE USE OF OR INABILITY TO USE THE TOOL, WHETHER BASED ON CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY OR OTHERWISE, EVEN IF RSA HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THIS EXCLUSION OF DAMAGES SHALL BE EFFECTIVE EVEN IF ANY REMEDY FAILS ITS ESSENTIAL PURPOSE.

The Tool is provided at no charge. RSA has included in this Disclaimer terms that disclaim all warranties and liability for the Tool. To the full extent allowed by law, YOU HEREBY RELEASE RSA FROM ANY AND ALL LIABILITY ARISING FROM OR RELATED TO THE TOOL OR ITS USE. No refund will be made because the Tool was provided at no charge.

The laws of the State of Massachusetts, USA will apply to this Disclaimer.