A Strategic Model for Compliance-First IAM

In today’s digitally interconnected world, compliance is the foundation on which organizations build an effective security program. Global regulations and laws are continuously evolving, requiring organizations to take diligent measures to safeguard their systems. An integrated approach is necessary to streamline efforts, enhance security, and increase the overall effectiveness of an enterprise’s cybersecurity and compliance posture.

Identity and access management (IAM) is at the center of many major compliance frameworks. A critical enabler of organizational security, IAM helps organizations manage who can access what resources, when, and under what conditions. There are several components to designing a compliance-first IAM model that will help enterprises enhance their security posture and ultimately achieve compliance. Such a model can evolve to meet risk posed by emerging technologies such as quantum computing.

Regulatory Compliance and IAM Requirements

By managing digital identities and access rights, IAM serves as a linchpin for meeting the legal and operational requirements of multiple regulatory frameworks, such as the EU General Data Protection Regulation (GDPR), the US State of California Consumer Privacy Act/California Privacy Rights Act (CCPA/CPRA), the US Health Insurance Portability and Accountability Act (HIPAA), the US Sarbanes–Oxley (SOX) Act, and the Payment Card Industry Data Security Standard (PCI DSS).¹

Figure 1 lists the various access management requirements set forth by these regulations.

FIGURE 1–Regulatory IAM Requirements

Designing a Compliance-First IAM Solution

An IAM architecture designed with compliance as a central focus will align with regulatory requirements and enable organizations to achieve their security and various other operational goals. An IAM-centric architecture integrates various IAM components to help organizations remain agile, secure, and compliant while also ensuring efficient access management.

To achieve compliance objectives, bolster organizational security, and improve consumer trust, a compliance-first IAM solution must be built upon six key components.

Centralized Identity Provider
Identity providers (IdPs) are responsible for managing identities within an organization and sharing identity details with various service providers, thereby enabling single sign-on (SSO).² Organizations must ensure that all identities (human and non-human) are accounted for so that users can be properly authenticated and any activity within the organization can be traced back to a single valid identity. This is also an important requirement under HIPAA, SOX, and PCI DSS.

Organizations may use multiple IdPs, such as Active Directory (AD) and Google, to support different user types. This results in challenges as service providers must develop trust with multiple IdPs.³ Furthermore, organizational policies such as MFA may be managed across disparate IdPs, potentially leading to inconsistent user experience and additional maintenance costs. In these scenarios, a proxy IdP should be implemented, and service providers should only trust the proxy IdP while it works with other IdPs to verify an identity. MFA policies can be maintained by the proxy IdP, granting easier administration and better scalability.

A centralized IdP is crucial for the identity management aspects of IAM. From a compliance perspective, it enables the consolidation of identities, reducing the risk of identity sprawl and ensuring that all actions and access associated with an identity can be traced back appropriately in an audit-friendly manner.

Federation
Federation allows organizations to establish trusted relationships by enabling users to securely access resources across different domains or a circle of trust (CoT) without needing to create separate identities for each system. A CoT represents a defined boundary where participating entities agree on certain rules related to identity verification and access. This foundational trust mechanism allows an identity authenticated in their home CoT to access resources in their partner CoT, eliminating the need to create duplicate identities. Federation is widely used today in:⁴

• Mergers and acquisitions
• National research and education networks (NRENs)
• Cross-organizational collaboration
• Financial services

Federation enables SSO by allowing organizations to establish trusted relationships with external partners. This leads to a better user experience and enhanced security, as password usage is minimized. It also allows auto-provisioning of user access across multiple organizations, thereby reducing maintenance costs and leading to improved operational efficiency.

Apart from these benefits, federation is a prime enabler in achieving compliance with various regulations. It facilitates secure cross-border access to data without duplicating identities, as required by GDPR and CCPA. Moreover, through federated identity protocols such as Security Assertion Markup Language (SAML) or OpenID Connect (OIDC), organizations can retain control over personal data and ensure that data is not stored unnecessarily, thereby achieving compliance with data minimization requirements (including those of GDPR). It also supports auditing of cross-domain access and action, which is another critical requirement under the mentioned regulations. Finally, federation is highly effective for HIPAA compliance, allowing hospitals to share patient details across networks per users’ consent and enabling patients to utilize SSO across various portals.

Contextual Authentication
MFA refers to the process of using two or more authentication criteria in any combination. Authentication usually consists of three forms of credentials: these include “what you know” (e.g., a password), “what you have” (e.g., a smart card), and “who you are” (e.g., represented by a fingerprint).⁵ MFA undoubtedly increases security; however, it also comes with high implementation costs and often leads to a lower-quality user experience. This is where contextual authentication comes into play.

Contextual authentication involves evaluating passive factors, such as user location, time, the user’s job profile, and the device being used, as part of the authentication request. If the authentication system determines that the operation deviates from the baseline pattern, it will prompt the user to authenticate using MFA. With contextual authentication, an additional layer of authentication, such as providing a personal identification number (PIN), may be required depending on the context associated with the authentication request.⁶

Contextual authentication is scalable as it does not rely on static configuration, provides better security, and reduces MFA prompts by up to 68%.⁷ Regarding compliance, contextual authentication also satisfies the authentication requirements of regulations such as PCI DSS, SOX, GDPR, and HIPAA.

Access Control Models
Once a user has been authenticated using the described components, the authorization process must begin. This process determines the actions an authenticated identity is allowed to perform. In the past, access control lists (ACLs) were used to determine the read, write, or execute access an identity could have to a resource; however, developing and maintaining these ACLs has proven daunting.⁸ In today's modern business context, the most widely used access control models among organizations are RBAC, ABAC, and policy-based access control (PBAC).

RBAC is used most often in organizations where permissions are resourced within a bundle known as a role, and that role is assigned to identities. RBAC lends itself well to the principle of least privilege and SoD and has been widely successful in achieving access control objectives, especially in small to medium-sized enterprises (SMEs).⁹ However, in large organizations, it can often lead to problems such as role explosions (where the number of roles grows uncontrollably, leading to higher maintenance and administration costs) and role-permission explosions (where users accumulate more permissions than they truly need).¹⁰ ABAC, on the other hand, relies on user, resource, and context attributes such as the user’s department, role, time of day, and sensitivity of the type of resource. ABAC rules are configured within the context of resources and provide more flexibility compared to RBAC; however, these policies allow for very fine-grained access control, which often leads to higher administrative and compliance efforts.¹¹ PBAC is the most advanced of the three. It enables organizations to manage access control policies centrally, offering improved scalability. The challenge for compliance teams lies in creating and maintaining policies that provide access in compliance with the organization's least privilege policies.

Regarding compliance, access control mechanisms such as PBAC and ABAC enable fine-grained contextual access to data and applications, thereby enabling compliance with least privilege and need-to-know requirements. Due to the dynamic nature of PBAC and ABAC, they provide the flexibility to adapt to changing business and regulatory requirements.

Identity Governance and Administration
Irrespective of the access control model, three basic principles in identity governance and administration (IGA) must be applied to any IAM system:

• The principle of least privilege ensures that users have the minimum access they need to do their tasks, and hence, user access must be revoked when not in use. This means that the user’s access must be reviewed periodically.
• The principle of least knowledge ensures that users only have access to the data necessary to perform their job function.
• Finally, SoD ensures that the steps of a critical operation are not executed by a single identity.¹² These three principles form the foundation of IGA, and organizations must implement security controls and solutions to ensure that all identities comply with these principles.

A typical IGA solution enables end users to request access for their own accounts or system accounts, provides access management with respect to the user life cycle, implements SoD policies, and supports access reviews.¹³ Additionally, IGA is responsible for periodic policy reviews to ensure that policies do not provide more access than a user should have. IGA also prevents role duplication and includes any associated cleanup activities (e.g., consolidation or deletion of redundant roles, the remediation of over-permissioned user accounts, the enforcement of consistent role definition standards).

Most of the mentioned regulations clearly mandate the three principles of IGA. SOX, HIPAA, and GDPR mandate periodic access reviews, while SOX and HIPAA require that SoD policies be enforced. Furthermore, access authorization processes, emergency access processes, and user life cycle management are compliance requirements under HIPAA, SOX, and PCI DSS. A core element of all these requirements is auditability. To this end, IGA solutions are effective in ensuring that access requests, changes, and approvals are documented and auditable, which is essential for regulatory compliance reporting.

Customer Identity and Access Management
Customer identity and access management (CIAM) enables organizations to manage identities across different channels, including mobile and web, with minimal performance degradation. It also bolsters customer trust and loyalty by managing privacy and accounting for various user preferences.

In recent years, the number of applications and services available to customers has increased significantly. Organizations have attempted to treat customers as internal identities in the past; however, that approach has not been successful.¹⁴ Customer identities are often larger than internal identities, and customers prefer easy self-service flows to interact with services (e.g., having a social media-based SSO for various portals and uncluttered interface screens to manage user preferences). This is where having a solid CIAM strategy is essential.

Integrating privacy by design into IAM is no longer a choice, as it has been mandated in regulations such as the GDPR and CCPA. These regulations require organizations to obtain and manage user consent for processing personal data. CIAM not only satisfies the requirements of these regulations by implementing solutions such as consent management, but also enables organizations to achieve digital business transformation, addresses various security threats, encourages adoption of Internet of Things (IoT), facilitates the development of mobile apps, and aids organizational leadership in navigating through partnerships and acquisitions.¹⁵

Figure 2 highlights how IAM requirements can be met through the implementation of IAM design components.

FIGURE 2–IAM Requirements Mapped to Design Components

Preparing for Quantum Risk

The outlined model aligns with the compliance and business requirements of today and prepares organizations for future risk, including the impending technological disruption posed by quantum computing. Quantum computing presents a threat to the traditional model of encryption-based security, therefore, identity and access governance are increasingly vital as a defense mechanism. Continuous monitoring of access ensures that identity risk is detected and addressed immediately, thereby reducing the need for potentially compromised encryption protection. An IAM posture review, aligned with identified risk, prioritizes high-value, high-impact accesses for closer monitoring, thereby focusing improvements where they are most needed within the identity and access management landscape. Decisions made with an awareness of business context ensure that while quantum threats may evolve beyond traditional security capabilities, decisions regarding access permissions are strictly enforced, reducing unnecessary exposure. Back-end technologies, such as identity analytics, just-in-time access, and policy-enforced controls, provide further resiliency through the dynamic enforcement of least privilege and the real-time detection of access anomalies. By implementing these methods, organizations can create a quantum-resilient foundation for assurance of access, which is not based solely on encryption, but on building trust through continuous verification, intelligent risk management, and foundational security controls.

Quantum computing will also redefine compliance expectations. As quantum risk becomes a reality, audit and regulatory guidelines will change, requiring organizations to implement quantum-resistant controls in areas including encryption, certificate management, risk assessments, and long-term data protection. Including quantum resilience as part of identity governance secures current compliance and empowers organizations to handle the next generation of regulation and operational imperatives.

Conclusion

The model presented offers a holistic solution for identity and access governance and includes six key components: centralized IdPs, federation, contextual authentication, access control models, IGA, and CIAM. Each of these components plays a significant role in enabling organizations to meet today's compliance requirements and in accurately forecasting future threats. The focus on continuous monitoring, risk-based recertification of access, and dynamic policy enforcement creates a flexible security posture that adapts as the threat landscape changes. By aligning these components with business needs, organizations can enhance identity assurance processes, safeguard sensitive data, and provide the foundation for a future-proof security posture amid expanding digital complexity.

Endnotes

¹ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation [GDPR]); California Department of Justice Office of the Attorney General, California Consumer Privacy Act (CCPA), USA, 2024; U.S. Department of Health and Human Services, “The Security Rule,” USA, 2025; Sarbanes- Oxley-Act.com, “The Sarbanes-Oxley Act”; PCI Security Standards Council, PCI DSS: v4.0.1
² Ferdous, M.S.; Poet, R.; “Dynamic Identity Federation Using Security Assertion Markup Language,” in: Fischer-Hübner, S.; de Leeuw, E.; et al. (eds); Policies and Research in Identity Management, IDMAN 2013, IFIP Advances in Information and Communication Technology, vol. 396, 2013, Springer, Berlin
³ Pöhn, D.; Hommel, W.; “An Overview of Limitations and Approaches in Identity Management,” Ares, 2020, p. 1-10
⁴ Pöhn; Hommel; “An Overview of Limitations”
⁵ Thakur, M.A.; Gaikwad, R.; "User Identity and Access Management Trends in IT Infrastructure–An Overview," Proceedings of the International Conference on Pervasive Computing, 2015, p. 1-4
⁶ Hayashi, E.; Das, S.; et al.; “Context-Aware Scalable Authentication,” SOUPS '13: Proceedings of the Ninth Symposium on Usable Privacy and Security, iss. 3, 2013, p. 1-10
⁷ Hayashi; Das; et al.; “Context-Aware Scalable Authentication”
⁸ Glöckler, J.; Sedlmeir, J.; et al.; "A Systematic Review of Identity and Access Management Requirements in Enterprises and Potential Contributions of Self-Sovereign Identity," Business and Information Systems Engineering, vol. 66, 2024, p. 421–440
⁹ Uddin, M.; Islam, S.; et al.; "A Dynamic Access Control Model Using Authorizing Workflow and Task-Role-Based Access Control," IEEE Access, vol. 7, 2019, p. 166676–166689
¹⁰ Rajpoot, Q.M.; Jensen, C.D.; et al.; "Integrating Attributes into Role-Based Access Control," Proceedings of the IFIP Annual Conference on Data and Applications Security and Privacy, 2015, p. 242-249
¹¹ Uddin; Islam; et al.; "A Dynamic Access Control Model"
¹² Glöckler; Sedlmeir; et al.; "A Systematic Review of Identity"
¹³ Singh, C.; Thakkar, R.; et al.; "IAM Identity Access Management—Importance in Maintaining Security Systems within Organizations," European Journal of Engineering and Technology Research, vol. 8, iss. 4, 2023, p. 30–38
¹⁴ Liveretos, A.; Draganov, I.; "Customer Identity and Access Management (CIAM): An Overview of the Main Technology Vendors," International Journal of Economics and Management Systems, vol. 7, 2022
¹⁵ Rasouli, H.; Valmohammadi, C.; "Proposing a Conceptual Framework for Customer Identity and Access Management," Global Knowledge, Memory and Communication, vol. 69, iss. 12, 2019

VATSAL GUPTA

Is a cybersecurity leader with 13 years of experience in identity and access management (IAM). He currently works at Apple and has previously held roles at Meta and Pricewaterhouse Coopers (PwC), advising Fortune 100 companies on securing complex digital ecosystems. Gupta specializes in building scalable, artificial intelligence (AI)-driven identity solutions. He is an active contributor to IDPro and a senior member of the Institute of Electrical and Electronics Engineers (IEEE), and he also serves on technical committees for leading cybersecurity conferences. His research focuses on AI, large language models (LLMs), and policy-based access controls (PBAC) to modernize IAM and enhance threat detection.