###### Abstract  
Identity management ensures that users have appropriate access to resources, such as ICT services and data. Thereby, identity management does not only identify, authenticate, and authorize individuals, but also the hardware devices and software applications which the users need for access. In consequence, identity management is an important element of information security management (ISM) and data governance. As ICT infrastructures are constantly changing, and new threats emerge, identity management has to be continuously improved, just like any other business process. In order to align the identity management process with business requirements, and provide a systematic approach supported by reporting and supporting visualizations, we apply Sherwood Applied Business Security Architecture (SABSA) and Visualization for Security (Vis4 Sec) together in our approach, IdMSecMan (identity management security management). We first introduce IdMSecMan, before applying it to the central technical process activities of identification, authentication, and authorization. Our approach is underlined by a case study. Thereby, we, for example, see that enabling multi-factor authentication in organizations impacts other areas that may be overlooked without a structured approach. With IdMSecMan, we provide a process framework to align all decisions and to constantly improve identity management within organizations and inter-organizational collaborations. d 2023 13 2023 11 202  
applying Time-based One-Time Passwords (TOTPs), enabling MFA for a single service which may require only a simple click for a system administrator, there are several more aspects to consider. The complexity of this task makes it difficult for security practitioners to enroll and improve MFA. Security standards and frameworks are either too broad or too narrow for this topic, while enterprise architecture frameworks have the drawback of often not sufficiently covering security aspects. This is also true for several research approaches. In addition, MFA is only one of many aspects of identity management (IdM) related to the central technical processes of identification, authentication, and authorization used in every organization. As a structured solution, we propose IdMSecMan, a security management process tailored for IdM. The process cycles are based on Visualization for Security (Vis4 Sec) [3] and the Sherwood Applied Business Security Architecture (SABSA) [4; 5], which, in combination, help to measure and continuously improve the maturity of the identity management activities aligned to business requirements. Thereby, IdMSecMan brings together business management and security, enabling the controlled introduction and improvement of authentication methods, as one example. This article enhances our previous work [6] in several ways. Whereas the first version of IdMSecMan concentrated on identities in servers, our latest results widen the area to identity management with the central technical process activities of identification, authentication, and authorization in general. We especially focus on important examples, such as MFA. In addition, SABSA was integrated to align the security improvements with the business processes and requirements. In consequence, every aspect from top to bottom is considered. Thereby, we provide the following _contributions_: (1) a framework for improving the security of identity management and its aspects, in alignment with business management, with a visual overview; (2) adaption for the introduction of national electronic identities (elDs), MFA, and risk-based authentication (RBA) in respect to zero trust architecture (ZTA); (3) an evaluation based on a case study. The case study features the computer science (CS) department at a university with different user groups, projects, and resources (central and decentral). The remainder of this article is organized as follows. We start with a motivating scenario in Section 2. In Section 3, we briefly describe the background and related work.