Consumer Identity & Access Management: Stakeholder Analysis
By: Ciam Design
Tags: Marketing, Identity, Consumer, Identity Management, Digital Transformation

The following is an excerpt from chapter 5 of Consumer Identity & Access Management: Design Fundamentals, ETA January 2021.

Stakeholder Analysis

The business objectives mapping, is likely to help reveal who the main interested parties in the CIAM project are likely to be. In most organisations, depending on structure, is likely to include the CMO (chief marketing officer), the CISO (chief information security officer), CIO (chief information officer) and a representative from the identity community — likely an architect or product services owner.

Under those four pillars, are likely to be sub teams and personnel who will have specific objectives surrounding concepts such as customer or user happiness, retention, call centre contact reduction and so on.

Let us analyse some basic examples of what each of the four pillar leaders will be looking for with regards to their input into the design phase.

CMO

The CMO is going to be focused on the initial user onboarding and acquisition phase of the CIAM lifecycle. Questions they are likely to want answered will be aimed at the registration process — how that can be customized to attract users from particular demographics, age groups, personas and the like. The registration process is a subtle step and requirements for concepts such as theming, branding and multi-device usage will be likely. It is important to dig deep into understanding who the CMO is aiming the registration process at and what usability requirements will be acceptable to particular personas. Security requirements may also be questioned heavily in the CMO discussions, mainly as concepts such as MFA could be seen as being restrictive or complicated and acting as conceptual barriers to service adoption and sign on.

CIO

The CIO is likely focused on the main infrastructure and operational aspects of deployment. Expect to discuss requirements centered around the location of new services and infrastructure — will they be cloud located, data centered located and managed by internal or external teams? The level of customisation versus commercial software will also be a keen topic, as will items focused on future-proofing and road mapping considerations. That in turn will generate demands to understand the existing level of support and engineering capabilities — will new skills, hires or consultants be needed to implement and support any future CIAM components? Understanding what metrics the CIO will be measured against is important of course, and may well touch on areas such as the time to roll out new services, outage and availability statistics and the utilisation of existing specialist personnel and developers.

CISO

The CISO and CIO will be closely related, with the former being more focused on the general security and privacy requirements of the new provisioned service.

An immediate focus for the CISO will be the compliance requirements any CIAM system could generate. We have touched upon the likes of the GDPR and CCPA, but other local requirements may also exist. Will this generate the need for new practices and personnel? The collection of consumer data should clearly be minimised and the CISO will be focused on understanding which pieces of data are required and for what purpose. Detailed data pipelines will need creating, outline the location and service processors that will act upon collected information. Basic service functions such as allowing end user editing and removal of collected data will also need to be designed with input from the CISO lead community.

Identity Architect

The identity team will be focused on automating as many of the identity related data flows as possible, using either commercial of custom solutions. Service descriptions for components such as MFA, authorization, end user profiling and application onboarding will be of interest to the identity team. Identifier discussions — such as whether to use usernames, globally unique identifiers or email addresses — will be paramount and how data from other systems will be linked together. The identity team is also going to be in pole position to own policy and control material centered around password complexity, device hygiene analysis, lock out policies, reset policies and notification and auditing.