Identity and Access Management
Book
MidPoint
- Quick Start Guide
- Compliance
  - ENISA baseline security requirements
  - ISO 27001
    - 5.1
    - 5.2
    - 5.3
    - 5.4
    - 5.5
    - 5.6
    - 5.7
    - 5.8
    - 5.9
    - 5.10
    - 5.11
    - 5.12
    - 5.13
    - 5.14
    - 5.15
    - 5.16
    - 5.17
    - 5.18
    - 5.19
    - 5.20
    - 5.21
    - 5.22
    - 5.23
    - 5.24
    - 5.25
    - 5.26
    - 5.27
    - 5.28
    - 5.29
    - 5.30
    - 5.31
    - 5.32
    - 5.33
    - 5.34
    - 5.35
    - 5.36
    - 5.37
    - 6.1
    - 6.2
    - 6.3
    - 6.4
    - 6.5
    - 6.6
    - 6.7
    - 6.8
    - 7.1
    - 7.2
    - 7.3
    - 7.4
    - 7.5
    - 7.6
    - 7.7
    - 7.8
    - 7.9
    - 7.10
    - 7.11
    - 7.12
    - 7.13
    - 7.14
    - 8.1
    - 8.2
    - 8.3
    - 8.4
    - 8.5
    - 8.6
    - 8.7
    - 8.8
    - 8.9
    - 8.10
    - 8.11
    - 8.12
    - 8.13
    - 8.14
    - 8.15
    - 8.16
    - 8.17
    - 8.18
    - 8.19
    - 8.20
    - 8.21
    - 8.22
    - 8.23
    - 8.24
    - 8.25
    - 8.26
    - 8.27
    - 8.28
    - 8.29
    - 8.30
    - 8.31
    - 8.32
    - 8.33
    - 8.34
  - NIS 2
- Installation
- Releases
- Roadmap
- Features
- Architecture
- Security
- Guides
- Developer Zone
- Exercises
- Live Demo
- Operations Manual
- Configuration reference
- MidPrivacy
- MidScale
- MidPoint Studio
- Methodology
- Projects
- Tools
- Versioning
- History
Identity Connectors
Support
Trainings
Why Evolveum?
Community
Library
Case Studies
Talks
Glossary
Frequently Asked Questions
About

ISO/IEC 27001 Control 8.32: Change management

Control

Changes to information processing facilities and information systems should be subject to change management procedures.

Necessity of MidPoint

MidPoint is optional for implementation of this control.

Implementation of this control without midPoint is feasible. However, midPoint provides considerable advantages for implementation of this control, making the implementation more efficient and reliable.

Implementation Overview

MidPoint has numerous features that take part in management of identity-related changes.

Implementation Details

Management of identity-related changes is one of the primary functionalities of identity governance and administration (IGA) platforms, such as midPoint. Naturally, midPoint provides numerous features to support change management procedures. Object lifecycle can be used to introduce new roles and policies in a gradual and safe manner, as well as decommission them. New policies (policy rules) can be applied gradually, only reporting policy violations at first, transitioning to full enforcement later when the violations are addressed. Organizational structure mechanism, together with automation provided by policy-driven role-based access control (PD-RBAC) provides controlled changes of privileges and entitlements even in large-scale re-organizations. Policy rules can be used to automatically detect and mark policy violations after a big change, providing opportunity to gradually address them. Simulation capability can be used to predict the effect of changes in roles, access control policies and configurations, avoiding unintended impact of the change before it happens. Synchronization capability of midPoint can detect policy violations that were caused by a change in external systems. Correlation mechanisms and synchronization reactions can automatically correct such policy violations, which may be necessary for large-scale changes. Violations that cannot be handled automatically can be marked for subsequent manual review. Orphaned account management can detect unmanaged accounts created by the change. MidPoint can provide assistance in fall-back scenarios, e.g. rolling back bulk changes in access control or quickly providing access to fallback systems. Audit trail and metadata maintained by midPoint provide an essential record of changes related to identity data and access control.

Implementation Notes

Integration of new applications with IAM frameworks is a common requirement and practice. It is also a common practice to enroll definitions of application roles into identity governance platform as part of the application commissioning process.
MidPoint provides change control with regard to identity management, policies and governance. It cannot provide general-purpose change management covering all aspects of an organization.

Rationale

MidPoint provides essential features to support change management for data related to identities and access control. Even though change management applies to a much broader area than identity and access control, the identity-related part is crucial for maintaining appropriate levels of cybersecurity.

Was this page helpful?

YES NO

Thanks for your feedback