An Identity Security Assessment Guide: IAM, IGA and PAM

IAM, IGA and PAM get used interchangeably in vendor marketing, which makes it harder than it should be to figure out what your organisation actually needs. Here's the distinction that matters, and how to assess where you stand on each.

The three terms, actually distinguished

IAM (Identity and Access Management) is the umbrella: authenticating users and controlling what they can access. SSO, MFA, and basic role assignment all live here.

IGA (Identity Governance and Administration) is the process layer on top of IAM: who approves access requests, how access gets reviewed periodically, and how joiner-mover-leaver actually works in practice rather than on paper.

PAM (Privileged Access Management) is specifically about the smaller, higher-risk set of privileged accounts (admins, service accounts) that need tighter controls than standard user access: time-bound elevation, justification, and audit.

A self-assessment, section by section

IAM basics

• Is MFA enforced for all users, or only some?
• Is single sign-on used consistently, or do users maintain separate credentials for major applications?
• Are access decisions based on role, or granted ad hoc as requested?

Governance

• Is there a documented process for what happens to access when someone joins, changes role, or leaves?
• Is access reviewed periodically, or does it only change when someone explicitly requests a change?
• Do you know, right now, whether any former employees still have active accounts?

Privileged access

• Do admin accounts have standing access, or is elevation time-bound and justified?
• Are service accounts and API keys inventoried, or does nobody have a complete list?
• Is privileged account activity logged and reviewed?

Where organisations typically are weakest

In our experience, IAM basics are usually in reasonable shape. Most organisations have MFA and SSO at least partially deployed. Governance and privileged access are where the real gaps concentrate: joiner-mover-leaver processes that exist on paper but aren't consistently followed, and admin accounts with standing rights nobody's questioned in years.

If this assessment surfaced more gaps than you expected, that's the normal outcome, not an unusual one. Access sprawl accumulates quietly in every organisation that doesn't actively fight it.