Industries
Industries we work in
Same discipline. Different requirements, systems and pace.
Identity and access management is about the same thing everywhere: the right people have the right access, it goes away again, and it can be documented. What sets industries apart is the regulation, the source systems and how fast things move.
Starting point
One discipline, five kinds of requirements
Identity and access management is all we do, and we have done it for organisations in central government, municipalities, finance, utilities, manufacturing and professional services. The core is the same: an authoritative source for who is employed and where, an engine that translates it into roles and access, and the systems where the access is used.
The difference lies in what sets the requirements. In the public sector it is audit and procurement rules, in finance it is the supervisory authority and DORA, in utilities and manufacturing it is NIS2 and the line between IT and operations. We know the requirements before we arrive, so the time goes into your set-up and not into learning the industry.
Named references are shared in a meeting, once the customer has given consent.
Public sector
Municipalities, regions and central government
Public organisations have more movement in their workforce than most companies: temporary staff, trainees, seasonal workers and moves between departments. At the same time, access to citizen and patient data has to be documented for auditors and supervisory authorities, and parts of the sector fall under NIS2.
We work with the payroll and HR system as the source, OS2MO or the payroll system's organisation as the structure, and Active Directory, Entra ID and the line-of-business systems as the targets. For Danish municipalities we have a ready configuration, IGA for municipalities, which several municipalities run in production.
The purchase can be made through SKI. We are an admitted supplier on 02.06 Standard Software, so licences, implementation, training and advisory can be bought in the system instead of through a separate EU tender.
See IGA for municipalitiesWhat we typically solve
- Day-one access and same-day closure driven by the employment in the payroll system, including temporary staff with an end date.
- Documentation for the auditors with a history of who had access to what, and who approved it.
- Purchasing through SKI 02.06 with us as the contracting party.
Finance and pensions
Banks, pension funds and insurers
The financial sector has had access governance requirements for a long time, and DORA has made them concrete: governing access and privileged rights, controlling suppliers' access, and documentation that can be shown to the supervisory authority and the auditors.
The task is rarely to introduce governance from scratch, but to bring it together. Access in core systems, the Microsoft environment and the many line-of-business systems must be seen in one picture, segregation of duties must be enforced and not just described, and recertification must be a workflow rather than a spreadsheet.
In this sector we work with enterprise IGA such as Omada and One Identity, where the requirements for segregation of duties and history are highest.
Read: DORA and access managementWhat we typically solve
- Segregation of duties (SoD) as rules in the platform, with exceptions that have an owner and an expiry.
- Privileged access with vaulting, rotation and session monitoring of the accounts hackers go for first.
- Recertification at fixed intervals with documentation ready for the supervisory authority.
Utilities, transport and critical infrastructure
Energy, water, transport and other critical infrastructure
Utilities, transport operators and other owners of critical infrastructure fall under NIS2, and access governance is one of the first areas the supervisory authority asks about. The task has an extra dimension: the line between IT and the operational systems that run the plant.
Many of the critical accesses are external. Suppliers service equipment, contractors work for periods, and operations run around the clock in shifts. Access must be granted quickly and closed just as quickly, and there must be a trail afterwards.
We work with IGA for employees and external parties, PAM for the privileged accesses, and MFA and secure access also where the systems cannot go to the cloud.
Read: NIS2 sets requirements for your access managementWhat we typically solve
- Supplier access with a time limit, a sponsor and automatic closure.
- Privileged accounts for operational and control systems, without standing privileges.
- NIS2 documentation of who has access to what, and how it is controlled.
Manufacturing and industry
Manufacturers and their supply chains
Industry has come under NIS2 more broadly than before, both directly and as a supplier to companies that pass requirements on. At the same time the range of systems is wide: ERP and often SAP, production systems, quality systems and a Microsoft environment that ties it together.
The workforce is large and varied. Hourly workers without their own PCs, shift workers, seasonal staff and external technicians all need the right access and no more, and a departure must close everything at once, including in the production systems.
We work with IGA across ERP, production and the Microsoft environment, and with SAP-specific access governance where SAP is the core.
Read: Answering your customers' security requirementsWhat we typically solve
- Roles across ERP and production based on position and location.
- Access to SAP with harmonised roles, segregation of duties and emergency access.
- Answering customers' security requirements with documentation that can be passed on down the supply chain.
Professional services
Audit, advisory and other businesses built on client data
Audit and advisory firms, law firms and other knowledge businesses live on their clients' trust. Access to client data must follow the engagement, not the employment: whoever leaves a case must lose access to it, even if the employment continues.
The environment is typically built around Entra ID, M365 and a range of line-of-business systems, and many clients require ISO 27001 or similar documentation. The question is often whether Entra ID Governance is enough, or whether a dedicated IGA platform is needed.
We work with IGA for Microsoft environments, where Pointsharp ILM and Entra ID Governance are the typical choices, and with Managed IGA, where we operate the solution.
See IGA for Microsoft environmentsWhat we typically solve
- Access that follows the engagement with an owner and an expiry per case or client.
- Entra ID Governance or dedicated IGA as a reasoned choice rather than an assumption.
- Documentation for client requirements and for certification.
Next step
Three ways in
IGA for municipalities
A ready configuration of Omada for the Danish municipal source systems, in production at several municipalities.
See IGA for municipalities →Buying through SKI
Danish public-sector customers can buy licences, implementation, training and advisory through 02.06 Standard Software.
How it works →IAM Maturity Assessment
A documented assessment of where you stand, whatever the industry. The first step for most.
Read about the Maturity Assessment →Is your industry not listed?
The requirements differ, but the discipline is the same. Talk to us about what sets the requirements where you are.