Question:

How do you evaluate the effectiveness of your de-provisioning automation process for retiring employees? I recently retired from the IAM team and found out that all my access rights were revoked on my last day, even before I could fill out my final time card or attend my farewell lunch. I was glad to see that our automation was working well, but I wonder if there is a better way to handle such situations.

Answer:

Evaluating the Effectiveness of De-Provisioning Automation for Retiring Employees

De-provisioning automation is the process of automatically revoking access rights and privileges from employees who are leaving the organization, such as by retirement, resignation, or termination. This process is essential for maintaining security and compliance, as well as reducing costs and risks associated with unauthorized access to sensitive data and resources.

However, de-provisioning automation also poses some challenges and trade-offs, especially when it comes to retiring employees who may have a long and valuable history with the organization. How do you balance the need for security and efficiency with the respect and appreciation for the retiring employees? How do you evaluate the effectiveness of your de-provisioning automation process and ensure that it is not too harsh or too lenient?

One way to approach this problem is to use a framework that considers the following aspects of de-provisioning automation:

• Timeliness: How quickly and accurately does the automation process revoke access rights from retiring employees? Is there a delay or a grace period between the employee’s last day and the de-provisioning date? How does the automation process handle exceptions and special cases, such as employees who are on leave or have pending tasks or projects?
• Scope: How comprehensive and granular is the automation process in identifying and removing access rights from retiring employees? Does it cover all the systems, applications, devices, and networks that the employee may have access to? Does it account for the different levels and types of access rights, such as read-only, write, edit, delete, or admin?
• Communication: How well does the automation process communicate with the retiring employees and other stakeholders, such as managers, HR, IT, and security teams? Does it inform the retiring employees of their access status and the de-provisioning schedule? Does it notify the other stakeholders of the de-provisioning actions and outcomes? Does it provide feedback and confirmation to the retiring employees and the other stakeholders?
• Feedback: How effectively does the automation process collect and analyze feedback from the retiring employees and the other stakeholders? Does it solicit feedback from the retiring employees on their satisfaction and experience with the de-provisioning process? Does it measure the impact and benefits of the de-provisioning process on the security and performance of the organization? Does it use the feedback to improve and optimize the de-provisioning process?

By using this framework, you can evaluate the effectiveness of your de-provisioning automation process and identify the areas of improvement and best practices. For example, you may find that your automation process is too fast and aggressive in revoking access rights from retiring employees, which may cause inconvenience and frustration for them and their colleagues. In this case, you may want to adjust the timing and scope of the de-provisioning process and provide more communication and feedback to the retiring employees and the other stakeholders.

Alternatively, you may find that your automation process is too slow and lax in revoking access rights from retiring employees, which may create security and compliance risks for the organization. In this case, you may want to speed up and tighten the de-provisioning process and ensure that it covers all the relevant access rights and systems.

In

conclusion, de-provisioning automation is a critical and complex process that requires careful evaluation and optimization. By using a framework that considers the timeliness, scope, communication, and feedback of the de-provisioning process, you can ensure that your automation process is effective and respectful for your retiring employees and your organization.