Identity governance / Compliance gap assessment
Right-sized IGA for compliance
Can you evidence access governance for DORA, NIS2 or ISO 27001?
Book a compliance gap assessment: a working session with an identity governance specialist. Together we identify the controls you must evidence, where your current capability falls short, and whether a focused package closes the gap.
Why now
The evidence is needed this audit cycle. A full Identity Governance and Administration (IGA) programme takes years.
Auditors and regulators keep asking the same question: who has access to what, and why? Most organisations cannot produce that view on demand, and cannot wait for a multi-year identity transformation to do it.
Compliance without over-engineering
You may not need a full IGA transformation to close the gap in front of you.
Use what you already have
Extend your existing identity investments rather than replacing them.
A route to maturity
Start proportionately, with a clear next step rather than a dead end.
What the assessment covers
Three questions, one working session
01
The controls you must evidence
We map the identity governance requirements of the frameworks in scope to the specific controls and evidence an auditor will ask for.
02
Where your capability falls short
We review current coverage: which applications sit outside governance, how recertification, leaver and orphaned-account processes run today, and what evidence you can already produce.
03
Whether a focused package closes the gap
You get a clear recommendation: what a bounded package would address, what it would not, and the next maturity step.
What you leave with
One control, one evidence view
A written gap summary that lines up each requirement in scope with the control behind it and the evidence you can produce today. Clear on what is covered, and clear on what is not. Built to take to your CISO or audit committee.
| Control | Requirement | Status |
|---|---|---|
| Privileged access review | ISO 27001 Annex A 8.2 | ✓ Evidenced |
| Access recertification | ISO 27001 Annex A 5.18 | – Partial |
| Leaver access removal | NIS2 Article 21(2)(i) | ✕ Gap |
| Orphaned account management | DORA Article 9 | ✕ Gap |
Is this for you?
Built for three situations
It works where a One Identity or Privileged Access Management (PAM) foundation already exists, and equally where governance is fragmented or missing.
Incomplete coverage
A governance foundation exists, but important applications sit outside it.
The session looks at extending control to the applications creating the gap.
Disconnected application
One important application sits outside your identity governance process.
The session looks at connecting it, governing access to it and creating the evidence.
Missing foundation
A regulatory requirement exists without a mature IGA capability behind it.
The session looks at the minimum effective control and a maturity roadmap.
If you go further
Right-sized identity governance, in three stages
Where a focused package fits, it delivers the identity governance controls and evidence you need now, through a proportionate solution that grows with your Identity and Access Management (IAM) maturity.
-
1
Connect and onboard
Bring the applications that matter into governance: connector building, application onboarding, account matching and orphaned account management.
-
2
Govern and control
Run the processes the requirement needs: access recertification, remediation and validation, leaver processes, unused accounts and licence management.
-
3
Evidence and improve
Show the outcome: reporting, regulation mapping, audit support and control improvement recommendations for the next maturity stage.
Clear boundaries: what the assessment is, and what it is not
It is
- A working session that maps the identity governance requirements in scope to the controls and evidence they need
- A clear view of what is already addressed, and what is not
- A recommendation you can take to your executive
It is not
- An audit or a certification
- A statement that your organisation is, or will become, compliant
- A commitment to a multi-year IGA programme
Higher Education / Finland
Laurea University of Applied Sciences
Laurea replaced a legacy Microsoft Identity Manager deployment with One Identity Manager, delivered by Intragen. Account lifecycle and attestation are now automated across eight critical systems, for around 30,000 students and more than 700 staff on six campuses.
The Service Desk has also seen a reduction equivalent to two full-time staff members.
Read the Laurea University case studyBook your session
Book your compliance gap assessment
Tell us a little about your scope. Fill out the form and our specialist team will be in touch to arrange your session.
- 1 Request a session. Five quick fields, under two minutes.
- 2 We get in touch. Our specialist team contacts you to agree a time.
- 3 Work through it together. Your gap summary follows the session.
Not ready to book?
Talk to an identity governance specialistQuestions
Will the assessment make us compliant?
No. It maps the identity governance requirements in scope to the controls and evidence they need, and shows where you stand today. Achieving and demonstrating compliance remains with your organisation and your auditors.
Do we need One Identity or an existing IGA platform?
No. The assessment works whether you already have a governance platform, a PAM foundation, or nothing formal in place yet.
What does the session involve?
A focused working session, held online with an Intragen specialist and designed to be fast and focused on the gap in front of you. You get a clear answer without committing to a lengthy audit or a large programme. Your written gap summary follows the session.
Who runs the session?
An Intragen identity governance specialist with experience of the frameworks in scope for you.
What happens after I submit the form?
Our specialist team will be in touch to agree a time and confirm which frameworks are in scope, so the right specialist runs your session.
Do DORA and NIS2 apply to our organisation?
It depends on your sector, size and where you operate. DORA applies directly to financial entities across the EU, and shapes their contracts with the ICT providers that serve them. NIS2 applies to essential and important entities through each EU member state's national legislation. Organisations based outside the EU, including in the UK, can fall within scope through their EU operations or as suppliers to in-scope entities. ISO 27001 applies wherever you hold or seek certification. The session confirms which frameworks are relevant to you.
Who should attend from our side?
Whoever owns identity and access day to day, such as a Head of IAM, an IAM or GRC manager, or an IT risk lead. Bring an application owner if one system is the focus.