What is the role of the sponsor (Auftraggeber) of an IAM system, and what motivates them?
The sponsor knows why an IAM system is important and necessary, and commissions its setup and maintenance. Typical motivations are compliance questions, economic considerations, or simply necessity, depending on industry, use cases and the current situation.
The sponsor is the person or body (often management, the CIO or the CISO) that orders the IAM system and pays for it. They do not configure anything themselves, but without them nothing happens. Their job:
- understand the significance and necessity of IAM for the organisation;
- commission both the initial setup and the ongoing maintenance (Einrichtung und Erhalt), which is easy to forget: IAM is never "finished".
Their motivation varies:
- Compliance: an audit finding, a regulator's requirement, a certification such as ISO 27001.
- Economics: rising help-desk costs, slow onboarding, too many licences for accounts nobody uses.
- Born of necessity (aus der Not geboren): a security incident, a merger, a cloud migration that suddenly makes the old approach unworkable.
Which motive dominates depends on the industry (a bank faces different regulators than a carpenter), the use cases and the current situation. Knowing the sponsor's real motive is essential, because the arguments for IAM must speak to it.
Go deeper:
Business case (Wikipedia) — how a sponsor's decision to fund a project is typically justified.