Who counts as a stakeholder of an IAM system, and into which four groups can stakeholders be divided?
Following the ISO 10006 definition, stakeholders are all persons who have an interest in the IAM system or are affected by it. Four groups: (a) direct users, (b) indirect users, (c) those who actively run IAM, (d) those with an audit or control function.
* The four stakeholder groups of an IAM system and who belongs to each. *
The definition borrows from ISO 10006 (quality management in projects), whose vocabulary treats a stakeholder or "interested party" as anyone who can affect, or is affected by, a decision or activity. For IAM this gives a deliberately wide circle:
| Group | Who | What they want |
|---|---|---|
| (a) Use IAM directly | Users, IT administrators, developers | Simplicity: SSO, automation, standards |
| (b) Use or consider IAM indirectly | Software vendors, cloud providers, customers buying software or cloud services | Products that sell and fit; few IAM systems and technologies |
| (c) Actively run IAM | The sponsor (Auftraggeber), the IAM operations team (Fachbetreuung) | A working, affordable system; automated standard processes |
| (d) Audit or control | Auditors, employee representatives, information security, data protection | Compliance, low risk, protected employees and personal data |
Why the wide circle matters: an IAM project that only listens to IT will be blocked by the works council, flagged by the auditors or ignored by the users. Identifying all stakeholders early is how you collect requirements and avoid late surprises. (The Swiss standards eCH-0107 and eCH-0219 use a different, more abstract cut: service consumer, service provider, IAM service provider, management and regulator.)
Go deeper:
NIST glossary: stakeholder — the systems-engineering definitions (from ISO/IEC/IEEE 15288) of a stakeholder in a system.- Stakeholder analysis (Wikipedia) — how to identify stakeholders and weigh their interest and influence.