CA Identity Manager Implementation Guide - CA Technologies

Complying with Business PoliciesThe change actions that occur based on an identity policy contain events whichcan be placed under workflow control and audited. In the previous example, theSalary Approver role grants significant privileges to its members. To protect theSalary Approver role, the company can create a workflow process that requiresa set of approvals before the role is assigned, and they can configure CA IdentityManager to audit the role assignment.To simplify identity policy management, identity policies are grouped in anidentity policy set. For example, the Vice President and CEO policies may be partof the Executive Privileges identity policy set.Complying with Business PoliciesCompliance is a corporate governance that includes a wide range of proceduresthat ensure a company and its employees comply with business policies. Thesecompliance procedures often involve documenting, automating, and auditing theallocation of entitlements to applications and systems.CA Identity Manager includes the following features, which support compliancemanagement:■Smart ProvisioningSmart Provisioning is a collection of functionality that simplifies provisioningrole assignment when CA Identity Manager integrates with CA RCM. Thisfunctionality includes:■Suggested Provisioning RolesCA Identity Manager can provide administrators with a list ofprovisioning roles that may be appropriate to assign to a user. The list ofprovisioning roles is determined by CA RCM, based on criteria entered bythe administrator.Suggested provisioning roles help ensure that users have the correctprivileges, while maintaining a company's role model.■Compliance and Pattern MessagesIdentity Manager administrators can validate proposed changes againsta role model in CA RCM before committing changes. Validating changesbefore they are committed helps companies maintain the role model thatthey have defined for their operations.Users can validate proposed changes to provisioning roles (assigning orremoving them), and changes to user attributes.22 Implementation Guide