Getting started with Identity Access Management

Moraph resells, implements and runs Okta for banks, credit unions and other financial institutions. We configure single sign-on, multi-factor authentication, authentication policies and user lifecycle to match the FFIEC's guidance on authentication and access, then operate the tenant day to day: changes, monitoring, access reviews and support. Your institution keeps the policy decisions, and every configuration change is recorded with its reason and approver.

What it is for

Financial institutions are expected to apply multi-factor authentication or equivalent controls to every user who can reach sensitive systems, including employees, contractors and privileged administrators, and to base those controls on a risk assessment. In practice, identity setups grow application by application: some systems sit behind single sign-on and some do not, MFA exceptions linger, leavers keep accounts in systems that were never connected, and nobody can quickly show an examiner how authentication strength relates to risk. Small IT teams rarely have the time to keep the identity platform tuned as applications, threats and guidance change.

• Applications outside single sign-on keep their own passwords and their own leaver process
• MFA exceptions and weaker authenticators remain in place long after they were granted
• Joiner, mover and leaver changes depend on manual tickets to each application owner
• Showing examiners how authentication controls follow the risk assessment takes days of gathering

Who uses it

• CISOs and information security officers at banks, credit unions and other financial institutions
• IT and infrastructure teams who run identity without a dedicated identity engineering group
• Risk and compliance staff who map controls to the FFIEC guidance and the institution's risk assessment
• Application owners who need their systems behind single sign-on and automated provisioning
• Internal audit and examiners, who need evidence of access controls and reviews

Before you start

• Your organization uses Identity Access Management as a managed platform from Moraph, under an agreement that covers it.
• Licences for Okta, bought through Moraph or under your own agreement with the vendor.
• A Moraph account in your organization for each person who works with Moraph on the service.
• Named technical and security contacts, recorded in the Moraph Portal.

Steps to get started

1. Agree the scope of the managed service for Identity Access Management with Moraph, including which environments and teams it covers.

2. Name your administrators, technical contact and security contact in the Moraph Portal under People and access.

3. Review the configuration baseline Moraph proposes for your regulations, and record any changes you need.

4. Confirm how users will sign in, through your identity provider where the platform supports it.

5. Agree the pilot group and the cut-over plan with your Moraph delivery lead.

Where to go next

• Onboard Identity Access Management
• Everyday tasks
• Connect your systems
• Security, data and compliance
• Troubleshooting and the support guide
• Product overview on moraph.com