Identity access governance implementation Saudi Arabia remains one of the most frequently deferred projects in financial institutions, not because the technology is unavailable, but because organizations attempt to deploy identity and access management platforms before they have defined roles, established ownership, or mapped the workflows that will sustain the system. The National Cybersecurity Authority's Essential Cybersecurity Controls framework—particularly Domain 5, which addresses identity and access management—requires not only technical controls but also documented processes, defined roles, and evidence of periodic access reviews. A spreadsheet-based access review conducted twice a year by IT administrators does not meet these requirements, yet many institutions find themselves unable to move beyond this baseline.
We deliver identity and access governance programs in 16 weeks by running five parallel work-streams, each with defined weekly deliverables and clear ownership on the client side. This article documents how these work-streams operate, what each produces, and how they converge to establish a governance program that satisfies NCA ECC Domain 5 and positions the institution for automated identity governance.
Why Identity Governance Projects Stall
Three obstacles recur across institutions planning identity governance:
Absence of a role model. Access is granted application by application, often by copying the permissions of a colleague. No one can explain what a "credit analyst" should access across all systems, because the concept of a role exists only informally.
Undefined ownership. IT holds the access provisioning process, but business units hold the knowledge of who should access what. Neither side owns the end-to-end joiner-mover-leaver process, and access requests sit in email threads for weeks.
Review fatigue without consequence. Access reviews are conducted in spreadsheets, often listing thousands of entitlements. Reviewers approve in bulk because they lack context, and nothing changes even when access is marked for removal.
These are process and governance problems, not technology problems. An identity governance platform deployed into this environment will automate chaos, not control.
The Five Work-Streams
Our approach runs five work-streams in parallel over 16 weeks. Each work-stream has a dedicated lead from the client side—typically the IAM manager, the HR systems owner, the information security officer, the internal audit representative, and the application owners for core banking and other critical systems. Weekly working sessions ensure that each work-stream progresses in step, and dependencies between streams are managed in a single program plan.
Work-Stream One: Role Mining and RBAC Design
This work-stream builds the role-based access model that will underpin all future provisioning and reviews. We begin by extracting current access data from core systems—core banking, payment platforms, Active Directory, and any privileged access management tools already in place. We analyze this data to identify clusters of users with similar access patterns, then validate these clusters with business unit heads to define roles that reflect actual job functions.
The output is a role catalog for key systems. Each role specifies the applications, modules, and permissions it includes, the business justification, and the approver. For a Saudi bank, this typically yields 40 to 80 roles covering 80 percent of users; the remainder hold exception access that must be individually justified.
Participants on the client side include application owners, department heads in retail banking, corporate banking, treasury, and finance, and the IAM or identity management lead. The work-stream runs from week one through week eight, with draft roles reviewed in week four and the final catalog approved in week eight.
Work-Stream Two: Joiner-Mover-Leaver Process Redesign
Joiner-mover-leaver processes are often the weakest link in access governance. New employees wait days for access because the request sits in an email inbox; employees who change roles retain old access indefinitely; leavers are disabled in Active Directory but remain active in core banking for weeks.
This work-stream maps the current process end to end, identifies handoffs and delays, and redesigns the process with defined owners, service levels, and escalation paths. We document the process in a set of IAM policy and procedures that specify who requests access, who approves it, what evidence is required, and how quickly provisioning must occur.
The redesigned process integrates with HR systems where possible, so that a new hire record or termination record triggers the access workflow automatically. Where integration is not feasible in the 16-week program, we define a manual trigger with a named owner and a service level agreement.
Participants include HR, IT service management, line managers who will approve access requests, and the information security team. The work-stream runs from week two through week ten, with the draft process reviewed in week six and the final policy approved in week ten.
Work-Stream Three: Privileged Access Governance
Privileged accounts—database administrators, system administrators, application support accounts, and service accounts—pose the highest risk and are the focus of NCA ECC controls on privileged access management. Many institutions have deployed a privileged access management platform but have not defined which accounts must be managed, who may check them out, under what circumstances, and how usage is monitored.
This work-stream produces a privileged access standard that defines privileged account types, checkout and approval workflows, session recording requirements, and periodic recertification. We inventory existing privileged accounts across core banking, infrastructure, and cloud environments, classify them by risk, and onboard high-risk accounts into the PAM platform if one exists, or define the roadmap for onboarding if the platform is not yet deployed.
Participants include infrastructure managers, database administrators, application support leads, and the security operations team. The work-stream runs from week three through week twelve, with the inventory complete in week six, the standard approved in week nine, and high-risk accounts onboarded or documented by week twelve.
Work-Stream Four: Segregation-of-Duties Rule Definition
Segregation-of-duties violations—where a single user can initiate and approve a transaction, or create a vendor and process a payment to that vendor—are a primary concern for internal audit and a specific requirement under NCA ECC Domain 5. Yet many institutions have never formally defined which combinations of access constitute a violation.
This work-stream defines segregation-of-duties rules for core banking, payment systems, and financial applications. We start with a standard set of SoD conflicts common to banking—maker-checker violations, payment initiation combined with approval, user administration combined with security administration—then work with internal audit and business process owners to confirm which rules apply and to define any institution-specific rules.
The rules are documented in a format that can be loaded into an identity governance platform or, in the interim, tested through periodic reports. We run an initial SoD report against current access data to identify existing violations, then work with business units to remediate or document accepted risks.
Participants include internal audit, the compliance function, treasury and finance process owners, and core banking application managers. The work-stream runs from week four through week fourteen, with draft rules reviewed in week eight, the initial violation report delivered in week eleven, and remediation complete or risk-accepted by week fourteen.
Work-Stream Five: Access Review Automation
Periodic access reviews are required by NCA ECC, but manual reviews conducted in spreadsheets are slow, inaccurate, and produce no meaningful remediation. This work-stream designs and executes the first automated access review campaign, establishes the review calendar, and trains reviewers.
We define review scope—which systems, which users, which frequency—and assign reviewers by role or by department. We configure the review campaign in the identity governance platform if one is in place, or build a structured review process using workflow tools if the platform is not yet deployed. Reviewers receive training on how to assess access, what "appropriate" looks like for each role, and how to mark access for removal.
The first campaign is executed as a pilot, typically covering one business unit or one high-risk system. We collect feedback, refine the process, and document it in the IAM policy and procedures. The result is an access review evidence pack that demonstrates to internal audit and to NCA that access reviews are conducted, decisions are documented, and remediation is tracked.
Participants include department heads who will serve as reviewers, the IAM team, and internal audit as observers. The work-stream runs from week six through week sixteen, with the first campaign launched in week twelve and the evidence pack finalized in week sixteen.
Program Governance and Weekly Deliverables
The five work-streams are managed through a single program plan with weekly checkpoints. A steering committee meets every two weeks, chaired by the CISO or IT director, with representatives from HR, internal audit, compliance, and business units. The committee reviews progress, resolves cross-functional issues, and approves key deliverables before they move to the next phase.
Weekly deliverables keep the program on track. In week four, the draft role catalog is reviewed. In week six, the current joiner-mover-leaver process map is validated. In week eight, the final role catalog is approved and the draft SoD rules are reviewed. In week eleven, the first SoD violation report is delivered. In week twelve, the first access review campaign is launched. In week sixteen, all work-streams converge: the IAM policy and procedures, the role catalog for key systems, the privileged access standard, and the access review evidence pack are handed over to the client.
What You Hold at the End
At the conclusion of the 16-week program, the institution holds four primary deliverables:
IAM policy and procedures that document the joiner-mover-leaver process, access request and approval workflows, privileged access checkout procedures, segregation-of-duties rules, and the access review calendar. This document serves as the governance foundation and the reference for internal audit.
Role catalog for key systems that defines 40 to 80 roles, each with specified permissions, business justification, and approver. The catalog is maintained by business units and updated as job functions evolve.
Privileged access standard that defines which accounts are privileged, how they are managed, who may use them, and how usage is monitored. High-risk accounts are onboarded into the PAM platform or documented for future onboarding.
Access review evidence pack that includes the review scope, reviewer assignments, review decisions, remediation tracking, and sign-off by reviewers and the steering committee. This pack demonstrates NCA ECC compliance and is ready for audit.
These deliverables position the institution to meet NCA ECC Domain 5 requirements and to move from manual, spreadsheet-based access governance to automated identity governance supported by a platform.
How We Deliver Identity & Access Governance
We strengthen how access is granted, reviewed and removed—joiner-mover-leaver processes, privileged access, segregation of duties and periodic access reviews. Programs are delivered in four phases over 6 to 10 weeks: baseline assessment of current processes, systems and access data; design of roles, rules and processes; execution of the first access review campaign; and embedding the program through handover and establishment of the recurring cycle. The program is tailored to SAMA CSF and NCA ECC requirements and integrates with the institution's broader governance, risk and compliance framework.
If your institution is planning identity access governance implementation in Saudi Arabia to meet NCA ECC Domain 5, and you recognize the need to define roles and workflows before deploying technology, we should speak.
