IDM and Access Management: Implementing IDM, IAM and PAM
IDM (Identity Management) — managing the lifecycle of user accounts and permissions: who gets access, on what basis, for how long, who approves it, and how to prove this to auditors. IAM adds authentication, authorization, and access policies (MFA, SSO), while PAM provides control over privileged accounts and administrative sessions. RESTART performs assessments, designs access and PAM models, and implements and integrates them with AD, HR, ITSM, SIEM/SOAR, ERP, and 1C.
When access becomes a management issue
IDM and PAM are needed not only by a large bank or CII operator. They become a mandatory topic when a company has many employees, contractors, branches, integrations, administrators, service accounts, robots, ERP, 1C, DWH, personal accounts and systems with personal or financial data.
For CISOs, this is a way to reduce the risk of privileges being compromised and provide evidence of control. For CIO and infrastructure - bring order to AD, LDAP, IdP, VPN, administrators and service access. For compliance, internal audit and business system owners - stop living in the mode of manual downloads from Excel and controversial approvals after the fact.
Key Terms, Plainly Explained
| Term | What does it mean in enterprise terms? |
|---|---|
| IDM | Identity Management: Lifecycle management of accounts, roles, claims and access approvals. |
| IAM | Identity and Access Management: The broader management of identities, authentication, authorization, and access policies. |
| IGA | Identity Governance and Administration: access management as a control process - owners, rules, audits, SoD conflicts, confirmations and evidence. |
| PAM | Privileged Access Management: control of privileged accounts, administrator sessions, passwords, commands, remote access and emergency access. |
| MFA | Multi-Factor Authentication: Multi-factor authentication when a password alone is not enough to log in or perform a sensitive action. |
| SSO | Single Sign-On: single sign-on to multiple systems through a trusted identity provider, such as a corporate IdP. |
| RBAC / ABAC | Role-Based and Attribute-Based Access Control: granting rights by role or by employee, system, context and action attributes. |
| JML | Joiner-Mover-Leaver: the process of hiring an employee, transferring to a new role and dismissing with automatic change or revocation of rights. |
| SoD | Segregation of Duties: separation of powers so that one person cannot simultaneously create, coordinate and execute a critical operation. |
| JIT / JEA | Just-in-Time and Just-Enough Administration: temporary access for exactly the required period and only to the required set of actions. |
| ITDR | Identity Threat Detection and Response: Identifying and responding to attacks via accounts, tokens, sessions and anomalous activities. |
| NHI | Non-Human Identities: non-human identities - service accounts, API keys, tokens, robots, integration users and workload identities. |
Where does risk usually occur?
Fired and transferred employees
Rights remain after a role change, dismissal, maternity leave, transfer to another branch or completion of a project.
Contractors and temporary access
Access is granted promptly, but revocation of rights, expiration date, and ownership are often not recorded as strictly.
Administrators and local rights
Privileged users have access to the OS, DBMS, network equipment, backup, hypervisors and critical applications.
Service accounts
Passwords and tokens live for years, are used in scripts, integrations and schedulers, but do not always have an owner and rotation.
Manual approvals
Letters, chats and Excel do not provide a reliable picture of who agreed on what exactly was issued, for how long and why.
Weak provability
During the audit, it is difficult to quickly show current rights, system owners, history of changes, SoD conflicts and audit results.
Russian regulation and enterprise context
IDM/PAM is rarely implemented for the sake of a beautiful design. It is usually needed where access is related to personal data, CII, GIS, financial transactions, trade secrets, ERP, technology systems or internal controls. RESTART helps to link technical measures to actual operation, rather than leaving them as a separate document.
| environment | Why access control is important |
|---|---|
| Federal Law No. 152-FZ and ISPDn | ISPDn is an information system for personal data. Roles, minimum rights, logs, administrators, access to data, and verifiable security measures are important to her. |
| FSTEC Order No. 21 | For ISPD, it specifies the composition of organizational and technical measures. IDM/PAM helps make access management not a one-time act, but a controlled process. |
| Federal Law No. 187-FZ And FSTEC No. 239 | For significant CII assets, administrators, process accounts, contractor actions, segmentation, logging, and incident preparedness are critical. |
| GIS and FSTEC No. 117 | In government and other regulated information systems, access control, separation of roles, and provability of security measures must be tied to the security class and life cycle of the system. |
| GOST R 57580.1-2017 | For financial institutions, access control is concerned with securing financial transactions, remote access, administrator control, and process resilience. |
World practices and benchmarks
A good IDM/PAM project should not conflict with international practice. In Zero Trust, identity becomes one of the main perimeters: the network is no longer a sufficient sign of trust, and access must be verified by user, device, context, resource and action.
| Landmark | How to use it in a project |
|---|---|
| NIST SP 800-207 Zero Trust Architecture | We remove implicit trust: access is granted after verification of the user, device, resource, policy and context. |
| CISA Zero Trust Maturity Model v2 | We look at identities as one of the key layers of maturity: MFA, lifecycle, governance, least privilege and visibility. |
| CIS Controls v8.1 | We use a practical language of controls: accounting for assets, accounts, access, logs, administrators and governance. |
| Verizon DBIR 2026 | We compare priorities with real incidents: vulnerabilities, ransomware, phishing, stolen credentials and AI-enhanced attacks require rights control and monitoring. |
| IBM Cost of a Data Breach 2025 | We take into account the growth of AI risks, non-human identities and the need for strong access controls for AI systems and data. |
How RESTART works
Fixing the outline
Systems, owners, AD/LDAP/IdP, ERP, 1C, DBMS, network devices, VPN, contractors, service accounts, regulators and current pain points.
Building an access model
We describe roles, the JML process, SoD conflicts, approval owners, access deadlines, review rules and target metrics.
We design PAM
We define privileged accounts, remote access scenarios, session recording, vault, emergency access, secret rotation and command control.
Let's integrate
We connect IDM/PAM with AD, LDAP, IdP, MFA, HR, ITSM, SIEM/SOAR, DBMS, ERP, 1C, DevOps, network equipment and logs.
Launching the pilot
We take a limited set of systems and roles, check processes, load, UX, fault tolerance, reports and real operating scenarios.
We put it into operation
We prepare regulations, runbook, RACI, role matrix, instructions, evidence pack, audit plan and support after production launch.
IAM/PAM partner base
To manage identities, privileged access, MFA, certificates and identity risks, RESTART can include InDEED products in the architecture: Indeed PAM, Indeed ITDR, Indeed Access Manager, Indeed Certificate Manager, Octopus IdM, BearPass and Indeed MFA. For the customer, this is not a “logo in a presentation”, but an opportunity to assemble a domestic identity security environment for real roles, remote access, administration, auditing and replacement of foreign IAM/PAM tools.
Partners are listed as the technology backbone of the solution class. The specific composition of products, versions, licenses, certificates, compatibility and delivery conditions are confirmed before the project.
The role of AI in access control
AI is useful where a person needs to quickly understand a large graph of access rights, requests, logs and exceptions. But it should not arbitrarily grant or revoke rights: such actions should go through an approved process, system owners and logged decisions.
Search for extra rights
AI helps to find orphaned accounts, rare privileges, outdated groups, unexpected role intersections and access without an owner.
Access audit
Prepares draft access reviews: what has changed, what rights require confirmation, where there is a risk and who to send the question to.
SoD and business risks
Highlights conflicting permissions, such as creating a supplier, changing details, and agreeing on payment by one person.
Anomalies and ITDR
Helps analyze logins, sessions, commands, role changes and signs of identity environment compromise.
Evidence pack
Collects explanations for the audit: what controls are working, where there are exceptions, who is the owner of the risk and what has already been corrected.
AI environment under control
For RAGs, AI assistants and agents, we separately check access to sources, logs, prompts, secrets and service identities.
What does the business get?
| Result | Business Value |
|---|---|
| Managed access lifecycle | Employees, contractors, and service accounts are granted rights through a clear process rather than historical requests in chat rooms. |
| Privilege Control | Administrative actions become visible: who connected, what they did, when, on what basis and in what system. |
| Faster onboarding and offboarding | New employees get the right roles faster, and dismissal or transfer does not leave tails in critical systems. |
| Less manual auditing | Rights audits, evidence packs, reports and exceptions are collected faster and with less dependence on individual administrators. |
| Zero Trust and SOC-ready | Identity events, MFA, privileges, sessions and roles become the source for monitoring, responding and managing risk. |
Deliverables
- identity-environment map: systems, owners, accounts, roles, groups, privileges, service users and contractors;
- target IDM/IAM/PAM model: roles, JML, SoD, MFA, SSO, privileged access, emergency access and access review;
- HLD/LLD for the selected environment, including integration with AD, LDAP, IdP, HR, ITSM, SIEM/SOAR, ERP, 1C, DBMS and network systems;
- risk register by access: critical privileges, orphaned accounts, weak processes, manual exceptions, logging gaps and quick fixes;
- pilot and production plan: backlog, team roles, acceptance criteria, roadmap, migration plan and operational metrics;
- regulations, RACI, administrator and user instructions, application templates, role matrix, evidence pack and regular audit plan.
First practical step
It’s better to start not with choosing a product, but with a short assessment of access-risk: which systems are critical, where the most privileges are, which processes break down when fired, where contractors and service accounts live without an owner, which information security and compliance requirements need to be addressed first.
After diagnostics, you can choose a safe first stage: PAM pilot for administrators, IDM/JML for employees and contractors, audit of service accounts, connection with SIEM/SOAR, or preparation of HLD/LLD for procurement and implementation.
Frequently asked questions
What is IDM?
IDM (Identity Management) — managing the account lifecycle: access requests, roles, approvals, employee onboarding, transfers, and terminations with automatic permission changes or revocations. Access is granted through a clear process, not based on historical chat requests.
How does IDM differ from IAM?
IAM (Identity and Access Management) is a broader scope covering identities, authentication, authorization, and access policies, including MFA and SSO. IDM is a subset of IAM responsible for the lifecycle of accounts and permissions. IGA adds governance over these processes: ownership, reviews, SoD conflicts, and attestations.
How is IDM different from PAM?
IDM manages the access lifecycle: requests, roles, approvals, onboarding, transfers, and terminations. PAM controls privileged accounts and administrative actions: vault, sessions, commands, recording, emergency access, and secret rotation. More details in the article. PAM: privileged accounts.
What is access management: JML and access reviews?
JML (Joiner-Mover-Leaver) is the process of onboarding, transferring, and offboarding employees with automatic modification or revocation of access rights. Access review is a regular verification performed by system and business owners to confirm who has been granted which rights—not just a formal signature but an actual confirmation. The frequency depends on the system's risk level; for regulated environments, access review is also a compliance requirement.
Where to start with implementing IDM?
From a brief access-risk assessment: which systems are critical, where privileges are most excessive, which processes break upon employee termination, and where contractor and service accounts exist without an owner. Following this, the first phase is selected: a PAM pilot for administrators, IDM/JML for employees and contractors, a review of service accounts, or HLD/LLD for procurement and implementation.
Is it possible to start with PAM only?
Yes. Often the first step is to secure administrators, contractors, and critical service accounts. But beyond that, PAM is best integrated with IDM/IAM, HR, ITSM, MFA, and SIEM so that access rights don't exist in isolation from business processes.
Delivery of access control solutions
For IDM and PAM, not only licenses are critical, but also integration with directories, administration systems, logging, service requests and rights approval processes. The delivery of such solutions must be accompanied by an access architecture and implementation plan.
Let's discuss your environment
Describe the task, current systems, constraints, and expected results. We will offer a practical first step: diagnostics, pilot, audit, roadmap or project team.
