IBM User Compliance Management

Compliance Management is one of the top areas of concerns for companies. Dealing with complex regulatory environments such as Sarbanes Oxley (SOX), Basel II, etc., increasing demands to run secure and highly resilient businesses, managing privileged user access and provisioning, and monitoring the activities of those with access to sensitive information have become nearly impossible without automation. The top 5 material deficiencies derived from the last two years of SOX Section 404 filings include:

• Excess access to systems / databases
• Lack of access controls
• Insufficient segregation of duties
• Improper change management
• Lack of general monitoring of the security infrastructure

IBM® User Compliance Management is a comprehensive solution that covers user provisioning, access controls, federation, user activity monitoring and compliance reporting for heterogeneous environments. It is a flexible, end to end approach which defines the relevant compliance and control elements and deploys an effective process, from assessment to planning, design, architecture, implementation and reporting. This flexible approach provides the ability to focus where issues with compliance are most acute.

User Compliance Management is a comprehensive solution that brings together several powerful IBM Tivoli® security software products and experienced consultants provided by our Global Technology Services organization that include:

• Assessment Services: Assesses current access rights and validates policies used are based upon proper business needs, regulations and controls.
• Implementation Services - User Monitoring: scope and roll out a user logging and monitoring solution across critical assets with Tivoli Compliance Insight Manager (TCIM).
• Implement Services - Identity and Access Management: refine or roll-out IAM solutions to lockdown role-based access definitions with Tivoli Identity Mgr (TIM), Tivoli Access Manager for e-business, Tivoli Federated identity Manager.
• Compliance Reporting - Access Rights: automate the audit and compliance reporting needed for proving you understand current access rights and risks.