Service — Identity Governance & Administration
Know who has access to what, and prove it
IGA makes sure the right people and systems have the right access, for the right reasons, and lets you prove it. Kommando designs and delivers it on SailPoint across the Nordics, so the control still holds the day the auditor arrives.
Start with an assessment: see your real access model before you automate it.
- Who has access to what?
- Why do they have it?
- Who approved it?
What is IGA?
The governance layer for who has access to what
Identity Governance and Administration (IGA) is the practice of making sure the right people and systems have the right access, for the right reasons, and being able to prove it. It combines identity administration with the governance policies, reviews and controls that decide what access is allowed.
Administration is the mechanical side: provisioning accounts when someone joins, changing access when they move roles, and removing it when they leave. Done badly, it’s the reason a leaver still had a VPN account four months after their last day.
Governance is the accountability side: certifying that access is still appropriate, enforcing Segregation of Duties, defining roles, and producing the evidence that proves the controls work. This is the half that fails audits.
- Joiner, mover, leaver
- Access requests & approvals
- Access certifications
- Segregation of Duties
- Role & policy management
- Audit & reporting
IGA vs IAM
Same words, different jobs
The terms get used interchangeably, which causes real confusion in procurement. If IAM is the lock on the door, IGA is the record of who was given a key, why, and whether they should still have it.
| IAM | IGA | |
|---|---|---|
| Full name | Identity & Access Management | Identity Governance & Administration |
| Question it answers | Can this identity get in? | Should this identity have this access, and can you prove it? |
| Core functions | Authentication, single sign-on, MFA, access enforcement | Access certification, provisioning, Segregation of Duties, audit evidence |
| Primary concern | Access | Accountability |
| Typical platform | Entra ID, Okta | SailPoint |
The platform
The six capabilities of a working IGA programme
Identity Lifecycle Management (JML)
IGA connects to your authoritative source, usually HR, and provisions access automatically as people join, change roles and leave. The mover case is where most trouble hides: people change jobs, gain new access, and keep the old.
Access Requests & Approvals
Users request access through self-service, and policy decides what can be granted automatically versus what needs a human approver. Every grant has a reason and a record attached, instead of a Slack message nobody can find later.
Access Certifications & Reviews
Periodic reviews where managers confirm their people still need the access they have. A quarterly review 400 managers approve without reading isn't a control. IGA makes reviews continuous and readable, so decisions mean something.
Segregation of Duties (SoD)
Some combinations of access are dangerous together: whoever creates a supplier shouldn't also approve its invoices. IGA enforces these rules in policy and flags violations before they become findings, rather than after fraud has happened.
Role & Policy Management
A role model translates job functions into access, so people get what the role needs and nothing it doesn't. Get the roles right and everything downstream is simpler. Get them wrong and you've automated the mess at scale.
Audit & Reporting
Every request, approval, change and certification is logged. When an auditor asks who had access to the payment system in March and who signed off, the answer is a report, not a three-week fire drill.
Why now
Why IGA matters now
Identity governance used to be a slow, once-a-year compliance chore. Two things changed that.
Machine identities have taken over. Service accounts, tokens, API keys and now AI agents each hold access, and almost none of them appear in a traditional access review.
Regulators stopped accepting paperwork. DORA’s Article 28 requires real-time insight into user rights and regular access reviews, and NIS2 issued its first administrative penalties in early 2026.
machine identities outnumber humans (CyberArk, 2025)
of breaches start with credential abuse (Verizon DBIR 2025)
identity is the highest-ROI security investment (SailPoint, 2025)
Regulated sectors
IGA for regulated sectors
The pressure isn’t evenly distributed. Some sectors feel it first.
Financial services
DORA and internal audit make access certification and Segregation of Duties non-negotiable. This is where the "who approved this" question gets asked most often, and where rubber-stamped reviews fail hardest.
Healthcare
Patient data under GDPR, complex access across clinical and administrative staff, and rotating temporary workers make lifecycle management the priority. Automating joiners and leavers is the fastest route to defensible access control.
Public sector
NIS2, legacy systems and slow procurement combine into large, long-standing access debt. IGA brings it under control without replacing everything at once.
Energy & utilities
OT/IT convergence and long-tenured employees mean accumulated entitlements are the norm. Governance here is as much about cleaning up decades of access as controlling new grants.
Our approach
How Kommando delivers IGA
Assessment
We map your applications, roles and current access before designing anything, often as part of a broader Identity Advisory engagement. It's usually the first time anyone has seen the whole picture.
Design
The role model, certification policies and provisioning rules. This is the step that decides whether the programme succeeds, so it's the step we spend the most care on.
Implementation
SailPoint deployed and applications onboarded in waves, starting with the systems that carry the most audit and risk weight, so you get risk reduction early.
Managed services
We run and extend the platform as your application estate grows. Useful when the team that owns IGA is two people with other jobs too.
Get the role model right and everything downstream is easier. Get it wrong and you automate the mess.
A note on what IGA doesn't fix
IGA governs access; it doesn't secure the credentials themselves, and it won't rescue a broken role model. If your access is a mess going in, a platform will automate the mess faster. The work that makes IGA succeed is the unglamorous part: cleaning up roles, agreeing policies, and deciding who actually owns access decisions. We'd rather tell you that up front than sell you a tool and leave.
Frequently asked questions
Questions we actually get
What is Identity Governance and Administration (IGA)?
IGA is the practice of ensuring the right identities have the right access for the right reasons, and being able to prove it. It combines administration (provisioning and lifecycle management) with governance (access certification, Segregation of Duties, and audit reporting) in a single platform with policies and a full audit trail.
What is the difference between IGA and IAM?
IAM is the broad category of managing identities and their access, including authentication, single sign-on and MFA. IGA is the governance layer within it: certifying access, enforcing Segregation of Duties, automating the joiner-mover-leaver lifecycle, and producing audit evidence. IAM controls whether an identity can get in; IGA controls what it should be able to do, and proves it.
What is the best way to automate access reviews in IGA?
Use continuous, policy-driven certification rather than periodic spreadsheet reviews. A platform gathers who has access to what, resolves nested and inherited permissions so reviewers see the real privilege state, flags what changed since last time, and records the decision. That removes the rubber-stamping that makes manual reviews fail an audit.
What are the main components of an IGA programme?
Six capabilities: identity lifecycle management (joiners, movers, leavers), access requests and approvals, access certifications and reviews, Segregation of Duties, role and policy management, and audit and reporting. A programme is only as strong as its weakest capability, which is usually the role model.
How does IGA help with NIS2 and DORA compliance?
Both regulations require organisations to control access and prove they do. DORA's Article 28 requires real-time insight into user rights and regular access reviews; NIS2 makes access control a core obligation. IGA produces the certifications, Segregation of Duties enforcement and audit evidence these regulations demand, and automates the reviews so they hold up under scrutiny.
What is Segregation of Duties (SoD)?
Segregation of Duties is the principle that no single person should control a whole sensitive process. The classic example: whoever creates a supplier shouldn't also approve its invoices. IGA enforces SoD rules in policy and flags conflicting access before it causes a problem, rather than after.
How long does an IGA implementation take?
It depends on the number of applications and the state of your role model, but most programmes deliver value in phases rather than a single go-live. We onboard the highest-risk systems first, so you get audit and risk reduction early instead of waiting for the whole estate to be connected.
Does IGA cover AI agents and machine identities?
It needs to. Non-human identities now outnumber humans by roughly 80 to 1, and AI agents acquire access at runtime. Modern IGA extends governance to service accounts and machine identities, but many legacy programmes still only cover human users, which leaves the majority of access ungoverned. We design for both.
Which IGA platform should we choose?
The right platform depends on your environment, but SailPoint is the platform we most often implement for enterprise IGA in the Nordics. More important than the logo is the design behind it: the role model, the policies and the onboarding order. A good design on a capable platform beats a great platform with no design.
Next step
See what a working IGA programme would look like
An assessment maps your applications, roles and current access, and shows where automation removes manual effort and where your access model would struggle in an audit. If you want to talk through where you're at, we're happy to help.
- Full picture of applications, roles and access
- Onboarding plan ordered by audit risk
- Delivered locally across the Nordics
Oslo · Gothenburg · Stockholm · Copenhagen
