Glossary term
IGA
Also: Identity Governance and Administration
Software category for identity governance: lifecycle management, role modelling, access recertification, segregation of duties, audit trail. Pulls the governance layer out of IAM.
Core functions: identity lifecycle (joiner-mover-leaver), role modelling and mining, access request with approval, access recertification (typically quarterly), segregation-of-duties checks, audit reports.
Market leaders: SailPoint, Saviynt, Omada, One Identity Manager, IBM Verify Governance, RSA Identity Governance. Cloud-native is still young; many companies combine on-prem IGA with cloud IAM.
In practice
Audit cases: joiner-mover-leaver discipline is a classic pain point in BAIT/VAIT audits. IGA is often the only solution covering all three phases with evidence.
Related terms
IAM (Identity and Access Management)
The stack of systems that governs who has access to which systems under which conditions. IAM covers authentication, single sign-on, lifecycle management, access governance (IGA) and privileged access management (PAM), and is the most commonly breached control in enterprise environments.
PAM
Software category for governing privileged access: vault, session management, just-in-time permissions, session recording, zero standing privilege. Mandatory stack under NIS2 and DORA for admin access.
Joiner-Mover-Leaver
Standard-Workflow im Identity-Lifecycle-Management: Onboarding (Joiner), Rollenwechsel inkl. Berechtigungs-Anpassung (Mover) und Offboarding mit Berechtigungs-Entzug (Leaver). Die Qualität des JML-Prozesses ist ein zentrales NIS2/DORA-Audit-Kriterium.
ICT Concentration Risk
Risk arising from dependence on a small number of or a single ICT third-party provider. DORA Art. 29 obliges financial entities to perform an explicit analysis and steering. Supervisors focus particularly on cloud hyperscalers and core banking system providers.
ISO 27001
International standard for information security management systems. Current version ISO/IEC 27001:2022. Certifiable through accredited bodies. Core framework for ISMS implementation, risk treatment, continuous improvement.
ISO 27002
Companion standard to ISO 27001 that fleshes out the 93 Annex A controls. Not certifiable, but the practical handbook for implementation.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.