This guide helps an IT manager at a firm in India or the GCC choose software for staff access. It is not a ranking. In our working words, the category is a set of tools meant for managing who signs in to what (a plain definition of IAM is on our glossary page). We name no vendor of identity and access management software. We also leave out customer sign-in and machine accounts. Signisys, which wrote this guide, is a services firm with technology partnerships. Weigh our decision rule with that in mind. The route has four moves: count your own accounts, ask every supplier the same questions, test on what you run today, and apply a rule.
Last reviewed 2026-11-01 by Manish Sharma.
Choosing Identity and Access Management Software Starts With Your Own Numbers
Take four counts from your own accounts before you read any proposal.
NCSC’s 10 Steps to Cyber Security page on this subject was published on 11 May 2021 for cyber security professionals. It says a policy should cover who should have access to which systems, data or functionality, why, and under what circumstances. It also names staff, contractors, volunteers, students and visitors as types of user to consider. Note three scoping questions as well: whether your estate is cloud-only or hybrid, and whether the sign-in is for staff or customers. Also note which directories and tools you need connected.
Questions for Every Supplier, Part 1: Accounts and Sign-in
Put the same questions to every supplier of identity and access management software, then compare the written answers. The table is Signisys’ own working list, but it makes no claim about any product.
| Area | Ask the supplier | What the answer lets you prove |
|---|---|---|
| Account life | When an account is created, changed, requested, reviewed or removed, which steps do you cover, and which are left to a person on our side? | You can name an owner for each of those five steps, including the ones the supplier covers. |
| Awkward application | If an application has no automatic account creation or removal, what can you do, and what stays manual? | If you test one real application from your list, its manual steps are written down and an owner is named. |
| Sign-in methods | Can people choose between second factors, and what is an administrator asked when signing in? | Each pilot user completes a sign-in with a factor they chose, and you can also see what an administrator is asked. |
The same NCSC page advises offering people a choice of factors where appropriate, because no single method will suit everyone. It also asks for a joiners, movers and leavers policy, so access can be revoked when no longer needed, or changed for movers.
Questions for Every Supplier, Part 2: Records and Evidence
Part 2 asks each supplier of identity and access management software what you can show, to yourself as well as to an auditor.
| Area | Ask the supplier | What the answer lets you prove |
|---|---|---|
| Records | If a sign-in or permission event is recorded, for how long is it kept, and can the action be tied to a person or account? | If you pick one test action, you can find who did it. |
| The system itself | Who applies security patches to the identity system, and what is monitored while it runs? | You can see an owner for patching and also an owner for monitoring, by name. |
| Exit and evidence | Which report can you give an auditor, and can you take your own data out in an open format if you leave? | You can read a sample report in your auditor’s wording, and you can also open an export of your test data. |
NCSC’s Introduction to identity and access management, published on 22 January 2018 for cyber security professionals, large organisations and the public sector, says that given the high value to an attacker of compromising these systems, they should be given priority for security maintenance. We take only that principle from it, but we date it: the page is from 2018.
Key Takeaway Put the same written questions to every supplier, while you look for what you can prove in a pilot.
Build on What You Run, or Add Identity and Access Management Software?
If your firm runs a directory or a suite, decide whether to build on it or add a product. Decide who carries the work under each route; the pilot in the next section lets you measure how much falls to your own people.
Advantages
Limitations
Before you decide, check your own contracts and documentation for what your current set-up already includes.
A Pilot for Identity and Access Management Software: Five Tests
Run the five tests below on what you run today, and also repeat them in any supplier’s trial. The tests are Signisys’ own working method. Tests 1, 2 and 4 relate to statements in the NCSC and NIST material cited here, and neither body sets them as tests. A pilot for identity and access management software can be as small as a few test accounts and one awkward application.
Create a test leaver and note how long each pilot application takes to refuse their sign-in. Also list any application that needed a manual step.
Change a test user’s role and check whether any access from the old role remains.
Pick one application with no automatic account creation. Record which steps are done by hand, such as creating or removing an account, and who does them.
For one sign-in and one permission change, find the event and check whether it names a person or account.
Take your auditor’s own wording for access evidence and ask whether any report answers it.
NIST’s Cybersecurity Framework 2.0 was published on 26 February 2024 for organisations of any size or sector. Under PR.AA-05 it lists an outcome that access permissions are “defined in a policy, managed, enforced, and reviewed”. The mover test is our way of looking at one part of that outcome.
Identity and Access Management Software: Signisys’ Decision Rule
This rule is Signisys’ own working method and not a standard. The thresholds are our judgement, not measured values. Mark each pilot test pass or fail, and count the fails before you choose a route.
With no fails, keep what you have and name an owner for every task that is still manual. With one or two fails, put the supplier questions for those areas to your current supplier first, and to others if its answers do not let you prove what you need. When three or more tests fail, build a shortlist of suppliers. Put the full set of questions to every name on it. Treat a fail on the leaver test as urgent, even if every other test passes. Repeat the leaver test with a second account, because one account is a small sample. Once you have chosen, the order of work for bringing accounts under one set of rules is in nine ordered steps for setting up access.
Here is an illustrative example, not a client. A firm of 300 people passes the leaver, mover and records tests but fails the awkward-application and auditor-report tests. Under the rule it asks its current supplier about those two areas only. It looks wider if the answers do not let it prove what it needs.
A missing owner is a decision for a person, in a suite or in a product. Name owners before you compare suppliers. To test what you run today before any purchase, use a scored list of sixteen yes-or-no access checks.
Key Takeaway In our rule, three or more failed pilot tests is the point to build a shortlist.
What This Guide Leaves Out, and When to Get Help
This guide ranks no product. It covers staff access only. Questions for accounts that are not people, such as service accounts and other machine logins, are outside this guide. It makes no claim about India or GCC regulation. To see whether access has already drifted, read the six signs that employee access is out of control. The route from scattered logins to one controlled sign-in is also on the page for managing employee identity and access.
In our view, get outside help when three or more pilot tests fail. Do the same when nobody can own the leaver process, or when your auditor’s wording is stricter than your records.
Signisys provides identity and access management, helping organisations control who can access what, with single sign-on, strong authentication, privileged access and automated provisioning. Signisys agrees the exact scope for each engagement. Our Solution: Identity and Access Management (IAM). Our Service: Cybersecurity and Digital Trust.
Identity and Access Management Software FAQ
How do I choose between suppliers?
Which identity and access management software is best?
Can we use what we already run instead of buying a product?
What should we ask about open-source options?
Does this guide cover customer sign-in or machine accounts?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.