Skip to main content
Style:
Size:

Chapter 13: Building Your IAM Roadmap

We have reached the end of the journey. You have the theory, the framework, and the target architecture. Now, you need the map to actually get there.

A Target Operating Model (TOM) tells you what you are building. The Roadmap tells you when and how you are going to build it without getting fired along the way.

If you try to implement a massive Identity overhaul in a single "big bang" release, you will fail. You will break production, lock out the CEO, and the project will be canceled by Friday.

The secret to a successful IAM roadmap is iterative value delivery. You must prove to the business that you are making them safer and faster in small, measurable chunks. We break the roadmap into three horizons.

Horizon 1: Fix the Basics (Months 0-6)​

The Goal: Stop the bleeding and secure the perimeter.

In this phase, you are not buying fancy AI security tools. You are closing the massive, gaping holes in your current infrastructure.

  1. The Orphan Account Purge: Run a script comparing Active Directory to the HR database. Disable any account that belongs to a terminated employee. (This is your ultimate "Quick Win").
  2. Phishing-Resistant MFA (Humans): Roll out FIDO2 security keys or device-bound biometrics to your highest-risk users (IT Admins, Executives, Finance). Do not roll this out to everyone yet.
  3. NHI Discovery (Bots): Run automated scanners across your code repositories and network traffic. You don't need to fix the bots yet; you just need to know how many you have.
  4. Just-In-Time (JIT) Access (Control): Revoke 24/7 Domain Admin rights from your IT staff. Implement a portal where they must check out permissions for a maximum of 4 hours.

Horizon 2: Automate & Segment (Months 6-18)​

The Goal: Remove the humans from the process and build the bulkheads.

Now that the bleeding is stopped, you start building the Target Operating Model architecture.

  1. HR-Driven Provisioning (Joiner/Leaver): Integrate your Identity Provider directly with the HR system. When HR clicks "Hired," the accounts are created automatically. When HR clicks "Terminated," the VPN is killed instantly.
  2. Zero Trust Network Access (ZTNA): Begin migrating applications off the traditional VPN and behind the Identity Proxy. Start with low-risk internal web apps before moving to critical infrastructure.
  3. Secrets Management (NHI): Take the critical service accounts you discovered in Horizon 1 and migrate their static passwords into a Secrets Vault.
  4. Micro-segmentation: Work with the network team to ensure that vault-managed bots are locked into specific VLANs with strict host-based firewall rules.

Horizon 3: Modernize & Autonomous (Months 18-36)​

The Goal: Dynamic trust and AI workload governance.

This is where you implement the advanced frameworks we discussed in the latter half of the book.

  1. Ephemeral Tokens (Bots & AI): Move away from static Vault passwords and implement dynamic, short-lived tokens for all service-to-service communication.
  2. Continuous Certification (Mover): Roll out automated, human-readable access reviews. Implement an Anytime Review Cycle (ARC) dashboard so managers can visually audit permissions rather than rubber-stamping spreadsheets.
  3. Contextual Bounding: Upgrade your ZTNA policies to include device posture.
  4. AI Security Proxy & Circuit Breakers: Deploy the guardrail middleware for any internal AI deployments. Enforce the Human-in-the-Loop thresholds for high-risk autonomous actions.

Visualizing the Timeline​

A successful roadmap relies on strict dependencies. You cannot implement ZTNA (Horizon 2) if you haven't deployed Phishing-Resistant MFA (Horizon 1).

Interactive Tool: The Roadmap Dependency Explorer​

Adjust phase durations and explore how upstream delays affect downstream Horizon 2 & 3 milestones:

IAM Roadmap & Critical Path Dependencies

Adjust foundational milestone durations to see how dependency delays cascade across Horizons 1, 2, and 3.

Prerequisite for ZTNA Migration.

Prerequisite for AI Guardrail Proxy.

M0
M6
M12
M18
M24
Horizon 1 & 2 (Human Workloads)
FIDO2 MFA Rollout (3m)
ZTNA Network Migration (5m)
Horizon 2 & 3 (Non-Human & AI Workloads)
Secrets Vault Migration (6m)
AI Guardrail Proxy Deploy (4m)

The Final Review: The 5 Pillars of Success​

As you execute this roadmap, your project will veer off course. A vendor will overpromise, a stakeholder will push back, or a new AI capability will completely disrupt your architecture. When you get lost, step back and evaluate your current challenge against the 5 Pillars:

  • People: Are the owners clearly defined, and is the leadership team trained on the changes?
  • Process: Are we automating a good process, or just speeding up a broken one?
  • Technology: Is the software enforcing the Zero Trust architecture, or are we falling back to legacy flat networks?
  • Control: Are we applying the right guardrails (MFA, JIT, Scoped Tokens) to the right identities?
  • Impact: Are we successfully reducing the blast radius of a breach?

If you can answer those questions confidently, you are not just building an IAM program. You are building an organization that can survive the chaotic, inevitable transition from Human Workloads to the Autonomous AI Future.

Good luck out there.