Identity and Access Controls The objective of identity and access controls is to help establish and maintain overall access policies that strengthen computer security in a way that: Assigns access to critical systems on a business "need to know" basis Limits unauthorized employees’ ability to execute, approve and view transactions The impact of strong policy controls is that separation of duties is effectively maintained and access is appropriately assigned. However, unauthorized access to financial applications and related data are significant deficiencies that must be reported to the organization’s audit committee. BMC Software Solutions The BMC Identity Management Route to Value enables centralized and delegated management of identities and access privileges. It includes a solution suite that delivers single sign-on for Web and non-Web environments, self-service password management, auditing and reporting capabilities, plus automatic notification and corrective actions in response to access policy violations. Identity Management allows IT to enforce segregation of duties between those who request and those that approve access rights. The BMC Identity Management Route to Value specifically addresses five IT control objectives, as specified by the IT Governance Institute’s adaptation of COBIT for Sarbanes-Oxley IT audit preparation. COBIT suggests general IT controls that ensure financial reporting systems and subsystems are appropriately secured to prevent unauthorized use, disclosure, modification, damage or loss of data. Using BMC Identity Management solutions, companies can: Eliminate the most serious and potentially dangerous security risks by monitoring the access behavior of authorized users Identify and fix weaknesses in controls and processes by evaluating normalized enterprise-wide data and log information Use compliance modules to monitor and report on relevant activities and data Comply with other regulations: easily integrate new regulatory and internal auditing requirements into their identity management processes