Get business involved from the initial stages. Spend some time on user change management, communication and education. Adopt a maturity model of implementation - getting from a paper based access request governance process to a fully automated closed-loop verification one is a large change. It is possible to get small wins for a large number of applications in stages, For example: * Attain visibility into user access first across all applications * Initiate a clean-up of legacy access (this adds a lot of value and reduces potential risk exposure of multiple applications) * Define/workshop technical access and how it correlates to business functions for an application at a time * Implement business rules and violations * Initiate user and access reviews * Automate provisioning.
![RSA Aveksa [EOL] Logo](https://images.peerspot.com/image/upload/c_scale,f_auto,q_auto,w_100/C5Gw2fHy6xLYfrtttEKNkDnK.jpg)
