Cybersecurity Management › Identity & Access Management

Identity & Access Management

BC-620.20 Level 2 Cross-Industry 50 providers 160 API surfaces 21 rated strong or better

IAM, PAM, federation, joiners-movers-leavers.

Identity & Access Management (BC-620.20) is a level-2 business capability under Cybersecurity Management in the Cross-Industry model. The catalog holds 160 API surface(s) from 50 provider(s) that can perform some part of it, 21 of them rated strong or better. Reach is the vendor surface that lands on this capability — it is not a claim about what any particular organisation has deployed.

Where this capability definition comes from. This capability is part of a published business-architecture model that API Evangelist did not author. It is redistributed here under CC-BY-4.0. Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0 Changes: Consolidated from 333 per-L1 YAML files into one JSON; English only (upstream i18n/ omitted); descriptions whitespace-normalised. No capability was added, removed, renamed or re-parented. Source repository · NOTICE and third-party framework attributions

Sub-capabilities

Identity Lifecycle Management BC-620.20.10

Joiner, mover, leaver processes and identity provisioning.

no catalog coverage

Access Management and Authentication BC-620.20.20

Authentication, MFA, single sign-on, and federation.

no catalog coverage

Privileged Access Management BC-620.20.30

PAM, just-in-time access, and privileged session monitoring.

no catalog coverage

Access Governance and Recertification BC-620.20.40

Access reviews, segregation of duties, and recertification.

no catalog coverage

Customer Identity Management BC-620.20.50

CIAM for external customers, partners, and consumers.

no catalog coverage

Providers that reach this capability

Ordered by rating band. Reach means a provider publishes an API surface that can perform some part of this capability — it is not a claim that any particular organisation has deployed it.

Exemplar 7 Complete, well-documented, and agent-ready
ThousandEyesRolesUsers2 APIs71.2SignalWireMulti-Factor Authentication1 API68.9Sigma Computingteams1 API68.8Cisco Catalyst SD-WANAdministration - User and Group1 API68.4WorkRampScim1 API67.7DoiTUsers1 API66.5Showpadusergroups1 API66.5
Strong 14 Solid coverage with minor gaps
NexGen CloudRBAC RoleUser Permission2 APIs65.6Cisco Identity Services EngineADGroupsActiveDirectoriesAdmin GroupsAdmin Users65 APIs64.4NexlaUsers1 API62.2Rhombus SystemsPermission WebserviceUser Webservice2 APIs62.2NasuniIAM1 API61.9PixieBrixgroups1 API61.1Sift StackUserGroupService1 API60.7Cisco UmbrellaUsers1 API59.3MaltSCIM1 API58.5EVEDEXACLAuth2 APIs57.6Cisco Secure FirewallAPI EntitlementPolicy Based Access Control PrivilegePolicy Based Access Control RolePolicy Based Access Control User8 APIs57.4Brandfolderuser_permissions1 API55.8Cisco Intersightiam1 API55.8BigtincanUser1 API54.5
Developing 13 Usable, with meaningful gaps to close
Platform.shGrantsMFAOrganization MembersTeam Access6 APIs52.9Bevzintegrator_users1 API52.5TrustArcPermissionProfilesUserProfilesUserProfiles-ActivationsUserProfiles-Users6 APIs51.6PartsTechuserusers2 APIs50.9Cisco Crossworkauthconfigpasswordrbac3 APIs50.2University of AmsterdamSSO Settingsjwt_mappingskey managementscim4 APIs48.9Flume HealthUsers1 API48.2University of GroningenRolesUsersuser3 APIs47.0Oxidepolicysilossystem/silostokens4 APIs45.8MetabolonUsers1 API44.2Université de MontréalRolesUsers2 APIs43.9SpyderbatOrgRBACSTS3 APIs39.7King Fahd University of Petroleum & Mineralsuser1 API39.4
Thin 13 Limited public surface area
Maastricht UniversityRolesUsers2 APIs37.4MealieAdmin: Manage Users1 API37.0InfoworksSecurityUsers2 APIs35.8SparkyFitnessAdmin1 API34.2UCLouvainRolesUsers2 APIs33.0PavootAdmin1 API31.7Tecnológico de MonterreyRolesUsers2 APIs31.4National University of SingaporeAuthorizationSession2 APIs31.3CacheflowUsers1 API30.3FlueidAccountPermissions2 APIs30.2Norwegian University of Science and TechnologyRolesUsers2 APIs29.9University of North Carolina at Chapel HillRolesUsers2 APIs28.2Queen's University at KingstonRolesUsers2 APIs28.0
Emerging 3 Early or largely undocumented
University of ChileRolesUsers2 APIs24.1Queen's University Belfastroleuser2 APIs22.0Yonsei Universityuser1 API17.6
This page carries no rating. Capabilities are not rated. A capability is a description of what a business does, not a thing a company publishes, so a Kin Score would have nothing to measure.
The edge table is a Pro feature. This page shows which providers and tags reach Identity & Access Management. The underlying tag → capability edges — each with the quoted fragment of the provider's own OpenAPI that evidences it, a calibrated confidence score, and the contract-provenance gate it passed — are available through the API, along with company-level capability maps. Only edges at confidence ≥ 0.7 with evidence found verbatim in the source contract are published at all.

See plans →  ·  How the edges are graded →