Identity and Access Management Vendor Evaluation Guide for Australian Organisations

Identity and access management (IAM) controls who can sign in, what they can reach and how that access is granted, reviewed and removed. It covers several product types that are often bought separately: an identity provider for single sign-on and multi-factor authentication (MFA), identity governance for joiner, mover and leaver processes and access reviews, privileged access management (PAM) for administrator accounts, and identity threat detection and response (ITDR). Buying well starts with knowing which of those gaps is causing the most risk.

CYBORIUM helps Australian organisations compare IAM products and implementation partners through a structured vendor-neutral sourcing process. The selected provider pays CYBORIUM a capped fee. The client contracts directly with that provider, and CYBORIUM does not sell, deliver, operate or invoice the technology.

Find the identity gaps first

Look at where access problems actually occur. Common findings include accounts that stay active after people leave, contractors with no end date, shared administrator accounts, applications that do not support single sign-on, MFA that can be bypassed by approving a push prompt, and service accounts with broad permissions that nobody reviews.

Map each gap to the capability that fixes it. Leaver accounts point to identity governance. Push-approval attacks point to phishing-resistant MFA. Shared administrator passwords point to PAM. This keeps the purchase focused and prevents a large platform being bought to solve one problem.

Five areas that decide IAM value

1. Application coverage

List your applications and mark which support modern federation standards such as SAML or OpenID Connect, which support automated provisioning, and which rely on local accounts. Ask each vendor how it handles the legacy applications, because they usually carry the most risk.

2. Authentication strength

The ASD Essential Eight maturity model expects phishing-resistant MFA at higher maturity levels. Check which methods the product supports, such as FIDO2 security keys and platform passkeys, and how it handles users who cannot use them.

3. Lifecycle automation

Test how the product connects to the HR system as the source of truth, how quickly access is removed when someone leaves, and how access reviews are run and evidenced. Ask for a sample access review report.

4. Privileged and machine identities

Administrator accounts and service accounts are frequent targets. Confirm whether the platform manages them or whether a separate PAM or secrets management product is needed, and how the products integrate.

5. Implementation effort and cost

Pricing is usually per user per month, with separate tiers for governance, PAM and advanced threat detection. Implementation effort often exceeds the first-year licence, especially for governance. Ask for a delivery plan based on your application list, and price contractors and external users explicitly.

Common IAM failures to test for

• MFA rolled out but exceptions left open for executives, legacy protocols or service desks.
• Single sign-on in place while local accounts remain active in the same applications.
• Access reviews that ask managers to approve long lists without context, so everything is approved.
• No owner for service accounts and API keys.

A comparable evaluation

Give each shortlisted vendor the same application list, user populations and scenarios: a new starter, a role change, a contractor leaving early, and an administrator needing temporary elevated access. Ask them to show each scenario working end to end. Score alongside written evidence on authentication methods, integration effort, reporting, data location, resilience of the sign-in service and three-year cost.

Contract points to settle

The identity provider is a single point of failure for every connected application. The contract should state availability commitments, incident notification, where identity data is stored, how you can export users and configuration at exit, and how users are counted for billing. Separate the software licence from any partner’s implementation deliverables.

CYBORIUM’s role in the decision

CYBORIUM can map identity gaps to capabilities, prepare the scenarios, coordinate vendors and partners, evaluate evidence and model cost. The organisation keeps the decision and contracts directly with the selected provider. See also the guides to privileged access management, secrets management and ZTNA.

Updated 15 September 2026. This guide explains CYBORIUM’s procurement evaluation method. It does not provide legal or regulatory advice.

Standards and further reading

Identity is the control most often bought as a product and delivered as a programme. These three help you size the programme before signing for the product.

• NIST SP 800-63-3. Assurance levels for identity proofing, authentication and federation. Decide the level you need before comparing products, because it changes the shortlist.
• ASD Essential Eight explained. Multi-factor authentication and restricting administrative privileges are two of the eight. An IAM purchase should move both, measurably.
• ISO/IEC 27001:2022. Access control requirements that an auditor will test, which is the standard your implementation has to satisfy rather than the vendor default.

Also relevant: privileged access management procurement, and business email compromise starts with a credential, and credentials used by applications rather than people.

Last updated: 22 October 2026