The challenge
As part of the Continuous Diagnostics and Mitigation (CDM) program, the IRS needed to replace an aging, custom-built Oracle Forms identity governance system with a commercial product. The move also meant the agency's first cloud migration, to AWS GovCloud.
The constraints were demanding:
- Move every user and entitlement without business disruption, and keep the complete access audit history intact.
- Support access request workflows with up to 10 levels of approval and different approver groups for each request type.
- Run privileged and non-privileged access certifications for all users.
- Satisfy stringent federal audit requirements from day one.
What Zephon did
As a subcontractor to CDW Government, Zephon led major identity-governance design, implementation, migration, and operational-support work for the SailPoint IdentityIQ replacement. The new solution, branded BEARS (Business Entitlement Access Request System), was deployed in AWS GovCloud in a FedRAMP Moderate environment.
- Privileged access: integrated CyberArk so privileged and standard access are governed from a single interface.
- Monitoring and reporting: integrated Splunk for real-time dashboards and reporting.
- Identity warehouse: designed an inter-agency identity warehouse on Radiant Logic.
- Strong authentication: PIV-based MFA aligned with HSPD-12, with SAML federation.
- Automation: automated all Active Directory provisioning and built role-based access models for managers, approvers, help desk, system administrators, and reporting.
- Migration: a phased approach that carried over every existing workflow, approval, and the full access audit history with no user impact.
Results
- The system supported GAO, FISMA, FedRAMP, and TIGTA audit activities and maintained its Authorization to Operate.
- Multiple access certification campaigns completed since go-live.
- Identity governance standardized across the agency, supporting the DHS CISA CDM initiative.
- Legacy maintenance costs and technical debt eliminated.
Zephon has provided 24x7 Tier 2/3 operational support, continuous patching and POA&M resolution, Agile enhancements, and audit support.
“It has been a pleasure working with Zephon and they are on my go-to list for Identity and Access Management solution expertise.”