SailPoint Identity Solutions

Without identity governance, privileged accounts multiply unchecked, access reviews become checkbox exercises, and audit findings pile up. Organizations without SailPoint IGA spend weeks preparing for SOX or HIPAA audits, manually tracking access across hundreds of applications, and discovering compliance gaps only after regulators point them out. The cost isn't just audit findings - it's the operational drag of an identity program that never matures beyond spreadsheets and tribal knowledge.

With SailPoint implemented by GCA, identity governance becomes the operational backbone of your compliance program. Access reviews run on schedule with evidence packages that auditors can retrieve without a reconstruction effort. Provisioning happens automatically when employees join, change roles, or leave. Segregation of duties policies enforce themselves, and your IAM team spends time optimizing governance rather than firefighting access requests.

SailPoint IdentityIQ is the on-premises identity governance platform that has served as the backbone of enterprise IGA programs for over a decade. Deployed within a customer's own data center or private cloud, IIQ gives organizations complete control over their identity infrastructure, data residency, and integration topology. For regulated industries that cannot or choose not to move identity data to multi-tenant SaaS, IIQ remains the deployment model of choice.

At its core, IIQ is built on a Java-based architecture with a powerful workflow engine that orchestrates employee identity lifecycle events across the organization. Every access request, certification decision, and provisioning action flows through configurable workflows that enforce business rules, approval chains, and escalation policies. GCA configures these workflows to match each client's operational reality, balancing governance rigor with end-user experience.

IIQ's BeanShell scripting engine provides extensibility for complex business logic that out-of-the-box configuration cannot address. GCA uses BeanShell to build custom correlation rules, transform entitlement data during provisioning, and implement conditional approval logic for high-risk access decisions. Every script is version-controlled, peer-reviewed, and documented to avoid the technical debt that unplanned customization creates.

The connector framework supports integration with directories, databases, HR systems, ERP platforms, and cloud applications through a library of built-in connectors and a configurable provisioning engine. GCA implements connector configurations with production-grade practices: connection pooling, error handling, retry logic, and monitoring hooks that feed into operational dashboards. IIQ's task definition framework allows scheduled aggregation, certification campaign execution, and compliance report generation to run on automated cadences, reducing the operational burden on IAM teams.

SailPoint Identity Security Cloud is the cloud-native SaaS identity governance platform that delivers the same core capabilities as IdentityIQ without requiring on-premises infrastructure. ISC is built on a multi-tenant architecture hosted and maintained by SailPoint, freeing internal teams from patch management, infrastructure sizing, and platform upgrades. For cloud-first organizations, a SailPoint ISC implementation is the fastest path to a production identity governance program.

ISC's architecture is API-first, providing a comprehensive REST API that covers every administrative and operational function. GCA uses the API to build automation pipelines, integrate SailPoint with ITSM platforms like ServiceNow, and create custom dashboards that surface governance metrics to executive stakeholders. Event Triggers allow ISC to publish identity events in real time to external systems, enabling downstream processes to react to access changes as they happen.

Transforms in ISC are the data manipulation layer that maps, filters, and reshapes identity data as it flows between SailPoint and connected systems. GCA configures transforms to normalize attributes from disparate HR sources, map entitlements to role models, and generate provisioning payloads for target applications. The transform framework replaces the scripting-heavy customization model of IIQ with a declarative, maintainable configuration approach.

ISC ships with a library of pre-built connectors for SaaS applications including Microsoft 365, Workday, Salesforce, ServiceNow, and hundreds of others. These connectors reduce integration timelines from weeks to days and are maintained by SailPoint as vendors update their APIs. For applications without pre-built connectors, ISC's Connectivity+ framework supports generic REST and SCIM integration patterns that GCA configures per-client.

GCA follows a structured six-phase implementation methodology that transforms a SailPoint deployment from initial assessment into a sustainable, audit-ready identity governance program. Each phase has defined deliverables, client touchpoints, and quality gates that prevent scope creep and ensure alignment with business objectives.

SailPoint IGA addresses industry-specific identity governance challenges that generic access management tools cannot solve. GCA implements SailPoint with configurations tailored to each industry's regulatory framework, operational patterns, and audit expectations.

Healthcare: Hospitals and health systems deploy SailPoint to govern clinician access across EHR platforms, clinical applications, and administrative systems. GCA configures access certification campaigns that align with HIPAA minimum necessary requirements, ensuring physicians, nurses, and allied health professionals retain only the access required for their role. Automated provisioning tied to credentialing workflows ensures new clinicians receive appropriate access on day one while former clinicians lose access within hours of separation.

Financial Services: Banks, credit unions, and insurance companies use SailPoint to enforce segregation of duties (SoD) policies across core banking systems, trading platforms, and financial applications. GCA builds SoD policy models that prevent conflicting access combinations while allowing operational flexibility through compensating controls and exception workflows. This approach satisfies OCC, FFIEC, and SOX auditors while keeping business processes moving.

Government: Federal agencies and state governments deploy SailPoint to meet FedRAMP, NIST 800-53, and FISMA identity governance requirements. GCA implements SailPoint in FedRAMP-authorized environments and configures access control models that satisfy continuous monitoring and authority-to-operate requirements. Our government implementations include automated access reviews tied to security control assessments and evidence generation for annual audits.

SailPoint NERM (formerly SecZetta) is the purpose-built module for governing contractor, vendor, consultant, and third-party identities that fall outside the HR system of record. Most organizations manage non-employee access through spreadsheets, shared mailboxes, or informal sponsor relationships, creating uncontrolled risk that grows with every new engagement.

NERM establishes a structured system of record for non-employee populations with sponsor-owned, time-bound access that automatically expires when the engagement ends. Contractors onboard through a self-service portal that captures required documentation, assigns a risk score based on role and access scope, and routes through approval chains before provisioning begins. Sponsors receive regular notifications to revalidate access, ensuring that non-employee privileges remain aligned with active engagements.

GCA implements NERM as either a standalone governance layer for non-employee populations or as an integrated extension of the broader SailPoint IGA platform. When integrated with IIQ or ISC, NERM provides unified visibility across employee and non-employee populations, enabling cross-population SoD enforcement and consolidated access certification campaigns. For organizations subject to supply chain risk management requirements, NERM provides the auditable evidence trail that demonstrates third-party access is governed with the same rigor as internal access.

Organizations running IdentityIQ on-premises increasingly evaluate migration to Identity Security Cloud to reduce infrastructure overhead, use AI-powered governance features, and align with cloud-first strategies. GCA approaches IIQ-to-ISC migration as a phased transition rather than a rip-and-replace, preserving existing governance investments while introducing cloud-native capabilities incrementally.

The migration path typically begins with a coexistence strategy: ISC connects to the same identity sources as IIQ, and GCA migrates application connectors and governance workflows in priority order. This approach allows organizations to prove ISC in production for a subset of applications before committing to full migration. GCA manages the coexistence period to prevent governance gaps, duplicate entitlements, and certification conflicts between tools. For organizations that choose to maintain IIQ indefinitely, GCA provides ongoing managed services for both tools and advises on hybrid architectures that use the strengths of each deployment model.

IIQ to ISC Migration Deep Dive →