SailPoint IdentityIQ (IIQ)

IIQ Architecture

IdentityIQ runs on a Java application server (typically Tomcat or WebLogic) backed by a relational database (SQL Server, Oracle, or MySQL). The system's customization surface is Java and BeanShell, executed inside the IIQ container and reaching the SailPoint API directly.

Architectural decisions made up front determine whether IIQ operates predictably at the enterprise scale it was built for or accumulates technical debt and runtime instability:

• Database sizing and index strategy
• Partition counts and thread budgets for Identity Refresh and Aggregation
• Extended and searchable attribute model
• Connector deployment topology

Configuration First, Customization Last

SailPoint has hundreds of engineers improving IdentityIQ on a continuous release cadence. The fastest way to turn an IIQ deployment into a multi-year quagmire is to out-engineer them with custom code, workflows, forms, and rules that only a handful of consultants understand - all of which must be re-validated on every system upgrade.

GCA's discipline is the opposite: configure first, customize only when configuration genuinely cannot meet the requirement, and keep customization small, isolated, and upgrade-safe. Out-of-the-box IIQ features - Lifecycle Events, Certifications, Policies, standard connectors - are exhausted before any rule is written.

Rules that genuinely are unavoidable are idempotent, defensively coded, version-controlled, documented, and aligned to SailPoint's published patterns. The result is an IIQ implementation your internal team can operate, audit can trace, and that survives quarterly patches and major upgrades without months-long rewrite projects.

Performance and Task Tuning

IIQ task definitions (Identity Refresh, Aggregation, Certification Generation) operate on full identity cubes and degrade quickly without explicit tuning. GCA scopes every IIQ implementation against population size and database capacity.

GCA's approach to IIQ performance includes:

• Partition tasks for populations above ten thousand identities
• Set thread counts explicitly rather than accepting defaults
• Declare filtering scope so tasks do not unnecessarily scan the entire tenant
• Validate expected runtime in a non-production environment before production cutover
• Aggregate throughput and per-identity refresh time budgeted up front, not discovered in production

Regulated Verticals

IIQ has historically been the system of choice for regulated enterprises (healthcare, financial services, energy/utilities, and federal supply-chain organizations) precisely because the on-premise model preserves data residency, the customization surface accommodates legacy and bespoke applications, and the system produces the audit-evidence depth that the major regulatory frameworks expect.

GCA's IIQ engagements in regulated verticals map certification campaigns, SoD policies, and provisioning audit trails directly to the relevant control families:

• SOX Section 404: Access certification for financial systems, SoD enforcement, quarterly evidence packages
• HIPAA Security Rule: PHI-handling application scoping, audit controls, unique user identification
• PCI-DSS: Cardholder data environment access reviews, requirement 7 and 8 compliance
• NERC CIP: Personnel access governance for Critical Cyber Assets, CIP-004-7 evidence
• NIST SP 800-53: AC family access control mappings, continuous monitoring evidence

Discovery & Architecture

GCA maps the current-state identity environment: identity populations, application inventory, existing access controls, and compliance requirements. This phase produces the foundational data model and IIQ architecture design - database sizing, partition strategy, connector topology, and customization boundaries - that drives every downstream decision.

Configuration & Build

GCA configures connectors, builds lifecycle rules, implements certification workflows, models roles, and integrates IIQ with downstream systems. All configuration follows the configuration-first principle: out-of-the-box features are exhausted before any rule is written. Customization is minimized, version-controlled, and upgrade-safe.

Testing & Validation

GCA validates provisioning workflows, access certification behavior, SoD enforcement, and task scheduling against documented test cases. Performance tuning is validated in non-production before production cutover. Test evidence packages satisfy auditor requirements from day one.

Deploy & Operate

Production deployment follows a controlled rollout with go-live checkpoints and rollback procedures. Post-deployment, GCA provides managed operations: connector health monitoring, certification campaign execution, system upgrades, and quarterly governance reviews that keep the IIQ deployment sustainable.