"Cyber risks linked to onboarding and offboarding processes are considerable if they are not controlled within organizations".

‍

Background at Adista

In just a few years, the Adista group has grown from 400 employees to nearly 1,000. To support this growth, the Human Resources department was equipped with an HRIS to manage the employees and ensure the entry/exit of employees. Philippe De Guis, the group's CIO, received information on new arrivals and departures and the following questions were asked for each employee movement:

• What should be prepared for each employee? Computer equipment, software access, cards/badges, company cars, etc. A lot of exchanges by email, Teams, tickets ... took place with HR, managers, general resources to know precisely what each one should prepare.
• Who has what? When an employee leaves, how can you be sure that all the employee's physical assets are returned and that all accesses are deactivated?

This lack of visibility on allocated resources was generating within the IT department :

• A lot of time wasted by IT teams to know "who has what", to recover the material and to make it enter a virtuous circle of recycling if necessary.
• Money down the drain - access/licenses remained active or equipment was not returned by employees who had left the company several months earlier.

Philippe De Guis therefore looked for a solution to meet these three challenges and allow perfect coordination between departments when each employee arrives/departs (hardware, software, badges, cars, etc.).  

"So I decided to develop our own in-house solution because we had a team of developers on hand, it took me several years but we got there."

3 steps to structuring the inflow and outflow of employees

1. Organize the decentralization of resources by working hand in hand with the businesses: 

With SaaS, IT has lost visibility on all the applications used because the business can move forward in their own way without involving IT.

Philippe De Guis explains: "The explosion of the SaaS mode means that if I had to control everything, I would spend my life acting as a policeman, and that's not at all what I want to do. I prefer, through an IT policy applied by all, to delegate to the business departments a part of the responsibility of using the applications, while associating a governance system that provides the necessary visibility.

IT must therefore be perceived by the business as a facilitator rather than a hindrance to the purchase of SaaS solutions, so that it is systematically involved in the choices. Therefore, the business can ensure the functional administration of their applications (user creation, etc.), but IT must remain the technical administrator (system security).

"The more the CIO shifts the responsibility of choice to the business with a minimum of prerequisites, the more the business will want to get on board. But if the CIO asks 50,000 questions and imposes conditions that are too restrictive... we go into "let's live happily ever after" mode!

"I am increasingly informed upstream of the choices and devices, because I am not in a mode where I want to control everything, understand everything, etc. On the other hand, I do put in prerequisites (security) but I don't question the functional needs of the business."

In short: align & organize yourself by coaching managers according to Philippe. This is how he has designed his approach.

"The business is responsible for processing the application, the IT department checks with the publisher on security aspects, compliance with regulations (RGPD) and integration into the information system."

2. Build a Resource Catalog and allocation rules according to Employee Profiles

This collaboration between HR, the business lines, IT, general resources and purchasing enables us to draw up an exhaustive list of resources to be allocated when an employee arrives, and to ensure traceability right through to the employee 's departure.

"By knowing what is installed, I can verify that we don't have 10 tools to do the same thing: cost reduction and economies of scale."

This Resource Repository allows:

• Identify precisely who are the internal administrators who should receive the requests for the arrival/departure of each employee.
• To define the different employee profiles in order to list the necessary resources for each one.

"Mapping resources/profiles is "a pain in the ass". It's hours of discussion with each department to initiate the process. Now that it's done, we just have to do maintenance as we go along. [ ...] Today, onlythe IT department can make changes given the automation involved."

3. Enabling matrix and automation

After drawing up the Resource Catalogue and answering the question "who should have access to what", we had to build the authorization matrix to link the resource catalog, the profiles used and the rights to be assigned in a LMA (Read, Modify, Administer) logic.

The resulting table of theoretical authorizations can then be used to trigger :

• Automatic creations in the AD with the right security groups, 
• Automations in third-party software solutions via API,
• Sending emails to different people in the organization to ensure the necessary allocation/unallocation for each employee.

The Resource Catalog could be connected to the HRIS so that all staffing could be done throughout the employee's life cycle with regular review phases for all employees in order to compare the theory (LMA matrix) and the reality in third-party solutions.

Consequences and ROI

Philippe De Guis went from 3h to less than 10min today for the allocation of resources during arrivals and departures.

"Cross email exchanges, follow-ups and chat teams: all that is over."

The solution that Philippe developed internally is very efficient but it also took a lot of energy and development time to achieve...   

"A packaged solution would have been ideal, but I hadn't found anything satisfactory that connected with our HRIS. At the time, I would have liked to have an umbrella like Pyla, to protect me from cyber risks related to entry/exit and better control our investments regarding employee movements."

Questions to ask yourself about whether it's the right time to implement a solution like Pyla:

• If tomorrow employees leave and new ones arrive, am I able to welcome them properly to integrate them efficiently and to prepare the growth of my company? 
• Even if I have little turnover, have I structured and documented these processes so that I am not dependent on expertise acquired over time?

For Philippe, "Being able to anticipate is also an absolute priority".

‍