Skip to main content
Modern 42
Contact Us
Modern 42 advisors developing an IAM and PAM strategy roadmap with a client team
Advisory & Strategy

An IAM strategy and roadmap tied to business outcomes.

Most identity strategies fail because they are technology shopping lists, not business plans. We build roadmaps that start with what your organisation needs to achieve, then work backwards to the right controls.

Talk to our teamView all advisory services
Our approach

What makes a good identity strategy

The difference between a strategy that drives change and one that sits on a shelf.

Starting point
Effective strategy
Business objectives and risk posture
Typical strategy
Technology wish list
Roadmap
Effective strategy
Phased, costed, aligned to budget cycles
Typical strategy
Aspirational slide deck
Stakeholder buy-in
Effective strategy
Board-ready business case included
Typical strategy
Technical document only
Framework alignment
Effective strategy
Mapped to ASD Essential Eight, APRA CPS 234, ISM, SOCI and/or NIST
Typical strategy
Generic best practices
Actionability
Effective strategy
90-day quick wins with clear owners
Typical strategy
Long-term goals with no accountability
Follow-through
Effective strategy
Engineering team available to execute
Typical strategy
Strategy ends at the PDF
Modern 42 advisory team presenting IAM and PAM strategy roadmap to enterprise stakeholders
Industry Research100+

identity and privilege security projects delivered for Australian organisations across six industries

Start your roadmap
What we deliver

Six deliverables, one coherent strategy

Each component of the strategy engagement builds on the last.

01

Current state assessment

Documented inventory of your existing identity and privilege controls, gaps, and technical debt.
02

Gap analysis

Structured gap analysis against the frameworks relevant to your organisation (ASD Essential Eight, APRA CPS 234, ISO 27001, NIST).
03

Target architecture

A defined target state for IAM and PAM, including platform choices, integration patterns, and identity governance model.
04

Prioritised roadmap

A 90-day, 6-month, and 12-month roadmap with clear priorities, dependencies, and effort estimates.
05

Business case support

Supporting materials for securing budget and executive sponsorship for identity investments.
06

Framework alignment

Documentation mapping your target state to regulatory and compliance requirements.
Sample roadmap

A sample IAM strategy and roadmap

The shape of a typical roadmap. Yours follows from your own gap analysis, so the initiatives and timing will differ.

01

First 90 days: quick wins

Low-cost changes that remove the most risk, each with a named owner. Typical examples: phishing-resistant MFA for administrators, removing standing Global Administrator assignments, testing break-glass accounts, and disabling stale and orphaned accounts.Decision point: confirm the quick wins have landed before the next tranche of budget is committed.
02

Months 4-6: foundations

The platform work everything else depends on. Typical examples: HR as the authoritative source for joiner-mover-leaver, a Conditional Access baseline, and vaulting tier 0 privileged credentials in your PAM platform.Decision point: platform choices are locked in here, so this is where a product evaluation happens if one is needed.
03

Months 7-12: governance

Controls that keep access correct over time. Typical examples: access reviews for high-risk applications, access packages for common roles, PAM extended to servers and third-party vendor access, and a re-measure against your target Essential Eight maturity level.Decision point: the re-measure shows whether the plan for year two still holds.
04

Years 2-3: larger programs

Complex estates continue in six-month increments, each with a measurable business objective, so funding can be justified one increment at a time. Typical work: retiring a legacy IAM platform, onboarding applications at scale, and customer identity (CIAM).Decision point: each increment is approved on the results of the last.

We used this structure for a state government organisation whose IAM platform had been in place for over a decade: a current-state assessment against our IAM Capability Model, a target state aligned to its corporate, IT and cyber strategies, and a three-year roadmap that meets measurable business objectives in each six-month period. Read the state government case study.

Who this is for

Common starting points

Strategy engagements are right for a range of situations.

  • New CISOs establishing a security baseline for their first 90 days
  • Organisations preparing for an APRA, IRAP, or ISO 27001 audit
  • Boards or executives requesting a structured security posture report
  • Organisations planning a major platform migration (Entra ID, BeyondTrust)
  • Post-incident reviews requiring a thorough identity control assessment
  • Mergers or acquisitions requiring identity consolidation planning
Team planning an identity security roadmap
Case Studies

See the work delivered

Comparable engagements we have delivered. Client names are withheld; the work is not.

View all case studies
State Government01

IAM Strategy and Roadmap for a State Government Organisation

A state government organisation engaged Modern 42 to assess its legacy IAM platform and chart a path forward.

3-year roadmapSix-month value incrementsProduct-agnostic
Retail Property / Real Estate02

End-to-End PAM Capability Uplift for a Major Australian Retail Property Group

A major Australian retail property group partnered with Modern 42 over multiple years to embed a mature Privileged Access Management capability.

BeyondTrust deployed24 app access reviewsMulti-year partnership
Federal Government03

Transforming Identity and Cyber Capability for a Federal Government Department

A large Australian Government department partnered with Modern 42 to overhaul its identity infrastructure and strengthen its cyber security posture.

Multi-year partnershipLegacy MIM replacedASD ISM aligned
FAQ

Common questions

How long does an IAM and PAM strategy engagement take?
Typically four to six weeks from kickoff to final roadmap delivery, depending on the scope and complexity of your environment.
What security frameworks do you align IAM strategies to?
We align to the frameworks most relevant to your organisation. For Australian government: the ASD Essential Eight, IRAP, ISM, and PSPF. For financial services: APRA CPS 234. For critical infrastructure: SOCI Act obligations. For broader enterprise: ISO 27001, NIST CSF, and NIST SP 800-53. We can also align to SOC 2 for organisations with US market requirements.
What is the difference between an IAM strategy and a PAM strategy?
IAM (Identity and Access Management) covers how all users authenticate and what they can access. PAM (Privileged Access Management) focuses specifically on controlling, monitoring, and auditing elevated access. Most organisations need both, and the strategies should be aligned. We deliver them as a single, integrated roadmap.
How does an IAM strategy help with ASD Essential Eight compliance?
Several Essential Eight controls directly relate to identity: restricting administrative privileges, multi-factor authentication, and application control. An IAM and PAM strategy maps your current maturity against these controls and provides a roadmap to reach your target maturity level.
Do you work with our existing security policies and documentation?
Yes. We review any existing security policies, architecture documents, audit findings, and risk registers as part of the current state assessment. We build on what you have rather than starting from scratch.
Can you help us build a business case for IAM investment?
Yes. The strategy engagement includes business case support materials that map identity investments to risk reduction, compliance requirements, and operational efficiency. These are designed to be presented to executive leadership and board-level stakeholders.
How does this relate to your engineering services?
A strategy engagement often precedes an engineering delivery. The roadmap defines what should be built and in what order. Our engineering team is available to execute against the roadmap, including privileged access management and workforce IAM and identity governance, so there is no gap between strategy and implementation.
What is Zero Trust and how does it relate to IAM strategy?
Zero Trust is a security model that assumes no user or device should be trusted by default, regardless of their location. Identity is the foundation of Zero Trust. An IAM strategy defines how your organisation implements Zero Trust principles through Conditional Access, privileged access controls, device trust, and continuous verification.

Let’s talk about your identity challenges

No pitch decks. No pressure. Just a straightforward conversation about where you are, where you need to be, and how we can help you get there.

  • Understand your current identity posture
  • Identify quick wins and critical gaps
  • Get actionable recommendations, no strings attached

Free 30 min discussion

No commitment required

Book a time that works for you. We’ll come prepared with initial observations about your industry and common identity challenges.

Book a 30-min discussionEmail us

We use cookies

We use cookies and similar technologies to help personalise content, measure the performance of our site, and provide a better experience. By clicking Accept, you consent to the use of all cookies.
Learn more.