Measuring IAM Maturity: Metrics Executives Actually Understand

Identity teams routinely struggle to secure investment, and it is usually a communication failure, not a merit failure. We talk in entitlements, correlation, and provisioning pipelines; executives think in risk, cost, and audit outcomes. Bridging that gap requires two things: a maturity model that shows where you are and where you're going, and a small set of metrics that translate identity work into language a board already cares about.

A capability model, not a tool inventory

Maturity is about capabilities, not products. I assess across a handful of dimensions — lifecycle automation, access governance, privileged access, authentication strength, and identity visibility — and rate each on a simple progression:

• Initial — manual, ticket-driven, inconsistent. Access is granted and removed by human effort and memory.
• Managed — documented processes exist; some automation; controls are real but not comprehensive.
• Defined — authoritative-source-driven lifecycle, governed access requests, PAM in place, controls tested.
• Optimised — least privilege enforced, just-in-time access, continuous certification, identity signals feeding detection.

The value of the model is that it turns "we need more identity investment" into "we are at Managed on privileged access against an industry expectation of Defined, and here is the gap." That is a sentence a board can act on.

The metrics that travel to the boardroom

Most identity metrics are operational noise to an executive. A few translate directly into risk and resonate:

Each of these maps cleanly to a question a board already asks: how exposed are we, how fast can we contain a problem, and are our controls real or theatre? Report the trend, not just the number — direction of travel is what tells leadership whether their investment is working.

Tie maturity to outcomes leadership feels

The maturity model lands hardest when each level is connected to consequences executives experience directly: audit findings, incident exposure, operational cost, and the ability to onboard acquisitions or new business quickly. "Advancing privileged access from Managed to Defined" is abstract. "Reducing the standing privileged accounts an attacker could target from 1,200 to 200, and cutting leaver risk window from days to minutes" is a business case. Always translate the capability into the consequence.

Benchmark honestly

Executives invariably ask "how do we compare?" Answer it honestly, against recognised frameworks — the maturity expectations embedded in standards like the Essential Eight, NIST, and ISO 27001 give you defensible external reference points rather than your own opinion. Being able to say "industry and regulatory expectation is here, we are here, and this investment closes the gap" is far more persuasive than internal advocacy, however well-reasoned.

Concretely, here is how I map the six identity domains onto the control frameworks an Australian regulated enterprise is already measured against — so a maturity score isn't an abstract number, it's a position against obligations you can't argue with:

Mappings are indicative, not certification claims — frameworks overlap and your control catalogue will differ — but a table like this turns "we should improve IAM" into "we are below the CPS 234 and Essential Eight expectation on privileged access, and here is the remediation." That sentence gets funded.

Identity maturity is a journey measured in capabilities and communicated in risk. Build the model, pick the handful of metrics that translate to the boardroom, tie each level to consequences leadership feels, and benchmark against external standards. Do that, and identity stops being the team that asks for money and becomes the team that demonstrably reduces risk — which is the only argument that reliably gets funded.