ITEP0653 Identity and Access Modernisation Programme

Description

National Highways has identified the following corporate risk (CRR-04): Due to weaknesses in National Highways' security posture, there is a risk that the confidentiality, integrity or availability of National Highways critical services and assets or information is compromised by a cyber security incident or attack. 

The current system for managing user identities and permissions within National Highways is manual, fragmented, insecure and inefficient. As a result, there are no means to effectively and efficiently control access to National Highways information assets with minimum privileges required to fulfil roles. Privileged Access Management (PAM) - Privileged accounts and credentials used to access National Highways critical systems are insufficiently protected and are vulnerable to exploitation from external and insider threats which could result in significant compromise of the Strategic Road Network and the organisation's operational systems and assets. 

Considering the increasing cyber-security threats and the criticality of securing access to National Highways systems and data, National Highways has initiated an improvement programme to implement robust IGA and PAM solutions. By addressing the current challenges and achieving the programme objectives, National Highways will significantly enhance its security posture; ensuring compliance with NIS regulations, mitigating insider threats and strengthening National Highways incident response capabilities. 

National Highways does not have the internal skills to deliver this, so the delivery of this programme will not only protect sensitive data and Critical Services but also foster a culture of security across the organisation, safeguarding long-term success and reputation, while improving user experience and ways of working both internally and with our supply chain across all Directorates. In light of the above, the IGA and PAM projects are operating within the IAM programme as part of the Cyber Security Improvement Portfolio (CSIP).