Survey Announcement Email

Economics of Access Control Policy Models for Identity Management

(Survey Announcement Email – Draft Text)¹

<Organization Name> is assisting the National Institute of Standards and Technology (NIST) and RTI International in a critical economic analysis of access control policy models for identity management (IdM). The purpose of the survey is to understand how different access control models, like role-based access control (RBAC) and access control lists (ACLs), influence the efficiency and effectiveness of firms’ IT and business workflows.

As part of this study, members of <Organization Name> are encouraged to participate in a brief survey about the economics of access control at https://accesscontrolsurvey.rti.org. It is expected that participation will take 15 to 30 minutes, depending on your responses.

As a participant in this study, you will receive a complimentary copy of this study’s final report and economic analysis via email later this year when the study is completed.

The survey is intended for active professionals in identity management, such as IT managers, senior systems administrators, and information security architects, for example. Question topics cover:

• business drivers underlying access control policy designs and decisions;

• routine provisioning;

• access control policy design, implementation, and maintenance; and

• compliance activities, including policy certification, permissions audits, and attestation.

The results will be used to inform strategic activities for IT standardization committees and organizations, as well as to report to the broader IT community on the economic costs and benefits of critical identity management activities.

More information about the survey is at https://accesscontrolsurvey.rti.org. If you have any questions contact <ORG REP> or Alan O’Connor, the Project Director, at [email protected].

1 Actual text may vary as ISACA, Burton Group, and HIMSS may edit or revise the email text slightly to better convey the purpose and intent to their members. What is presented is the minimum amount of information expected to be included in the announcement.