Enterprise Tech Logic
Worksheet
Identity procurement and migration scorecard
Set mandatory IAM requirements, compare evidence from three suppliers and prepare the migration decisions that follow.
IAM teamsIT leadershipProcurement
Access the resource
Read and copy the worksheet below. No registration is required.
Use the worksheetWhat you will learn
What this resource helps you do.
- Define mandatory IAM evaluation gates.
- Compare supplier evidence using a consistent scoring method.
- Prepare migration, rollback and acceptance decisions.
About this resource
Use the IAM evaluation scorecard
Use this worksheet to define an IAM evaluation before reviewing suppliers. Copy the tables into your working document, add your own evidence and retain the completed decision record. The proposed criteria and weights are editorial starting points, not certification requirements or product rankings.
1. Record the evaluation scope
Record the service owner, evaluation date, applications in scope, identity sources, user groups, required integrations and the people authorised to accept the decision. Define the pilot environment and data-handling rules before testing.
2. Resolve mandatory gates
| Gate | Evidence required | Result, assessor and date |
|---|---|---|
| Required applications | Demonstrated mandatory integrations and recorded limitations. | Not tested |
| Lifecycle outcome | Approved access present and obsolete access removed after a role change. | Not tested |
| Privilege controls | Approval, expiry and revocation for required administrative tasks. | Not tested |
| Recovery | Controlled emergency-access and restoration process. | Not tested |
| Data and audit | Required records, access controls and retention verified against requirements. | Not tested |
| Migration and rollback | Acceptable transition and rollback for a representative cohort. | Not tested |
Use Pass, Fail or Not tested. A failed mandatory gate stops eligibility. An untested gate remains unresolved. Attach an evidence reference to every pass.
3. Compare acceptable options
Agree weights before demonstrations. The illustrative weights below total 100. Score each criterion from 0 to 4: demonstrated failure; major gap; partial fit; requirement met; requirement met with a specifically valuable additional benefit. Leave untested criteria blank. Keep the assessor, date, evidence reference and limitation beside each score.
| Criterion | Illustrative weight | What to test |
|---|---|---|
| Integration fit | 20 | Difficult applications and supported methods. |
| Lifecycle operations | 20 | Role changes, leavers and failed-update handling. |
| Administration and privilege | 15 | Approval, scope, expiry and traceability. |
| Recovery and support | 15 | Failure scenarios, escalation and response ownership. |
| User and operator experience | 10 | Representative enrolment and investigation tasks. |
| Migration effort | 10 | Coexistence, rollback and support capacity. |
| Operating cost | 5 | Comparable implementation and recurring commitments. |
| Exit and portability | 5 | Verified export and replacement requirements. |
Once every gate passes and every score has evidence, calculate each weighted contribution as weight multiplied by score divided by four. Add the contributions for a result out of 100. A total is a comparison aid, not proof of suitability. Check whether a disputed weight changes the decision.
4. Check migration readiness
- Sequence applications by criticality and dependency.
- Verify authoritative identity records and matching rules.
- Document coexistence while both identity services operate.
- Prepare enrolment, recovery and support arrangements.
- Agree rollback triggers, authority and tested steps.
- Protect and test controlled emergency access.
- Have application owners confirm cutover acceptance.
- Retire legacy access only after dependencies are checked.
5. Keep the decision record
Record the preferred option, alternatives rejected, gate evidence, weighted comparison, operating-cost assumptions, unresolved risks, decision owner and review trigger. Name an owner and due date for every remaining action.
Source and scope
The source foundation is the NCSC introduction to identity and access management, checked on 10 October 2026. The worksheet, weights and scoring conventions are original Enterprise Tech Logic editorial tools. No vendors have been tested or rated in this resource.
Review the access information and producer’s terms before submitting your details.
Keep exploring
