During an analyst briefing I had some days ago with a leading vendor in the BSM space around the role Identity Management plays for BSM (which is quite important, given the fact that all leading BSM vendors are IAM vendors and that IAM plays a significant role within ITILv3) we came to the conclusion that there is no ERP for IT. There are specific ERP solutions for Finance, Customer Relationship Management, Product Lifecycle Management, and so on. But there is nothing for IT. That automatically led to the question whether BSM might fill this gap.

The discussion also was sort of a reminder to another talk I had some months ago with the CIO of one of the German DAX companies. His vision is about an IT with clear knowledge on its costs thus being able to predict the TCO (and not only development costs or an initial investment into infrastructure) of new “Business Services” IT delivers. These services might be applications or infrastructure services. He’d like to be able to predict the cost per user, the cost per use of a specific service or whatever you want. This ability would be the basis for a factual discussion about IT services and a granular accounting and might even lead to an IT department which is sort of a business centre (like an Outsourcer) and not only a cost centre.

Both discussions are around the way IT acts, about the role of Business Service Management and, in fact, about ERP for IT. The BSM approach which is required for that type of solution will go well beyond todays infrastructure focus. BSM itself is much broader than the IT infrastructure service focus of ITIL. But for that approach it will have to include much more functionality around application and service (in the sense of web services) management, something which isn’t covered that much by most BSM vendors today.

I personally believe that sort of an ERP for IT will be very interesting, proofing the fact that IT is today an important enabler for business and not just a technology department which burns money. The question is whether it will really be some of the large BSM vendors who deliver that new type of application or whether the ERP vendors will be the ones. I’ll wait and see.

You might ask yourself what this has to do with IAM (Identity and Access Management), my core topic. Well, first of all IAM is not my only topic. BSM is one which becomes more and more important for KCP due to the relationship to IAM – and one I’m doing research for quite a long time now. Besides this, there is another ERP for IT thing I’m currently thinking about. May be I’d better call it EIP for “Enterprise Information Planning” but it’s about enterprise control of information, the next real big step in IAM. I’ll cover this in one of my next blogs.

In the last week I had several conversations with different IT vendors and end users which led to a discussion about the value of identity services within a service-oriented architecture. The IT companies came from different market segments. One example is E2E, a swiss company which develops a tool for model-driven architecture and the resulting applications. They have started defining such identity (and other security) services within their models. Other persons I spoke with came for example from the BSM (Business Service Management) space.

The well-known business values for identity services within a SOA concept are mainly the ability to not only build business processes but to build secure business processes and the reduced development costs. The latter is true because it is more efficient to use pre-defined services instead of reinventing the wheel of security for every single application (and, to note, to reinvent something which usually has five edges instead of being round…).

Another point is that there usually won’t be “compliant” applications without a set of pre-defined identity services – the alternative often is to code at least some aspects of security, even in applications which were developed with the SOA concept in mind.

That leads to one other real big advantage of identity services: They make software audits much easier – and thus avoid some of the struggles you often observe between the security guys and the application developers. With a consistent service-oriented approach and the use of pre-defined identity services, software audits become much easier. You only have to audit a version of a service once. Afterwards, it’s only about analyzing the “orchestrated” application models and the additional code. When security is delivered through services, you have much less to worry about when doing software audits. Besides, the audit of changes becomes much easier – you have to either analyze the changes in services or in the applications itself. By the way: The more these applications are really model-based and orchestrated and the less custom, application-specific code there is, the easier are software audits.

The guys from E2E told me that in some case they could reduce the time for a software audit from 4 weeks to some 36 hours. Even while the effect isn’t necessarily that big – there is a clear, positive effect. And it is an effect in terms of money, in terms of time and, given this, sometimes even in time to market. May be the biggest effect is that identity services makes you the developer’s best friend through reducing the pain of software audits.