Customer Identity and Access Management: Useful Terms

As the world of CIAM has evolved, the language used to describe it has evolved as well. Here’s an overview of helpful terms.

Customer/User Registration

This enables customers/users to create an account via an application, device or support representative. The registration process captures the user’s credentials and other profile data and is used to enable future authentication of that user to access resources. The profile data captured also allows an organization to personalize offerings and services for that customer/user.

Data Privacy Management

A feature that allows customers/users to specify their consent to share private data. Customer consent may be combined with an organization’s corporate policies and industry regulations, resulting in a set of policies or rules defining access to customer/user data. Privacy management helps organizations build customer loyalty and maintain compliance with industry regulations and regional laws, as well as age-specific regulations such as the Children’s Online Privacy Protection Act (COPPA).

Delegated Account Management

A decentralized model of role or group management in which administrators delegate access rights. It offers a layer of protection against data theft, misuse and breach.

Identity Proofing

A method to verify people’s identities before an organization issues them accounts and credentials. Examples include knowledge-based authentication such as “What is your mother’s maiden name?” or “What are the last four digits of your social security number?” Other approaches leverage third-party reporting agencies and query the user on information like the amount of the consumer’s last mortgage or the last address where they lived.

Multi-factor Authentication

Multi-factor authentication (MFA) is a feature that grants access to resources only after a user has successfully provided multiple forms of identity evidence. It typically involves information spanning at least two of the following categories of information: knowledge (something they know), possession (something they have) and inherence (something they are). Typical consumer examples include a combination of username/password and a second factor passcode sent via SMS to a mobile phone in their possession.

Opt-in/Out Management

This feature allows customers/users to elect to receive different communications from a business by type and/or topic to facilitate better personalization. These selections should be enforced uniformly, no matter what channel, device or app is the end-use point, to enable a consistent customer experience.

Password Reset

A feature that offers customers/users the ability to self-manage their passwords. Customers can conveniently change their password any time without requiring the help of a customer service representative or administrator. Password reset helps promote security best practices by making it easy to periodically change passwords.

Personalization and Preference Management

A capability that allows organizations to capture detailed information about customers and manage how this information is shared and used throughout the organization. It enables organizations to tailor engagement to each customer’s preferences and needs and enforcing these preferences across all channels.

Self-service Account/Profile Management

This feature provides customers with control to update their account details. Examples include customer self-management of preferences for how an organization communicates with them (e.g. whether by email or text) and the types of services and offers they want to receive.

Single Sign-on

Single Sign-on (SSO) is a feature that enables a customer/user to provide a single user name and password to access multiple systems. It helps improve customer experience by providing convenience and ease of use.

Social Login

Social login links one or more social networking login services, or identity service providers, to a third-party application. Social login provides customers with an easy and convenient login experience using existing login credentials instead of creating a new username and password. It can be used as a mechanism for both authentication and authorization.