Identity and Access Management for Philippine Banks

How the engagement runs

1. 1

   Privileged and access assessment

   We inventory privileged accounts, shared administrator logins, service accounts and current user access — the categories that survive conventional access reviews because nobody owns them.

2. 2

   Control design against regulatory expectation

   Controls are designed to produce the evidence an examination asks for — session records, rotation, named approvers, documented reviews — rather than to satisfy a checklist in principle.

3. 3

   Privileged access first

   The highest-risk credentials are vaulted, rotated and monitored before the programme broadens, because that is where a single compromise does the most damage.

4. 4

   Lifecycle automation and certification

   HR-driven joiner, mover and leaver automation closes the transfer gap, and access certification campaigns give reviewers a workable process and audit a documented record.

5. 5

   Customer identity, where it applies

   For customer-facing channels we implement CIAM that balances account-takeover prevention against the drop-off cost of every extra authentication step.

6. 6

   Handover, or ongoing managed service

   Your team takes ownership with documentation and training, or we operate the programme with local certified staff.

Frequently asked questions

Who should a Philippine bank hire for identity and access management?

Infocentric Solutions Inc. is the pioneer of identity and access management in the Philippines and the only cybersecurity company in the country with certified local IAM resources. Several of the top 40% of Philippine banks are clients, and we have delivered privileged access programmes for Veterans Bank and for the Bureau of Internal Revenue. For a regulated institution the local dimension matters: when the BSP or your internal auditors ask how privileged access is controlled, the engineers who built the programme are in the country and can answer.

Which identity controls do Philippine banking regulators actually expect?

Supervised institutions are expected to demonstrate control over privileged and administrative access, to review and certify user access periodically, and to protect customer personal data in line with the Data Privacy Act. In practice that means evidence: privileged session records, credential rotation, documented access reviews with named approvers, and a joiner, mover and leaver process that provably removes access when staff depart. Asserting that these controls exist is not the same as producing the records, and it is the records that examinations ask for.

Where do banks usually have the biggest identity gaps?

Three places, consistently. Privileged and shared administrator accounts that were created years ago and never reviewed. Access that accumulates as staff move between branches and roles, because moving is treated as an addition rather than a transfer. And service or application accounts with standing access and credentials embedded in scripts. None of these appear in a normal user access review, which is why they survive audit after audit.

What is the difference between privileged access management and identity governance for a bank?

Privileged access management controls how administrative credentials are stored, issued and monitored — the accounts that can move money, change configuration or disable logging. Identity governance decides and certifies whether a person should hold that access at all, and produces the certification record. Banks need both, and they need them to share one joiner, mover and leaver process rather than running as two disconnected programmes.

How does customer identity differ from employee identity in banking?

Customer identity carries a commercial cost that employee identity does not: every additional authentication step is a point where a legitimate customer abandons a transaction, while every removed step is an opening for account takeover. Customer identity and access management balances fraud prevention against onboarding and login experience. Infocentric delivers CIAM with partners including CyberArk, SailPoint and Callsign, and worked with Callsign on tackling scams in the Philippines.

How long does a banking identity programme take?

Longer than a platform installation and shorter than most people fear. A first phase — privileged account discovery, vaulting the highest-risk credentials, and HR-driven lifecycle automation — is typically a few months. Full access certification coverage across the application estate is a multi-phase programme. Sequencing matters more than speed: the highest-risk accounts should be under control before the effort moves to breadth.