Identity and Access Management Metrics: A Systematic Review

Identity and Access Management (IAM) challenges organizations, requiring carefully orchestrated processes, technologies, and authorizations. Despite its strategic relevance, we lack a consolidated scientific understanding of IAM metrics and their alignment with IAM goals, like security, compliance, and operational efficiency. This systematic review aims to identify and classify IAM metrics from the literature to support evidence-based IAM. It links collected metrics to IAM goals and audiences. The literature review followed the guidelines of Levy and Ellis. It includes publications from databases SpringerLink, AIS eLibrary, IEEE Explore, ScienceDirect, ACM Digital Library, and relevant cross-referenced publications. The search strategy used keyword combinations, like “Identity and Access Management” and “Metrics,” since 2000. We screened and included publications based on eligibility criteria for relevance, quality, and the explicit presentation of IAM metrics, resulting in sixty publications. The review identified 43 IAM metrics, categorized by seven perspectives derived from IAM goals and processes. Each metric was analyzed by its target, impact on IAM goals, and relevant audiences. The synthesis shows that the literature lacks unified terminology and frameworks for IAM metrics. Future research includes standardizing terminology, linking metrics and targets to maturity levels, and establishing IAM process metrics. The DEVISE project funded this work. It was not registered in PROSPERO.