Every breach investigation eventually asks the same question: who had access, and should they have had it? As organisations move more of their operations into complex digital systems and cloud platforms, that question gets harder to answer — unless Identity and Access Management (IAM) is built in from the start.

IAM is the discipline that makes sure the right people, and only the right people, can reach the right resources. Getting it right cuts straight through some of the most common causes of a breach: excessive privileges, forgotten accounts, and access nobody remembers granting.

Arab British Fellowship Training Academy's "Digital Identity and Access Control" course takes participants through the practical side of that discipline: designing access models, deploying authentication controls, and running IAM operations in line with British standards such as ISO/IEC 27001 and Cyber Essentials.

Who Should Attend?

• IT and Cybersecurity Managers shaping identity and access strategy across the organisation.
• Technical Specialists and Engineers who design, build, or integrate IAM solutions.
• Information Security Professionals implementing access control policies and managing digital identities day to day.
• Compliance and Audit teams tracking adherence to IAM-related regulations such as GDPR and ISO 27001.
• HR and Security Administrators managing roles, permissions, and system access across the employee and contractor lifecycle.

Knowledge and Benefits:

• Apply the core principles and best practices behind Identity and Access Management.
• Turn IAM principles into working policies for managing identities and controlling access to critical resources.
• Roll out British cybersecurity standards inside IAM processes to satisfy regulatory requirements.
• Cut the risk of unauthorised access and data breaches through stronger access governance.
• Build staff awareness and shared responsibility around identity and access controls.

Module 1: What Weak IAM Actually Costs You

• Unauthorised access, privilege escalation and insider misuse as direct consequences of weak IAM.
• Identity, authentication and access control as three connected pieces of the same system.

Module 2: British Standards and Legal Drivers

• What ISO/IEC 27001 and Cyber Essentials expect from an IAM programme.
• GDPR and other legal requirements that a well-run IAM process helps satisfy.

Module 3: Choosing the Right IAM Building Blocks

• SSO, MFA, RBAC and ABAC — what each one solves, and when to use it.
• Managing the account lifecycle: creation, changes and deactivation.

Module 4: Designing Access Around Risk, Not Just Roles

• Matching access controls to data sensitivity and user activity rather than job title alone.
• Balancing security with usability so people can still get their work done.

Module 5: Single Sign-On in Practice

• What SSO genuinely simplifies for end-users and administrators.
• Deployment challenges and how to avoid the most common ones.

Module 6: Multi-Factor Authentication and Password Hygiene

• MFA methods — SMS, app-based, biometric — and the trade-offs of each.
• Password policy design, and the tools that make enforcing it realistic.

Module 7: Watching Access in Real Time

• Logging user interactions with sensitive systems and data.
• Spotting anomalies using analytics and SIEM tools.

Module 8: Responding to Unauthorised Access

• First steps once suspicious access is confirmed: containment, investigation, recovery.
• Communicating the incident to stakeholders without losing their trust.

Module 9: IAM in the Cloud

• Identity challenges specific to platforms such as AWS, Microsoft Azure and Google Cloud.
• Keeping IAM consistent across on-premise and cloud environments.

Module 10: Automating and Strengthening IAM with AI

• Predictive analytics and anomaly detection applied to access management.
• Where automation genuinely reduces risk, and where it just relocates it.

Module 11: Where IAM Is Heading

• Zero Trust Architecture and blockchain-based identity, and what they mean in practice.
• Preparing IAM for remote and hybrid working models.