Making the case
One case. Four rooms.
The board, the CFO, the CISO, and the line-of-business leader are all deciding about the same identity work. None of them is asking the same question.
Chapter 21 makes the case for each pillar in a single paragraph. This page carries each of those paragraphs into the four rooms where the decision gets made: what that person is weighing, how to frame it, which measures to bring, the question you will get, and the one sentence you leave behind. There is no return-on-investment math here, on purpose.
Walk into a board meeting with a pitch built for a CFO, and you have made the right case to the wrong room. The Modern Identity Operating Model, Chapter 21
In brief
- The same identity case lands differently with the board, the CFO, the CISO, and a line-of-business leader. This page shows how to frame each pillar for each room.
- Use honest numbers or none. One inflated savings figure loses the CFO for good.
- Bring nonhuman and AI identity into the same case, not a separate one.
Start with the four roomsAbout 18 minutes to read in full
This page extends Chapter 21, Identity as a Strategic Capability of The Modern Identity Operating Model.
Before you walk in
Four rooms, four questions
The substance does not change from room to room. The drift is the same drift and the owner gap is the same gap. What changes is the question the person across the table is trying to answer, and if you answer a different one, you lose them even when you are right.
- The board: is this a risk being managed or a risk being ignored? They are not choosing a tool. They are deciding whether they can stand behind how the organization handles authority, and whether anyone is watching it.
- The CFO: what is the number underneath that risk? A finance leader trusts a small number they can check far more than a large one they cannot.
- The CISO: does this change the structure, or only the findings? They already have a queue of findings. Identity offers the move from chasing them to understanding the structure that produces them.
- The line-of-business leader: does this slow my team down or clear the way? Their measure is whether work moves: the launch date, the new hire who can work on day one.
The CISO's room is the one identity people tend to assume they have already won, and that assumption is where good cases go quiet.
Before you build anything, find out who actually holds the money and the authority. In some organizations it is the CISO. In others it is IT, the business units that own the applications, or a risk committee, with the security executive as a partner rather than the decision-maker. Build for the room that decides first.
Answer the question the room is asking, not the one you prepared for.
Rules for every room
Honest numbers, or none
The book is direct about this: translate the operating value honestly, without inflating it into a return-on-investment story no one believes. The fastest way to lose a CFO is a savings figure they can take apart in two questions. The fastest way to lose a board is a green slide that turns red next quarter.
- Bring counts from your own environment, not industry averages. Accounts still active for people who left is a fact the room can check. Someone else's breach-cost survey is an argument the room can dismiss.
- Separate the money you can show from the exposure you can describe. Recovered license and seat spend can be verified on a renewal. Most of the rest is exposure: the incident that does not happen, the finding that does not return. Do not convert exposure into dollars you cannot defend.
- Show direction next to status. A yellow that is improving is a truer story than a green you cannot explain. The reporting dashboards show the same signal at each altitude.
- Carry a leading and a lagging measure for every claim. A case built only on lagging measures asks the room to wait for the next incident to find out whether you were right.
- Make the ask small enough to say yes to. A named sponsor, a decision, a scoped first wave, a budget line with a date. "Support for identity" is not an ask. It is a mood.
Pillar one
Governance: decisions you could defend
Access decisions are already being made, one ad hoc call at a time. Governance does not add decisions. It makes the existing ones visible, owned, and defensible.
BThe board
They care whether accountability is real. Frame governance as the difference between decisions the organization can explain and decisions it would have to reconstruct in front of an auditor or a regulator.
Bring: The share of sensitive systems and access roles with a named owner, with direction. Exceptions past their end date. One recurring audit finding and the ownership gap under it.
They will ask: "Who is accountable for this today?" If the honest answer is no one in particular, say so. That answer is the case.
The ask: Endorse a named executive owner for identity decisions, reporting ownership and exceptions quarterly to the committee that oversees risk.
FThe CFO
Frame it as rework. Every exception that quietly becomes permanent and every finding that comes back is effort the organization pays for again, cycle after cycle.
Bring: Hours spent remediating recurring findings each cycle. Exceptions renewed without review. The cost of the ask, which for governance is often time from existing roles more than new spend.
They will ask: "What does this cost, and what stops costing us?" Answer the first precisely. For the second, name the recurring finding and its effort, and stop.
The ask: Fund the time for a governance working group, and judge it by whether the recurring findings return at the next audit.
CThe CISO
Much of identity risk is an ownership problem before it is a control problem. Frame governance as what makes their other controls hold: a review is only as good as the owner who answers it.
Bring: Access roles with named owners. Exception volume and age by system. AI agents with named sponsors.
They will ask: "Why is this security and not compliance?" Because findings keep returning when no one owns the structure that produced them, and the CISO keeps answering for them.
The ask: Sponsor written decision rights for identity, so an unclear owner has an escalation path that ends somewhere real.
LThe line-of-business leader
They assume more governance means more approvals. Frame it the way it works: clear decision rights are why a request gets answered in a day instead of bouncing between three teams.
Bring: Requests from their area that stalled on an unclear approver. The access their team depends on that has no owner.
They will ask: "More forms for my people?" Not if it is designed well. Role-obvious access should arrive without a request. Governance decides which access needs one.
The ask: Name someone on your team to own the access your team depends on, so decisions about it are made by a person who understands the work.
Pillar two
Lifecycle: closing the gap between should and did
Lifecycle failures make headlines, so everyone already understands the pillar. The case is the gap between when access should end and when it actually does. It is also the pillar with the most direct line to spend.
BThe board
People who have left and can still get in is the most legible exposure in identity. Do not over-explain it. Do widen it, because the room will hear "employees," and contractors, service accounts, and agents are usually where the gap is.
Bring: Accounts active after departure, by population, with the trend. Whether service accounts and agents have a defined end at all.
They will ask: "Could this happen here?" Answer with your current count, not with reassurance.
The ask: Adopt leaver timeliness, for employees and non-employees alike, as a standing risk measure reported with its direction every quarter.
FThe CFO
This is where the honest money is. Access retired properly takes its licenses and seats with it, and that shows up on the next renewal. Money with a receipt. The other half is time: how long a new hire is paid before they can do the job.
Bring: Seats held by people who left or never used them, against the next renewal date. Time from start date to correct access.
They will ask: "Is that number real?" Show the list behind it. It survives a finance review because it sits on an invoice.
The ask: Let us run a reclamation pass before the next major renewal and put what it recovers toward automating the leaver process.
CThe CISO
Lifecycle is the control most other controls assume. Reviews and privileged access presume the account belongs to someone who still works here, in the job they hold today. Birthright granted once and never recalculated is where accumulation starts.
Bring: Transfer completion accuracy. Failed deprovisioning events. Nonhuman identities with lifecycle metadata.
They will ask: "Why can't a tool fix this?" A tool acts on the trigger it is given. If the contractor record has no end date, nothing downstream can enforce one.
The ask: Back a mandatory end date for every non-employee at its source, and make that date the deprovisioning trigger.
LThe line-of-business leader
They feel lifecycle on day one and on the day someone changes teams. Frame it as readiness: the new hire works the first morning, and the transfer arrives with the right access instead of the old access plus some new.
Bring: Days from start to working access in their area. Contractors they sponsor with no end date on record.
They will ask: "What do you need from me?" An end date, a sponsor, and a manager who tells the source of truth when something changes.
The ask: Put an end date on every contractor you sponsor, and we will hold ourselves to every new hire on your team working on day one.
Pillar three
Access: paying down the debt
The book compares access debt to financial debt, and the comparison holds in every room. The case is to pay it down on your own schedule, before an auditor or an attacker sets one for you.
BThe board
Exposure is not spread evenly. A few standing privileges and paths into the most sensitive systems decide how far an incident can reach. Frame access as knowing where that concentration is, and who owns each piece.
Bring: Privileged access time-bounded versus standing, with direction. Separation-of-duties conflicts on financially significant systems.
They will ask: "Are our access reviews working?" If they close on time with almost nothing changed, say that. Perfect completion on a near-zero action rate is a review that is not doing its job.
The ask: Endorse a target for moving standing privileged access on the most sensitive systems to time-bounded access.
FThe CFO
Use the debt framing literally. Access debt accrues interest in review hours, remediation effort, and audit cost, every cycle the access exists. Removing an unexplained entitlement costs once.
Bring: Hours consumed by the last review cycle against how much access it actually changed. Licensed entitlements no one has used in a year.
They will ask: "Why spend money to take access away?" The interest is already being paid. You are proposing to stop paying it.
The ask: Fund a scoped cleanup of one high-risk, in-scope system, judged by the review effort it saves next cycle.
CThe CISO
Frame access as reach. Privilege chains, including the ones an agent inherits through delegated authority, are how an ordinary compromise becomes an incident.
Bring: Entitlements with owners. Review action rates. Known privilege chains into sensitive systems, including those through service accounts and agents.
They will ask: "Where do we start?" Where obligation and risk agree: a financial system in audit scope, or privileged access on a sensitive platform. One honest review there beats a campaign that rubber-stamps everything.
The ask: Make privilege chains into the most sensitive systems the focus of the next review cycle, starting with the ones that run through nonhuman identities.
LThe line-of-business leader
They feel access as friction: role names nobody can explain, review packets so long their managers approve them unread. Frame access modeling as making requests easy and reviews short.
Bring: Their team's rejected or reworked requests. The size of their managers' review packets.
They will ask: "Will my people lose access they need?" Not access they use. Start with what no one has touched in a year.
The ask: Lend us one manager and one subject-matter expert for a few working sessions to define the access your team actually needs.
Pillar four
Technology: funding the discipline the tool assumes
Technology is the pillar most likely to get funded and least likely to deliver on its own. A platform without the operating model underneath it automates the confusion faster. The honest case names the discipline that has to exist first, and funds both.
BThe board
Many boards have watched a platform program run long and deliver less. Frame the investment as conditional on a foundation you can show: the source of truth, the owners, and the access model the platform will be configured to.
Bring: The operating-model prerequisites and the status of each. Certificates and secrets past renewal threshold, as the resilience signal.
They will ask: "Why will this succeed when the last one did not?" Because this plan funds the ownership and data work first.
The ask: Approve the investment with the prerequisites as named milestones, so the board can see the foundation is in place before the spend scales.
FThe CFO
Frame the full cost: licensing, implementation, and running it year after year. AI-assisted access capabilities need a specific mention, because their cost grows with every decision they make. After an acquisition there are often two of every platform, which is its own case.
Bring: Overlapping platforms and directories, with renewal dates. Run cost alongside purchase cost.
They will ask: "What does this replace?" Name what retires and when. A platform that retires nothing is an addition, and will be priced as one.
The ask: Fund the platform and the data and ownership work together, with decommissioning dates written into the plan.
CThe CISO
Frame the decision through the four jobs: Source, Registry, Governance, Enforcement. Almost every identity failure comes from collapsing two of them, and many disappointing purchases come from buying a system to do a job that belongs to people.
Bring: Telemetry completeness. Failed provisioning events. A one-page map of which job each current system actually performs.
They will ask: "Does this close our gaps or move them?" If it is being bought to decide what people should be deciding, it moves them.
The ask: Hold the platform decision until we can show which of the four jobs it fills.
LThe line-of-business leader
They care whether their applications get connected without stalling a release, and whether their people sign in one way instead of five. Frame it as predictability: one place access begins, one place it ends, and no credential expiring on a weekend.
Bring: How their people sign into each application today. Outages their team felt from expired credentials.
They will ask: "When, and what does my team have to do?" Give a date for their applications and name the owner work you need.
The ask: Name an application owner for each system your team runs, so it can be connected on a schedule your releases can count on.
Pillar five
People & Change: a reason to believe in it
Every other pillar depends on people doing what the model asks of them. It is the hardest pillar to fund, because its output is behavior and behavior does not show up on an invoice. It is also where a lot of programs actually fail.
BThe board
Frame it as sponsorship. Identity changes how a great many people do ordinary work, and the clearest signal that the change is real is a senior leader who visibly expects it.
Bring: Whether an active sponsor exists, by name. Adoption measured as changed behavior, not attendance.
They will ask: "Isn't this IT's job?" The design is. Whether managers and owners actually make the decisions the model gives them is a leadership job.
The ask: Ask management to report identity adoption alongside the risk measures.
FThe CFO
Frame change as protecting the rest of the investment. Training and communication are a small line next to the platform, and the first line cut when a schedule slips. Name that risk out loud.
Bring: Change and training cost as a share of the program. Requests and reviews redone because the approver did not understand them.
They will ask: "Can we cut this line?" You can. Then reviews stay rubber-stamped, and the new platform automates the old habits.
The ask: Hold change and training as a fixed share of the program, protected when the schedule moves.
CThe CISO
Rubber-stamped reviews and workarounds are security problems with human causes. A program-wide workforce effort may well be sponsored by the CISO, which can make this the room to ask.
Bring: Review action rates by reviewer group. Approver training completion. What the resistance you are seeing says about the design.
They will ask: "Why do people keep working around this?" Usually because the design asks them something they cannot answer. Resistance is information.
The ask: Sponsor the change visibly, in your own voice, at the moments it touches people's work, not only at launch.
LThe line-of-business leader
Their people carry the change, so frame it around their time: what changes, who it touches, and how much of the week it costs, told before it happens.
Bring: Which roles on their team are affected, and when. What their managers will be asked to decide.
They will ask: "How much of my team's time does this take?" Answer in hours per role. If you do not know, find out before the meeting.
The ask: Give us time in your next staff meeting and one manager willing to try the new process first.
Worked example, illustrative
One finding, four conversations
Chapter 18 follows a leaver offboarding signal up the reporting roll-up. In its worked example, 88 percent of leaver events were within policy, down from 94 percent, and the entire slip was in contractor offboarding. Here is that finding carried into each room. The numbers are the book's illustration, and the brackets are yours to fill.
- To the board. "Offboarding exposure rose this quarter, all of it in the contingent workforce. The control gap behind it has an owner and a close date of [date]. Status yellow, and we will show you next quarter whether the direction turned."
- To the CFO. "Contractor access ends late because contractor end dates are not reliably on record. The fix is a process change, not a purchase, and costs [hours] of sponsor and identity-team time. It also gives us a clean list of contractor seats to reclaim at renewal."
- To the CISO. "Every late leaver event this month was a contractor. That is not a team missing a deadline. It is a missing trigger, and no tool we own can enforce an end date that was never recorded."
- To the line-of-business leader. "Some contractors your team sponsored stayed active after their work ended. We need an end date for each one you bring on, and we will take care of the rest."
The facts are identical in all four. Nothing is inflated. What changes is which part of the truth goes first.
In every room now
Nonhuman and AI identity belong in all twenty conversations
Every one of these audiences is already hearing about AI from someone else. Bring it into the same case rather than a separate one.
Not because AI is “another identity use case.” Because AI exposes whether the organization can govern authority at all. The Modern Identity Operating Model, Chapter 21
Put nonhuman identities in each pillar's measures
For the board they are the outage that has not happened yet. For the CFO they are run cost. For the CISO they are privilege chains. For the business leader they are the automation that stops working when the person who built it leaves.
Ask for the same three things for every agent
An owner, a boundary on what it may do, and an end. Bring the share of agents with completed intake and a named sponsor, and any actions outside delegated boundaries. Those read the same way in all four rooms.
Take these with you
The companions that go with this page
This page shows how one case changes across four rooms. The Selling Identity to Executives guide is the boardroom leave-behind, one page per pillar. Use them together.
Selling Identity to Executives
The case, the measures to bring, and the one-sentence version, one page per pillar.
Identity Metrics Starter
The measures above, tied to the pillars and to predictability, each with an owner.
Reporting dashboards
The same signal at the operational, governance, executive, and board altitudes.
Stakeholder and Sponsor Map
Who decides, who influences, and who sponsors, so you know which room comes first.
For an honest reading of each pillar before you build the case, start with the Predictability Assessment. A board trusts "we measured it" more than "we believe it."
From the book
The longer treatment
This page is the room-by-room version. The full argument is in The Modern Identity Operating Model:
- "Making the Case, Pillar by Pillar," Chapter 21. The five pillar cases this page is built on.
- "Making the Case in Operating Terms," Chapter 21. On translating operating value into revenue, growth, cost, risk, and time without inflating it, and on mergers and acquisitions, where that translation becomes unavoidable.
- "What Good Reporting Looks Like," Chapter 18. The same truth shaped for different readers, and the worked example used above.
- "Risk Appetite and Change Appetite Shape the Path," Chapter 11. On why, when you are reading an organization's real appetite, you watch the budget as closely as the policy.
Go deeper in the book
Chapter 21, Identity as a Strategic Capability, covers why identity is strategic and how each pillar's case is made.
Coming soon: get notified