Implement the Model in Waves

Most identity programs are not behind because the work is hard. They are behind because too much work is in progress at the same time and none of it is operational.

Wave based implementation is not a project management preference. It is a governance discipline. Each wave has a defined scope, a dependency chain, and a clear definition of what operational looks like when the wave closes. Without that discipline, implementation becomes a permanent state of partial completion. Tools are deployed, processes are half built, and capabilities exist in slides but not in practice.

Identity work makes this even more important. Lifecycle, access governance, privilege, and cloud entitlements all depend on each other. Waves keep the program focused on what must be true before the next capability can run.

Three factors govern wave design.

Dependency. Some capabilities work better when foundations are in place. You can govern entitlements without clean identity data, but the results drift and the work repeats. You can run access certification without defined roles, but the outcomes are weak. Wave sequencing follows the order that produces durable results.

Risk. Where the exposure is highest is where implementation often needs to begin. High risk populations, high risk systems, and high risk access patterns shape the early waves.

Readiness. Not every part of the organization can move at the same pace. Wave design accounts for where governance structures, ownership, and change capacity exist to sustain what gets built. Sometimes the right starting point is the part of the organization that is ready to move. Early wins create momentum that makes the harder waves possible.

A wave is not complete when the technology is deployed. It is complete when the operating model is running in scope. The process executes, governance is active, and measurement confirms it is working.

The most common failure in wave based implementation is not finishing waves. The next priority arrives, scope expands, and nothing reaches sustained operation. Many programs have work in progress from years ago that no one has declared done.

Define the wave. Close the wave. Then expand. Closing a wave creates a moment to celebrate what is working and capture what needs to improve before the next one begins.

Measure:

• Waves defined with explicit scope and exit criteria
• Capabilities confirmed operational before the next wave begins
• Open initiatives with no declared completion date

❓How many open identity initiatives have never been declared done?