Frameworks built to be picked up and used.

IAM teams cite ISO and NIST to defend their work, and the citations do not always match what the documents say. This reference maps the four ways a citation fails, the wrong concept, the wrong document, the stale edition, and the invented requirement, each worked against the primary source, with guidance on defending it to an auditor.

Operational IGA metrics measure whether governance work happened, not whether the program is keeping pace with how fast access changes. This paper proposes four named, program-level metrics for governance responsiveness, the way DORA metrics did for software delivery, applied to human and non-human identity alike.