The Okta Identity Maturity Model: An implementation roadmap across five industries

Every identity leader asks the same question sooner or later: Where do we start?

Identity touches the workforce, customers, partners, devices, and now AI agents. It touches security, operations, and user experience all at once. That reach is what makes it powerful, and it's also what makes it hard to prioritize. A hospital, a retailer, a bank, a plant floor, and a streaming platform all need a mature identity program. They do not need to implement it in the same order.

That's the gap the Okta Identity Maturity Model (IMM) was built to close. It's a value-driven framework, built on patterns observed across more than 17,000 Okta customers, that gives you both a roadmap and a set of evaluation criteria. It maps identity capabilities to the NIST Zero Trust principles in SP 800-207 and organizes them using the capability structure of the CISA Zero Trust Maturity Model. Where those frameworks tell you what good looks like, the IMM tells you how to get there and in what sequence.

Download now: Accelerate Business Outcomes with the Okta Identity Maturity Model

In this post, we'll break down the model’s core framework, then explore how five industries apply it differently: 

• Retail
• Healthcare
• Financial services
• Manufacturing
• Technology, media, and telecommunications (TMT) 

For each, we'll look at where the pressure comes from, what maturity looks like in practice, and where we recommend starting.

The Identity Maturity Model framework

The IMM evaluates organizational posture across three value pillars: Security and Compliance, Operational Agility, and End-User Experience.

Four stages of maturity

The IMM describes four progressive stages, each delivering measurable outcomes across the three value pillars:

1. Fundamental: Meeting essential identity needs while creating a strong, reliable foundation for maturation.
2. Scaling: Expanding a consolidated identity footprint to new apps, services, use cases, and users.
3. Advanced: Increasing automation and integration to elevate experiences, improve agility, and strengthen security.
4. Strategic: Gaining a strategic advantage through initiatives that empower the workforce, optimize efficiency, and leverage identity to detect and respond to threats in real time.

The seven core identity functions

Within each stage, the IMM examines identity through seven functions drawn from the CISA Zero Trust Maturity Model:

1. Authentication: Verifying that a user is who they say they are, and deciding what they can access.
2. Identity stores: The repositories of users and entities, now including non-person entities such as service accounts, devices, bots, and AI agents.
3. Risk assessments: Continuously evaluating identity risk rather than checking once at sign-in.
4. Access management: Identity governance and administration, applied through least privilege.
5. Visibility and analytics: Understanding how identities behave to detect threats and improve experiences.
6. Automation and orchestration: Lifecycle workflows, including joiner, mover, and leaver processes.
7. Governance: Unified identity policy across human and non-person entities.

Cross-industry comparison: Where should your organization start?

The stages are not a checklist every organization completes in the same order. A function can sit at Stage 3 while another is still at Stage 1. The model's value is that it lets you see that unevenness and decide which gap costs you the most.

And what costs you the most depends on your industry.

How does retail apply the Identity Maturity Model?

The challenge

Retail runs on two very different identity populations at the same time: 

• The workforce is large, seasonal, and high-turnover: store associates, warehouse and fulfillment staff, seasonal hires, and a long tail of vendors and franchise partners. 
• The customer base is enormous, digital, and unforgiving: A shopper who hits friction at sign-in or checkout doesn't file a help ticket—they leave.

That makes retail the clearest example of identity as a business lever, not just a control. Sign-in and sign-up conversion, loyalty program engagement, and account takeover fraud all sit on the same identity stack. Add the card-data scope of PCI DSS and privacy obligations such as CCPA/CPRA and GDPR for global brands, and the compliance requirements are real—but achieving compliance is a natural outcome of getting identity right, not the reason to start.

Maturity milestones

• Authentication (customer-facing): In the Fundamental stage, customer accounts rely on passwords with basic bot detection and strong password policies. As retailers mature, they advance to passkeys and early passwordless options, then to fully passwordless, personalized access across web, app, and store. The IMM's End-User Experience pillar maps directly to the outcomes retail leaders already track: increased sign-up and sign-in conversions and an improved digital experience.
• Automation and orchestration (workforce): Seasonal hiring turns joiner, mover, and leaver processes into a volume problem. At Stage 1, onboarding and offboarding are handled by email and service desk tickets. At Stage 2 and beyond, provisioning and deprovisioning are driven by lifecycle events, so a seasonal associate has the right access on day one and none on the day after their contract ends.
• Risk assessments: Account takeover is the retail threat that directly impacts both the customer and the bottom line. Moving from binary rules to continuous, signal-rich risk assessment lets a retailer step up authentication only when risk warrants it, protecting customers without adding friction for the majority who are legitimate.

Recommended first step

Start with customer authentication and the workforce lifecycle in parallel, since they draw on different budgets but the same platform. The quick win is typically bot protection and passkeys on the customer side and automated provisioning for store and seasonal staff on the workforce side. Compliance with PCI DSS requirements for multi-factor authentication (MFA) then follows as an outcome rather than a separate project.

How do healthcare organizations balance clinical speed and compliance?

The challenge

In healthcare, a sign-in screen sits between a clinician and a patient. Security that slows care gets worked around, which is why the usual MFA playbook breaks down in clinical settings: shared workstations, gloved hands, constant movement between rooms, and emergency situations in which access cannot wait.

The workforce is also unusually fluid. Medical residents and fellows rotate, travel nurses and locum clinicians come and go, and affiliated physicians need access without being employees. Mergers and affiliations multiply directories, so a single health system may run several identity stores, each with its own lifecycle practices. Meanwhile, a growing set of non-person entities act on the organization's behalf: connected medical devices, ambient AI scribes, and agents for scheduling and prior authorization.

The compliance backdrop is substantial. The HIPAA Security Rule's access control, authentication, and audit expectations, the HHS Healthcare and Public Health Cybersecurity Performance Goals, and HITRUST all apply. As with retail, they are best treated as outcomes of a mature identity program.

Maturity milestones

• Authentication: At the Fundamental stage, shared credentials on clinical workstations and partial, phishable MFA are common. At the Advanced stage, phishing-resistant, passwordless sign-in becomes practical on shared devices, so a clinician can tap in and move on. The IMM's Stage 3 authorization language, relationship-based access control, maps naturally to a clinician's care-team relationship with a patient.
• Identity stores: The IMM describes identity sprawl as the condition in which identities proliferate across disconnected systems, complicating administration and introducing risk. For a health system that has grown by acquisition, that is an everyday description. Consolidating toward a single source of truth is the foundation for everything else: automated lifecycle, consistent policy, and visibility.
• Access management and governance: Least privilege has to coexist with emergency access. Break-the-glass is a design requirement, not an exception, and a mature program keeps it available while making it visible, time-bound, and reviewable. Governance extends to medical devices and AI agents, which the IMM treats as first-class citizens subject to least privilege, access reviews, and lifecycle controls.
• Visibility and analytics: Identity telemetry serves security and privacy teams alike: detecting inappropriate access to patient records, supporting audits, and answering "who accessed what, and when" during an investigation.

Recommended first step

Start with identity stores and authentication: consolidate directories, then deliver fast, phishing-resistant sign-in for the clinical workforce. Without identity stores, lifecycle automation can't scale; without easy authentication, security remains something clinicians route around.

What does identity maturity look like in financial services?

The challenge

For a bank, insurer, or asset manager, trust is not a feature—it is the product. Customers expect sensitive actions to be authenticated, their data to be protected in transit, and fraud to be stopped without impeding legitimate transactions. Regulators expect demonstrable controls, and the volume of regulation is high: FFIEC authentication guidance, NYDFS 23 NYCRR 500, GLBA, SOX, PCI DSS, PSD2 strong customer authentication in Europe, and DORA for operational resilience in the EU.

The financial services industry also has the most developed privileged-access challenge. Large numbers of administrators, developers, and third parties touch critical systems, and standing privilege is a risk that auditors and attackers both look for.

Maturity milestones

• Authentication: The IMM's Stage 4 authentication description reads as if it were written for this industry: Sensitive customer actions such as high-risk transactions or assignment changes are authenticated through real-time confirmation that enhances security without disrupting the journey, and customer communications and data exchanges are hardened to financial-grade standards. That's the territory of Strong Customer Authentication and Financial-Grade APIs (FAPI), where open banking and API-driven partnerships raise the bar.
• Access management: The IMM's progression describes the path auditors increasingly expect: permanent access with manual tracking > automated review > just-in-time and time-bound privileged access >  zero standing privileges. Toxic combinations—where a single user can both request and approve a privilege escalation—are precisely the separation-of-duties failures that SOX and internal audit programs target.
• Risk assessments: Continuous risk evaluation across the session, rather than at sign-in only, is how a bank catches session theft and takes action such as universal logout when a threat appears.
• Governance: As banks deploy AI agents for operations, advisory support, and fraud, governing those agents with the same rigor as human users—including risk scoring, access automation, and human-in-the-loop approval for high-risk actions—becomes a core capability.

Recommended first step

Start with access management and risk assessments: Reduce standing privilege and move from authentication-time checks to continuous evaluation. Customer-facing strong authentication then builds on a defensible foundation.

How does manufacturing secure identity on the plant floor?

The challenge

Manufacturers face a distinctive identity problem—two worlds that were never designed to meet: 

• The corporate IT environment runs on conventional enterprise identity. 
• The operational technology (OT) environment—the plant floor—runs on shared accounts, legacy systems, and equipment that can't easily be patched or retrofitted with modern authentication.

The workforce is just as varied. Frontline workers share terminals and devices across shifts, contractors and equipment vendors need remote access to machinery, and supply chain partners connect to production and logistics systems. Downtime is expensive, so any control that interrupts production is a tough sell. 

The relevant standards reflect that split: IEC 62443 and NIST SP 800-82 for industrial control systems, NIS2 for covered entities in the EU, and CMMC for suppliers to the US Department of Defense.

Maturity milestones

• Identity stores: Many manufacturers start with several self-managed directories across plants and business units, often a result of acquisitions, and with service and machine accounts tracked informally. The IMM's trajectory toward a unified identity fabric that governs human and non-person identities alike is directly relevant, because in manufacturing the non-person population (machines, sensors, controllers, robotic processes) is large.
• Access management: Third-party and vendor access is where just-in-time, time-bound, and session-based privileged access pays off most. Granting a vendor access only for the duration of a maintenance window, to the specific system required, with the session recorded, is the IMM's Stage 3 description applied to the plant.
• Authentication: For frontline workers sharing terminals, the Advanced-stage emphasis on fast, passwordless sign-in, including device sign-in, replaces shared credentials without slowing a shift change.
• Automation and orchestration: Shift workers, seasonal labor, and contractors turn joiner, mover, and leaver workflows into a continuous process. Automating it closes the gap where access outlives employment.

Recommended first step

Start with identity stores and access management for third parties: Consolidate who and what exists, then replace standing vendor access with just-in-time access. Both reduce risk in the environment where an incident is most costly, without needing to touch the equipment itself.

How do technology, media, and telecommunications companies mitigate high-volume identity attacks?

The challenge

Technology, media, and telecommunications (TMT) companies operate at a scale that makes identity both a core product capability and a primary target. Subscribers number in the millions. Developers and engineers hold powerful access to production systems and source code. Content, IP, and customer data are high-value. Telecom adds a specific attack risk that the IMM names directly: SIM swapping, along with adversary-in-the-middle attacks that bypass susceptible forms of MFA.

Fast-moving organizations also tend to be cloud-native and API-heavy, with large volumes of service accounts and tokens alongside a rapidly growing footprint of AI agents. Customer expectations for a frictionless sign-in experience are set by the best consumer apps, and compliance requirements such as SOC 2, NIS2, and regional telecom regulations are demonstrated through the same controls.

Maturity milestones

• Authentication: For TMT, the move from phishable factors such as SMS to phishing-resistant, passwordless authentication isn't an upgrade, it's a direct response to attack methods aimed squarely at the industry. The IMM's Stage 4 session security—demonstrating proof-of-possession (DPoP) and device-bound tokens so that stolen session artifacts can't be replayed—addresses infostealers and session hijacking head- on.
• Risk assessments and visibility: With high account volume, automation is the only way to keep up. Continuous risk evaluation with immediate response, such as secure logout and security workflows, helps a large subscriber base and a large engineering workforce stay protected without manual triage.
• Identity stores and governance: Service accounts, APIs, bots, and AI agents far outnumber human users in many TMT environments. The IMM's position that non-person entities, including emerging AI agents, are governed alongside human users—with least privilege, reviews, and lifecycle controls—describes the end state.
• Access management: For engineering organizations, just-in-time access to production infrastructure and zero standing privileges limit the blast radius of a compromised developer account.

Recommended first step

Start with authentication and risk assessments: phishing-resistant authentication for the workforce and customers, paired with continuous session evaluation. Governance of service accounts and AI agents follows quickly, because that population is growing fastest.

Three universal truths of identity maturity

Different starting lines, but the same destination, and the same three lessons.

1. Maturity is uneven, and that's useful. Almost no organization is at one stage across its entire enterprise. The model's value is in showing which function lags and which gap is the costliest for your business.
2. Non-person identities are the common thread. In every industry, the number of service accounts, devices, bots, and now AI agents is growing faster than the human workforce. The IMM's Stage 4 vision, where non-person entities including AI agents are governed alongside humans, is where all five industries converge.
3. Compliance follows maturity. Each industry carries a different regulatory load. In every case, the organizations that move through the stages find that the audit evidence they need becomes a byproduct of controls they already operate, rather than a separate effort.

Take the next step in your identity journey

The Okta Identity Maturity Model provides a comprehensive framework to evaluate your architecture across all seven functions and four maturity stages. It maps every capability to NIST SP 800-207 and the CISA Zero Trust Maturity Model, helping you benchmark your posture, pinpoint your costliest gaps, and prioritize investments. 

Download the Okta Identity Maturity Model

Ready to tailor this roadmap to your organization? Contact us to connect with an Okta expert and start mapping your identity maturity journey today.

Any mention of solutions, features, functionalities, certifications, authorizations, or attestations that are not currently generally available may not be delivered on time or at all. Okta assumes no obligation to deliver on such items and you should not rely on them to make purchase decisions.These materials are intended for general informational purposes only and are not intended to be legal, privacy, security, compliance, or business advice.  ©2026 Okta, Inc. and/or its affiliates.