Last issue I introduced the term “compliance management” to describe a relatively new niche in the market. It’s also relatively small since, until last week, Aveksa was, perhaps, the only vendor securely in that niche. Today, though, there are twice as many vendors!

I’ve known Mark McClain and Kevin Cunningham since they left IBM-Tivoli to found Waveset, a company which quickly came to dominate the electronic provisioning market.

<aside> Mark’s pithy comment about free software – “there’s no such thing as a free cat” - is as true now as it was four years ago.</aside>

When Sun acquired Waveset in 2003, Kevin and Mark stayed on to become executives within the new organization. But like most veterans of start-ups, the straitjacket of a large enterprise eventually created enough pressure that they needed to get back out on their own. And so they did. Last week’s announcement of the new SailPoint Technologies is the result.

I’d run into Mark at last summer’s Catalyst conference where he gave me a (very) brief overview of what the new organization would try to do. Then, a couple of weeks ago, both Mark and Kevin got on the phone to tell me all about the new products they went soon bring forth.

SailPoint’s Compliance IQ is, broadly speaking, part of the compliance management niche. AS Kevin describes it (he’s the marketing guy) “The product uses advanced data mining and analytics - or ‘identity intelligence’ - to provide meaningful business context for the volumes of identity data generated by diverse IT systems and applications.” It examines your entire structure to find those places where you’re most at risk of failing to be in compliance.

The product combines business information such as job functions, asset risk and compliance policy with technical data mined from the IT environment to offer a single data model to help organizations filter and interpret critical compliance information. In addition, Compliance IQ offers an “Identity Risk Scorecard”, a configurable calculator that assigns risk scores to users based on their access to critical systems and applications.

I’ve said that this year organizations will be looking for ways to shore up compliance while reducing the overall cost of doing so. Automation products like Compliance IQ could be a very useful tool in that regard. In other words, it can offer a bigger bang for the buck.

There’s a lot more information available at the Web site, which you should take a look at.