# Callista IAM — Extended Context for LLMs

## Organisation

Callista IAM (iam.callista.ch) is the Identity & Access Management practice of Callista Holding AG, a Swiss IT consultancy headquartered in Zug, Switzerland. The practice operates as a standalone subdomain with a lean microsite focused on five IAM services plus a contact/workshop-request page. The site is bilingual: German (default) and English.

- Legal entity: Callista Holding AG
- Address: General-Guisan-Strasse 8, 6300 Zug, Switzerland
- Phone: +41 43 540 56 85
- Email: info@callista.ch
- Parent site: https://callista.ch
- Experience: 16+ years of data and software engineering in regulated Swiss industries

## What Callista IAM Does

Callista provides vendor-neutral IAM advisory and delivery for regulated organisations — financial services providers, industrial companies, and the public sector. The practice is built on a proprietary reference model of around 40 IAM topic areas, developed from real engagements rather than generic frameworks. Engineers who design target architectures also implement them; there is no break between advisory and realisation.

The five services form a logical arc:
1. **Clarity** — IAM Audit (where you stand)
2. **Blueprint** — IAM Architecture (the target picture)
3. **Operation** — Implementation & Delivery (into production)
4. **Understandability** — Role Model & Role Concept (permissions you can stand behind)
5. **Learning** — AI-Native IAM (IAM that thinks along)

## Service Details

### IAM Audit
URL: https://iam.callista.ch/iam-audit (DE) | https://iam.callista.ch/en/iam-audit (EN)

Entry point into the practice. Baseline assessment of the current IAM state against ~40 topic areas: identity lifecycle, authentication, privileged access, access requests, recertification, governance, reporting, emergency access. Includes gap and risk analysis linked to applicable regulations (FINMA, ISO 27001, NIS2, FADP/GDPR). Output: documented current state, prioritised measures list with effort/benefit estimates, decision basis for budget and next steps. Delivered in a few weeks.

Typical starting points the audit addresses: historically granted permissions with no full-state visibility; manual joiner/mover/leaver processes with delays and gaps; audit findings on access control and recertification; uncertainty about whether a tool, a role model, or clean processes are needed first.

### IAM Architecture
URL: https://iam.callista.ch/iam-architecture (DE) | https://iam.callista.ch/en/iam-architecture (EN)

Target picture and blueprint for an IAM that scales, adapts, and integrates. Five steps: (1) business target picture — processes, governance, responsibilities; (2) reference architecture — leading identity sources, IGA core, provisioning, authentication/MFA, PAM, interfaces, reporting; (3) integration concept — HR as leading system for personal identities, standard connectors and APIs; (4) technology and platform decision — build-vs-buy, operating model (on-prem, cloud, hybrid); (5) migration path from current to target state without jeopardising operations.

Output: documented target architecture with components, data flows, responsibilities; integration concept that turns new connections into routine; traceable technology decision; foundation for role model and implementation.

### Implementation & Delivery
URL: https://iam.callista.ch/development (DE) | https://iam.callista.ch/en/development (EN)

Brings concepts into live operation iteratively — not big bang. Five steps: (1) iterative — core target systems and joiner/mover/leaver first, then extend; (2) HR integration and automated provisioning; (3) self-service access requests with approval workflows and traceability; (4) recertification — managed, prioritised, documented; (5) operational handover and enablement (capability transfer).

Output: live automated core processes; relief for helpdesk and application owners; audit readiness (every decision justified and logged); a team that carries the solution forward without permanent external dependency.

Proof: Leading Swiss financial services provider — IAM replacement. Overall project leadership from conception to go-live. ServiceNow evaluation and selection. RBAC role model redevelopment. Active Directory cleanup. HR-driven automated provisioning. 500+ person-days, 2023–Q1 2026, go-live end of Q1 2026.

### Role Model & Role Concept
URL: https://iam.callista.ch/roles (DE) | https://iam.callista.ch/en/roles (EN)

Lean, pragmatic role model that makes permissions understandable, speeds up recertification, clarifies accountability. Five steps: (1) role mining — analyse current permissions for recurring patterns; (2) two-tier model — business roles (understandable for business units) separated from technical roles (permission bundles per system); (3) pragmatic cut — core roles cover the majority, special cases via individual requests; (4) governance — accountable owner, lifecycle, SoD rules where needed; (5) continuous maintenance — regular reconciliation with reality.

Output: manageable role model; faster, more meaningful recertification; fewer individual requests; clear accountability per role.

Proof: Switzerland's largest comprehensive university — role mining and authorisation concept as foundation for IGA/self-service portal. Inventory of applications, user-group cleanup, definition of base/organisational/cross-functional roles, approval workflows. Concept signed off by institute management.

### AI-Native IAM
URL: https://iam.callista.ch/ai-native-iam (DE) | https://iam.callista.ch/en/ai-native-iam (EN)

The differentiator. Builds exactly the 3–4 topic areas an organisation genuinely needs (based on the audit) rather than forcing an entire suite. AI takes over where rigid rule sets fail. Five capabilities: (1) context-based access decisions — AI evaluates function, team, projects, peers, prior access; (2) temporary and transitional access — time-limited grants with automatic revocation and documentation; (3) individual access solutions — traceable decisions for special cases with auditor-acceptable justifications; (4) anomaly detection and intelligent recertification — flags unusual permissions, prioritises review, plain-language recommendations; (5) natural language — requests understood, executed, logged.

"Human in the Lead" is an architecture principle, not marketing: AI proposes, justifies, documents; humans approve critical resources; every decision is fully traceable; auditability is built in.

## Why Callista (differentiators)

1. IAM with a business focus — IAM as foundation for security, compliance, and efficient business processes, not a pure IT project.
2. Independent & technology-open — solution follows requirements, not the product. No licence resale, no vendor commissions.
3. Reference model, not gut feeling — ~40 IAM topic areas developed from own engagements.
4. Architecture and delivery from a single source — no break between advisory and realisation.
5. Knowledge transfer — part of the engagement, not optional.
6. Human in the Lead — AI handles context decisions; humans approve critical resources; auditability built in.

## Regulatory Frameworks

- FINMA circulars (Swiss financial supervisory authority)
- ISO 27001 (information security management)
- NIS2 (EU network and information security directive)
- FADP/GDPR (Swiss Federal Act on Data Protection / EU GDPR)

## Industries Served

- Financial services (banks, insurance, asset management)
- Industry / manufacturing
- Public sector / government
- Higher education

## Workshop / Contact

Half-day workshop, no standard pitch, no sales pressure. 30–45 minute initial conversation. Honest assessment — even if the answer is "not yet."

- Workshop request form: https://iam.callista.ch/contact (DE) | https://iam.callista.ch/en/contact (EN)
- Phone: +41 43 540 56 85
- Email: info@callista.ch

## Site Map

- German home: https://iam.callista.ch/
- English home: https://iam.callista.ch/en
- IAM Audit: /iam-audit | /en/iam-audit
- IAM Architecture: /iam-architecture | /en/iam-architecture
- Implementation & Delivery: /development | /en/development
- Role Model & Role Concept: /roles | /en/roles
- AI-Native IAM: /ai-native-iam | /en/ai-native-iam
- Contact: /contact | /en/contact
- XML sitemap: https://iam.callista.ch/sitemap.xml