Question 1

What is SailPoint Non-Employee Risk Management?

Accepted Answer

It is an add-on to SailPoint Identity Security Cloud that gives contractors, vendors, partners, auditors and temporary staff the identity lifecycle employees already have: centralised visibility across the whole external population, a named internal owner accountable for each relationship, structured onboarding that collects the personal data needed to grant access to critical applications, time-bound access that expires by default rather than persisting until someone notices, inclusion in access certification campaigns alongside employees, and an audit evidence trail. Since September 2025 it integrates with Microsoft Entra Verified ID, adding faster onboarding with biometric verification. The problem it addresses is structural rather than technical. Employee identity governance works because HR is an authoritative source — someone joins, the system knows, access follows; someone leaves, deprovisioning fires. Non-employees have no equivalent: a contractor is onboarded by a project manager, a vendor engineer by whoever handled the support case, an auditor by someone being helpful. None of those events reach HR, so nothing drives expiry and access persists by default. That is why this population is where audit findings cluster, and why the finding is usually that you could not produce the list rather than that the access was wrong. TechBag scopes it as part of the platform decision, in INR with GST.

Question 2

Can we buy this on its own?

Accepted Answer

No, and we would rather tell you before the quote than during it. Non-Employee Risk Management is an add-on to SailPoint Identity Security Cloud, not a standalone product, so buying it means buying or already running the platform. That changes the arithmetic substantially. If you already run Identity Security Cloud, adding NERM is an incremental decision with modest incremental cost, and if you have a meaningful external population it is straightforwardly worth having — it closes a gap your certification campaigns currently leave open. If you do not run the platform, the business case has to carry the whole programme. SailPoint is enterprise-priced and quote-only, and implementation across this category typically runs two to three times licence cost because of connector work, role modelling and certification design. Buying that programme to solve a contractor problem alone is a heavy answer to a narrow question. What to do if contractors are genuinely your entire requirement: consider whether a disciplined process would work — named owners, real expiry dates, a quarterly review — because for a smaller population that is legitimate and far cheaper. Or look at whether your specific concern is privileged third-party access, in which case a vendor PAM product addresses it more directly and can be bought alone. Where the balance usually falls for Indian enterprises above a certain size: the external population is large enough AND a wider governance requirement already exists, so both conditions for NERM are met. But we check that rather than assume it, and we have pointed buyers at lighter answers.

Question 3

Why is this a bigger problem in India?

Accepted Answer

The structural gap is identical everywhere — HR is not authoritative for non-employees, so nothing drives their offboarding. What differs is the volume passing through that gap. Three things make it larger in a typical Indian enterprise. The external population is big relative to headcount: contract staffing, vendor engineers, systems integrator teams and outsourced functions are a normal part of how work gets done, so the ratio of non-employees to employees is often high. Turnover is fast: engagements are shorter, people rotate between projects and employers, and the same individual may be onboarded and offboarded several times under different vendor relationships. And onboarding is frequently manager-led: a project lead needs someone productive on Monday, so access is arranged directly rather than through a process, which means no record exists to drive the eventual removal. Add the regulatory direction of travel. Indian regulators and large enterprise clients increasingly ask specific questions about third-party access — not just whether it is appropriate, but whether you can enumerate it and evidence how it ends. RBI and IRDAI-regulated organisations face this directly, and it flows down contractually to their suppliers. What that means practically: the first request in a third-party access audit is usually for the list, and the failure is usually that producing it takes days and the result is incomplete. That is the specific problem this product solves. TechBag sizes it against your actual population before recommending anything.

Question 4

What does the Entra Verified ID integration actually add?

Accepted Answer

It establishes that the person is who they claim to be at the point of admission, which sounds obvious and is frequently missing. The situation it addresses: a vendor tells you their engineer needs access. That engineer is employed by the vendor, not by you. You have no HR record for them, no background check, and often no in-person contact — the entire relationship is mediated through the vendor. Yet you are granting a login to systems that matter, and if something goes wrong, the access was yours to control and yours to explain. What the September 2025 integration provides: faster onboarding combined with biometric verification through Microsoft Entra Verified ID. Unusually for an identity control, it makes the process both quicker and stronger — most controls trade one against the other. Where it matters most: regulated environments where you must evidence not merely that access was appropriate but that the holder was verified. In Indian financial services and healthcare that question is being asked more often, and 'the vendor vouched for them' is a weakening answer. It also helps where the same individual appears under different vendor relationships over time, because identity is established rather than re-asserted. The honest boundary: this verifies identity. It does not tell you the person is competent, that the vendor's own security controls are sound, that the engagement is still live, or that the access requested is the access needed. Those remain separate questions and separate controls. It closes one specific gap well rather than solving third-party risk generally. TechBag helps scope where verification is genuinely required and where it would be process overhead.

Question 5

Would a spreadsheet do instead?

Accepted Answer

Sometimes, genuinely — and we would rather say so than sell you something you do not need. When a spreadsheet works: your non-employee population is small enough that one person can hold it in their head, onboarding runs through a small number of known managers, and — this is the part that usually fails — somebody actually maintains it. Owners recorded, end dates recorded, and a recurring calendar commitment to review it that survives that person going on leave or changing role. If all of that is true, a spreadsheet and a quarterly reminder deliver most of the value of this product for nothing, and buying an enterprise platform to replace it would be hard to justify. When it stops working, and it usually does: the population grows past what one person can track. Onboarding spreads across enough managers that no single list is complete. The person who maintained it moves on and the discipline lapses quietly. Or an auditor asks for the list and you discover it is three months stale and missing whole categories. That last one is how most organisations find out, and it is an expensive way to learn. The honest test to apply now: ask for the list today, with an owner and an end date for every external identity. If it arrives in an hour and everyone believes it, you may not need this yet. If it takes days, arrives in fragments from several people, and nobody is confident it is complete, the spreadsheet has already failed and you are simply not being told. TechBag will tell you which situation you are in, and we have advised buyers to stay with a process rather than buy a platform.

Question 6

Where are non-employee records stored?

Accepted Answer

In SailPoint's AWS Asia Pacific (Mumbai) region for Indian customers, and this is worth getting into the contract because of what these records contain. On the region: SailPoint has run on AWS Mumbai since 27 November 2024, its ninth point of presence globally, in an environment it describes as completely isolated from other AWS regions, with no data replicated, backed up or stored in any other AWS region. That is a documented statement about storage, and it is the strongest position in this category. SailPoint does not separately document where data is processed, and we are not going to infer a processing answer from a storage statement. Why it matters more for this product than for the platform generally: non-employee records are personal data by definition. Onboarding collects the information needed to admit someone to critical systems — identity details, employer, contact information, and with Verified ID, biometric verification data. Under the DPDP Act that is squarely personal data, and it belongs to people who are not your employees, which can raise its own consent and purpose-limitation questions. What to do: get the region and the sub-processor list written into your contract rather than relying on a webpage. Establish retention — how long non-employee records persist after an engagement ends, and whether that matches your DPDP position. And if you are IRDAI-regulated, remember the 2023 audit annexure asks a direct question about whether ICT logs are held in India. TechBag helps get all of this documented during the evaluation rather than during an audit.

Question 7

Why buy this through TechBag?

Accepted Answer

TechBag is a Bengaluru-headquartered reseller serving pan-India, and on this product our value is mostly in right-sizing the answer. Honest qualification first: we will ask you to try producing the list — every external party with access, an owner and an end date for each. If that arrives in an hour and everyone believes it, you may not need this yet, and we will say so. If it takes days and arrives incomplete, you have your business case and you did not need us to write it. The structural point, before the quote: NERM is an add-on to Identity Security Cloud, not standalone. We make sure you understand that early, because scoping it as a point solution and meeting the platform price during procurement is a bad conversation to have late. If contractors are your entire requirement with no wider governance driver, we will point you at lighter options including a disciplined process, or at vendor PAM if the real concern is privileged third-party access. Programme scoping: if you are buying the platform, we price the connector list, because that drives implementation cost — typically two to three times licence. Compliance: non-employee records are personal data under the DPDP Act, so we help you get the Mumbai region, the sub-processor list and retention terms into the contract, and raise the storage-versus-processing distinction with your DPO before it becomes an audit question. And commercially: INR invoicing with GST, and a local point of contact.

Dimension	Contractors in a spreadsheet	Non-Employee Risk Management (SailPoint)
Authoritative source	None — HR does not know them	The platform, with a named owner
Who onboarded them	A manager, by email	A defined process, with a record
Identity verification	The vendor vouched for them	Entra Verified ID, biometric
Access end date	None — persists until noticed	Expires unless the owner renews
In the access review	Excluded — the review draws from HR	Reviewed alongside staff
Producing the list	Eleven days and four spreadsheets	On request
When the engagement ends	The account continues	Offboarding fires
Commercial structure	(varies)	⚠️ An add-on to the platform

Dimension	SailPoint NERM	Saviynt External	Idira (was CyberArk)	A spreadsheet	Vendor PAM	Do nothing
Position	Non-employee governance add-on	External Identity Management module	Vendor PAM, privileged focus	What most organisations do now	Privileged third-party access only	Access persists by default
Named internal owner	Yes — core to the model	Yes	Partial	If someone maintains it	For privileged sessions	No
Expiry that fires	Yes — ends unless renewed	Yes	Session-scoped	A calendar reminder at best	Session-based by design	No
Identity verification	Entra Verified ID, biometric (Sept 2025)	Present	Present	The vendor vouched for them	Varies	None
In access certification	Yes — alongside employees	Yes	Within the platform	Usually excluded	Not a certification tool	No
Standalone purchase	⚠️ No — an add-on to the platform	Within the Saviynt platform	Vendor PAM is buyable alone	Free	Yes	Free
Best fit	Already on SailPoint, large external population	Already on Saviynt	PRIVILEGED third-party access specifically	A genuinely small population one person can hold	Session-level control of vendor engineers	Nothing — this is the position auditors find

Non-Employee Risk Management

The SailPoint platform family

Quick facts

Understand non-employee identity before you buy it

What is NERM?

Contractors nobody tracks vs identities with an owner — the honest table

The five pieces of the platform

The Population HR Does Not Own

An Owner Who Is Accountable

An Expiry That Fires

Onboarding With Verified Identity

Inside The Same Certification

Twelve capabilities. Admit, own, expire.

Centralised Non-Employee Visibility

Named Internal Owner Per Identity

Business-Partner Risk Visibility

Structured Non-Employee Onboarding

Microsoft Entra Verified ID (Sept 2025)

Time-Bound Access By Default

Full Non-Employee Lifecycle

Included In Access Reviews

Sponsorship & Attestation Workflow

Audit Evidence For External Access

Part Of Identity Security Cloud

AWS Mumbai — For Storage

Watch Non-Employee Risk Management in action

SailPoint Non-Employee Risk Management Overview

Non-Employee Management API capabilities

SailPoint Identity Security Cloud Overview

Access that outlives the engagement. Or an expiry date.

This is the population an auditor finds first

Ownership and expiry do most of the work

Verified identity for people you have never met

It is an add-on, and that changes the arithmetic

The honest scope

The numbers behind the platform

What your Non-Employee Risk Management evaluation looks like

Try to produce the list

Check whether a spreadsheet would still work

Scope it as part of the platform decision

Make sponsorship a habit

The review scoreboard

Quick poll — what’s driving your evaluation?

Where everyone sits — the grids

TechBag Identity Governance Grid

Coverage × Speed to Start

NERM vs the alternatives — including a spreadsheet

Which approach fits you?

Choose NERM if…

A disciplined spreadsheet if…

Vendor PAM if…

Look wider if…

What does untracked contractor access cost you?

Three ways to consume it

Non-Employee Risk Management

+ Platform add-ons

+ the honest alternative

Buy it for less — TechBag pricing beats list

Get an India-ready quote

The 8 questions to ask every vendor

Questions buyers ask

Ready to find out how big the gap is?