Sun Looks To Partners To Help Deliver Compliance, RFID Solutions

The Santa Clara, Calif., company on Monday introduced an auditing solution for the Sun Java System Identity Manager that enables customers to meet Sarbanes-Oxley Act (SOX) and HIPAA requirements. Called Sun Java System Identity Auditor, the add-on helps customers comply with provisions of the SOX and HIPAA legislation that require them to create a secure identity audit trail and a view of an individual's identity and system-access activities. Pricing for the multiplatform solution starts at $250,000.

Last week, Sun also launched an entry-level RFID solution to help speed adoption of the technology in the retail sector, as well as the Compliance and Content Management Solution, which allows companies to store and archive corporate e-mail and instant messages as required by legislation and regulations including SOX, HIPAA, SEC 17a-4 and Gramm-Leach-Bliley.

Many customers currently are cobbling together various pieces of technology on the fly to meet those requirements, but they need a solution like Sun's Identity Auditor to create a sustainable business process, said Tamara Rezler, director of product management for identity at Sun.

Specifically, Sun's auditing solution meets provisions that require companies to report on and manage who has access to sensitive information, such as medical records or financial applications. It's also designed to provide data on historical access privileges and secure auditable evidence that these controls are in place. The add-on to the existing Identity Manager automated provisioning software offers enforcement features so a company can react quickly to any violations and minimize risk or quickly shut down system access to terminated employees, company executives said.

"Companies have put together manual processes. They're meeting [compliance requirements] but with duct tape and bailing wire," Rezler said. "They have put new people and processes in place that are expensive, and it's sort of working. But it's not sustainable. This is not like Y2K. These [requirements] become part of the fabric of every business."

Sun executives said the vendor will rely on channel partners to help deploy the auditing solution, as well as its RFID solution.

The company released the Sun Java System RFID Tag and Ship Solution and the Sun RFID Reference Architecture on Jan. 17. An entry-level offering, the Tag and Ship Solution enables customers and their partners to deal with specific RFID-compliant requests from retailers such as Wal-Mart, Target and Albertson's and from the U.S. Department of Defense. The solution will be priced between $40,000 and $70,000, within the range of similar offerings, a Sun spokeswoman said.

Sun is delivering prepackaged solutions, product bundles and reference architectures to enable faster deployment of RFID solutions and meet the needs of specific verticals, such as retail. Vijay Sarathy, director of Sun's RFID product marketing and strategy, said the company has traditional strongholds in telecom and finance but is evolving to serve all verticals, including pharmaceuticals. That strategy will require broad participation from Sun's iForce partners, he said.

"We learned some lessons from that and are trying to have a broader portfolio of solutions. Sun is demonstrating a greater understanding of the marketplace," Sarathy said. "We're working more with partners on services and understanding pain points of our customers."

Marc Maselli, CEO of Back Bay Technologies, a Boston-based solution provider and iForce partner, said it's a good move for Sun to enlist the help of channel partners to deliver solutions. "It's wise that Sun and other vendors look to position their software as a foundation for business solutions," he said. "Without [Sun] purchasing a professional services firm, as IBM did with [PricewaterhouseCoopers], it's critical [for them to partner] with firms such as ours that have true vertical orientation--in our case, insurance and financial services. Selling software on technical features only will not work."

Another large systems integrator that plans to deploy Sun's Identity Auditor said it will help reduce costs for customers. "The cost challenges are significant as organizations work toward achieving compliance control objectives," said John Clark, principal of Deloitte and Touche Security Services. "Organizations need a comprehensive identity-management solution to streamline identity auditing and incorporate it in everyday business activity, which can significantly reduce audit and long-term operational costs."

Earlier this month, Sun also unveiled its Compliance and Content Management Solution, designed to help customers meet storage and archiving electronic records requirements imposed SOX, HIPAA, SEC 17a-4 and Gramm-Leach-Bliley. However, that solution--provided in conjunction with Sun ISV partner AXS-One--is sold, serviced and supported by Sun only. It combines Solaris 10, a Sun storage and file system, AXS-One software and a Web search screen for locating all electronic records, including e-mail and instant messages.