Periodic campaigns assume access is stable long enough to be reviewed on a schedule, but modern environments change continuously across SaaS and machine identities. By the time a review closes, entitlement context may already be outdated. Continuous governance closes that gap by using live identity, usage, and risk signals instead of static snapshots.
Why This Matters for Security Teams
Periodic certification campaigns were built for a world where access could be treated as a snapshot. That assumption breaks when SaaS permissions, service accounts, API keys, and agent-driven workflows change between review cycles. Current guidance in NIST Cybersecurity Framework 2.0 emphasizes continuous risk-aware governance, which is a better fit for today’s identity sprawl. NHIMG research on the Ultimate Guide to NHIs also frames lifecycle visibility as a core control problem, not an annual admin exercise.
The practical issue is that reviewers often certify what was true at the start of the campaign, not what is still true at the end. Entitlements drift, owners change, integrations proliferate, and stale access can remain approved simply because nobody had a current signal to challenge it. In one NHIMG data point, only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, underscoring how weak static review processes can be when identity state is always moving. In practice, many security teams encounter misuse only after an entitlement has already been abused, rather than through intentional review discipline.
How It Works in Practice
Continuous identity governance replaces batch review with live decisioning. Instead of asking managers to re-certify a frozen spreadsheet, security teams feed current signals into access decisions: user and workload identity, recent usage, device or workload posture, risk scores, ownership, and sensitivity of the target system. That makes NIST SP 800-63 Digital Identity Guidelines and modern identity proofing concepts more operational, because identity assurance is only useful when it is paired with ongoing authorization checks.
For non-human identities, the control model should be even stricter. NHIs are better managed through inventory, binding to owners, secret rotation, usage monitoring, and expiry-based enforcement. The lifecycle perspective in Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs is useful because it treats identity as something to monitor continuously, not merely approve periodically. A workable pattern usually includes:
- continuous discovery of accounts, service principals, tokens, and OAuth grants
- policy checks at request time, not only during campaign windows
- automatic escalation when access is unused, over-privileged, or unowned
- event-driven removal for stale entitlements and expired secrets
This is also where governance connects to breach lessons. NHIMG’s 52 NHI Breaches Analysis shows that identity failures are often discovered through exploitation patterns, not audit schedules. Continuous governance shortens the time between drift and response, which matters because a review that closes after the risk has already changed provides comfort, not control. These controls tend to break down when identity data is fragmented across multiple SaaS tenants and shadow integrations because no single system has the full usage context.
Common Variations and Edge Cases
Tighter continuous controls often increase operational overhead, requiring organisations to balance decision speed against review fatigue and data quality. That tradeoff is real, especially in large enterprises where ownership is unclear or entitlement telemetry is incomplete. Current guidance suggests that campaign-based recertification can still have a place for regulatory attestation, but best practice is evolving toward exception handling and continuous monitoring rather than relying on full-scope periodic recertification alone.
There are also cases where periodic review is still necessary. High-risk access, privileged roles, and regulated environments may require formal sign-off, especially when auditors need evidence of governance cadence. But that does not make campaigns sufficient. They work best as a backstop, not as the primary control. For modern environments, the operational question is whether governance can react quickly enough to changes in access, ownership, and context. NHIMG’s Top 10 NHI Issues and the Ultimate Guide to NHIs — Regulatory and Audit Perspectives both reinforce that evidence quality matters, but evidence gathered too late is not the same as effective control.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC | Continuous access control is the core alternative to snapshot-based certification. |
| NIST SP 800-63 | Identity assurance is weak without ongoing validation of identity state and risk. | |
| OWASP Non-Human Identity Top 10 | NHI-03 | Stale non-human identities are a common failure mode for periodic reviews. |
| CSA MAESTRO | Agentic and machine identities need runtime governance, not infrequent manual approval. | |
| NIST AI RMF | GOVERN | Governance for AI systems requires ongoing monitoring, accountability, and risk management. |
Use live access signals to enforce least privilege and remove stale access as soon as context changes.
