Measure it from the HR termination event to completed deprovisioning across every application, not just inside one tool. That requires joining HRIS timestamps, workflow logs, and per-app account status on a shared identity key. If you cannot do that without a manual data project, your stack is reporting activity, not governance outcomes.
Why This Matters for Security Teams
mean time to revoke is only useful if it measures the full identity lifecycle, not the speed of one admin console. In a disparate stack, termination, contractor offboarding, API key revocation, and account disablement often live in different systems with different clocks and different owners. That means a short number can hide a long tail of active access after the business believes the identity is gone.
Security teams should treat revocation as an outcome metric tied to governance, not a workflow completion metric. The OWASP Non-Human Identity Top 10 and NIST access-control guidance both point toward measurable enforcement, but the practical challenge is correlating HRIS, ITSM, PAM, IAM, SaaS admin, and application telemetry on one shared identity key. NHIMG research on the Ultimate Guide to NHIs shows how often identities outlive their intended use, which is exactly why revocation timing matters operationally.
In practice, many security teams discover delayed revocation only after a departed user or a stale NHI is still active in a downstream application, rather than through intentional governance reporting.
How It Works in Practice
The cleanest model is to define one start event and one end state. The start event is usually HR termination, contract end, or automated decommission request. The end state is not “ticket closed” or “disable requested”; it is when every in-scope application has confirmed the identity is no longer able to authenticate, authorize, or retrieve secrets. That distinction matters because a workflow can complete before the technical control is actually enforced.
To make the metric reliable, teams need a correlation layer that joins records across systems using a shared identity key, such as employee ID, contractor ID, service account identifier, or workload identity subject. From there, they can calculate elapsed time at each dependency point: HR event to ticket creation, ticket creation to first disable action, first disable action to final app confirmation, and final app confirmation to revocation closure. This is where identity governance, PAM, and secrets management all need the same time source and the same ownership model.
- Use a single identity master where possible, then map downstream aliases and local account names.
- Record timestamps in UTC and keep source-system timestamps for auditability.
- Track every target system, including SaaS apps, API keys, and service accounts.
- Measure both median and 95th percentile revocation time, since the tail often reveals the real risk.
For implementation detail, current guidance from NIST SP 800-53 Rev 5 Security and Privacy Controls supports auditable access enforcement and accountability, while NHIMG’s NHI Lifecycle Management Guide emphasizes lifecycle visibility for non-human identities. The metric should include retries, exceptions, and systems without native SCIM or API support, because manual remediation still counts as revocation work. These controls tend to break down when identity data is fragmented across acquired businesses or shadow SaaS apps because no single system can verify final deprovisioning.
Common Variations and Edge Cases
Tighter revocation measurement often increases operational overhead, requiring organisations to balance audit precision against integration cost. That tradeoff becomes sharper when the stack includes contractors, third parties, or machine identities that do not map neatly to HR records. Current guidance suggests separating human and non-human paths rather than forcing both into one workflow, because a service account may need secret rotation or workload termination instead of a traditional disable action.
Edge cases also include shared admin accounts, emergency access, delegated SaaS administration, and identities that authenticate indirectly through tokens or certificates. In those cases, Mean Time to Revoke should be expanded to include token invalidation, certificate revocation, vault purge, and removal of role bindings. If the organisation uses just-in-time access, the question becomes whether standing privilege was removed on time and whether the ephemeral grant expired automatically. That is a different control outcome than merely closing a ticket.
For mature programmes, the best practice is evolving toward event-based measurement on top of 52 NHI Breaches Analysis style lessons: detect the path where identities persist after offboarding, then eliminate the longest-delay systems first. The metric is least useful when teams count only systems that support automation, because the unautomated tail is usually where exposure remains longest.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-01 | Addresses identity lifecycle tracking across systems. |
| OWASP Non-Human Identity Top 10 | NHI-05 | Covers lifecycle revocation for non-human identities. |
| NIST SP 800-63 | Supports identity assurance and account lifecycle governance. | |
| NIST Zero Trust (SP 800-207) | PA-7 | Zero trust requires continuous enforcement and rapid access removal. |
| NIST AI RMF | GOVERN | Govern function supports accountable identity risk measurement. |
Measure time to revoke service accounts and keys until all downstream access is gone.
