When two organisations merge, different access rules can leave gaps that attackers exploit. One side may allow broad standing access while the other requires tighter controls, creating confusion over who should have access to which apps and data. Harmonising policies early reduces unauthorised access, limits lateral movement, and makes compliance easier to prove across the combined environment.
Why This Matters for Security Teams
After a merger, access policy drift becomes a control problem, not just an administrative one. If one SaaS tenant still permits broad standing access while the other has tighter approval and review rules, attackers only need the weaker path to move across shared business workflows. NIST’s NIST Cybersecurity Framework 2.0 treats governance and access control as foundational because inconsistent enforcement creates predictable gaps in prevention, detection, and recovery.
This is especially dangerous in SaaS environments where identity sprawl, delegated admin rights, and application-to-application connections already blur the boundary between business units. NHIMG research shows Ultimate Guide to NHIs notes that 97% of NHIs carry excessive privileges, which is a useful warning sign for post-merger environments where inherited access is often left untouched for too long. In practice, many security teams discover this only after an audit finding, a failed deprovisioning event, or suspicious cross-tenant activity has already occurred.
How It Works in Practice
The safest merger approach is to treat access harmonisation as a security integration workstream, not a back-office cleanup task. Teams should inventory SaaS applications, map users and non-human identities to business ownership, and identify where policy differences create inconsistent entitlement decisions. That includes SSO groups, role mappings, conditional access rules, API tokens, service accounts, and delegated admin rights.
Current guidance from the OWASP Non-Human Identity Top 10 aligns with the need to reduce standing access and move toward least privilege for machine identities as well as humans. In a merger, that often means defining a common access baseline, then applying exceptions only where business-critical systems require them. The operational sequence usually looks like this:
- Classify SaaS apps by sensitivity, business function, and data residency impact.
- Compare both organisations’ access policies for privilege, approval, MFA, and review cadence.
- Normalize roles and remove duplicate or overlapping entitlements.
- Reissue or rotate high-risk credentials and service account permissions.
- Validate access through test scenarios before decommissioning legacy policy paths.
For identity-heavy environments, NHIMG’s Top 10 NHI Issues is a practical reminder that visibility and lifecycle control matter as much as policy design. The issue is not only who can log in, but which accounts, keys, and app-to-app permissions survived the merger without review. These controls tend to break down when the combined SaaS estate is large, decentralized, and still operating under separate HR, legal, or IT ownership because no single team can prove policy consistency end to end.
Common Variations and Edge Cases
Tighter access harmonisation often increases migration overhead, requiring organisations to balance speed of integration against the risk of inherited over-permissioning. That tradeoff becomes more pronounced when the merged companies use different SaaS vendors, separate identity providers, or distinct compliance obligations.
There is no universal standard for merger-day access consolidation yet, so current guidance suggests prioritising the systems with the highest privilege concentration first. That usually means finance platforms, collaboration tools with external sharing, cloud admin consoles, and any SaaS app that can issue or store secrets. If one company relied on broad role-based access and the other used more granular approvals, the merged policy should not simply average the two approaches; it should adopt the stricter control where it protects sensitive data without blocking essential operations.
NHIMG’s Ultimate Guide to NHIs — Regulatory and Audit Perspectives is useful here because auditors will usually ask how inherited access was reviewed, not whether a harmonization plan existed on paper. The hardest edge case is acquisition of a business unit that uses shadow IT or long-lived API keys outside central IAM, because policy alignment can fail where ownership is unclear and revocation paths are missing.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-1 | Inconsistent SaaS access policies weaken identity and access governance after merger. |
| OWASP Non-Human Identity Top 10 | NHI-03 | Inherited SaaS service accounts and tokens often retain excessive privileges after consolidation. |
| NIST SP 800-63 | IAL2 | Merged environments need trustworthy identity proofing and lifecycle alignment for access decisions. |
| NIST Zero Trust (SP 800-207) | AC-4 | Zero Trust requires policy consistency so every access request is evaluated uniformly. |
| CSA MAESTRO | GOV-02 | MAESTRO emphasizes governance consistency for SaaS and cloud control integration. |
Standardize access approval and enforcement across both tenants, then verify least privilege remains consistent.
Related resources from NHI Mgmt Group
- Why do cloud ERP environments still create identity and access risk even when workflow automation is in place?
- Why do ERP environments create so much risk when access is granted too broadly?
- Why do SaaS environments still create identity risk even after SSO is in place?
- Why do autonomous identities increase the risk of ungoverned access in cloud and SaaS environments?
