Start with complete identity discovery across all IdPs, then score each identity by its actual reach, not just by assigned roles. The programme should include human, non-human, and AI identities, because cloud posture breaks when the estate is only partially visible.
Why ISPM Has to Cover the Whole Identity Estate
ISPM only works when it sees the same estate an attacker or failure mode would see: every human, service, workload, device, and AI identity across cloud and hybrid environments. The practical shift is from checking assigned entitlements in one directory to understanding real exposure across all identity systems, their trust relationships, and their drift over time.
For teams modernising beyond a single directory, the programme has to include cloud-native accounts, federated identities, and legacy directories in one view. NHIMG’s Identity Security Programme Guide is useful here because ISPM succeeds as an operating model, not a one-off assessment.
That scope also has to include the mechanisms that quietly expand blast radius, especially hybrid trust paths and standing access. The Active Directory and Entra ID Hardening Guide is a strong companion for the parts of the estate where legacy directory design, delegation, and tiering still shape posture.
Identity Security Programme Guide also matters because ISPM needs ownership, prioritisation, and governance decisions that survive beyond the first discovery sprint. If findings are not tied to accountable teams, posture data becomes a report rather than a programme.
How to Score Identity Risk by Reach, Not Just by Role
The right ISPM model scores identities by what they can actually reach, not by how they are labelled in a directory. A low-privilege role can still have broad effective access through group nesting, delegation, inherited permissions, token scope, federated trust, or cross-cloud connectivity.
That is why discovery should be paired with effective-access analysis, privilege concentration, and path-based review. NHIMG’s Identity Security Posture Management (ISPM) Guide is the most direct reference for how to prioritise posture findings once the estate is visible.
For cloud identity specifically, the useful question is whether the identity can assume roles, mint tokens, or reach production assets without a compensating control. Cloud Workload Identity Guide is relevant because cloud posture often fails where temporary credentials, managed identities, and federation are not treated as first-class exposure paths.
Role labels are still worth collecting, but they are not enough on their own. The practical standard is to treat reachability, standing privilege, and trust relationships as the main posture signals, then use roles as one input to that assessment rather than the assessment itself.
What Changes When Human, Non-Human, and AI Identities Share One ISPM Programme
A single ISPM programme should normalise all three identity populations, because each introduces different posture failures and different remediation patterns. Human identities usually drive authentication, access review, and privileged access issues, while non-human and AI identities tend to introduce hidden secrets, overprivilege, poor lifecycle control, and unclear ownership.
That mixed estate is why lifecycle discipline matters as much as initial discovery. NHI Lifecycle Management Guide is helpful for the discovery-to-offboarding flow, especially where dormant credentials, stale access, or unowned identities persist after teams believe they have already cleaned up the environment.
For organisations trying to standardise the broader operating model, Identity Convergence Guide is useful because it frames workforce, privileged, customer, non-human, and AI agent identity as one governance problem with multiple populations.
Where cloud and hybrid estates are involved, effective ISPM also has to account for workload-to-workload trust, not just user login risk. That is why the posture programme should treat service identities, service principals, and federated credentials as visible assets, not implementation details buried inside platform teams.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5, CSA Cloud Controls Matrix and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | ISPM depends on knowing which identities exist and who owns them. |
| Recommendation — Inventory identities and review account lifecycle, access, and ownership continuously. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | ISPM is driven by account inventory, lifecycle state, and review of active access. |
| IA-5 — Authenticator Management | Cloud and hybrid ISPM must track the secrets and authenticators that enable identity reach. | |
| Recommendation — Maintain authoritative account records and remove stale or orphaned access promptly. Rotate, protect, and revoke authenticators and credentials on a defined lifecycle. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Cloud identity posture management maps directly to cloud IAM visibility, control, and governance. |
| Recommendation — Apply cloud IAM controls to centralize identity visibility and enforce least privilege. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems within the organization are inventoried | ISPM starts with complete inventory of identity-relevant systems and accounts across estates. |
| PR.AA-01 — Identities and credentials are issued, managed, verified, revoked, and audited | ISPM is fundamentally about identity lifecycle control across human and non-human populations. | |
| Recommendation — Build a complete inventory of identity sources, trust paths, and managed identities. Standardize issuance, review, revocation, and audit of all identities and credentials. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity management | ISPM requires consistent identity governance across cloud and hybrid environments. |
| A.5.17 — Authentication information | ISPM must account for the secrets and authenticators that create posture risk. | |
| Recommendation — Define and enforce identity governance processes across all identity populations. Protect authentication information with lifecycle controls and secure handling rules. | ||
Practitioner Guidance
What to prioritise: Start with inventory completeness and identity ownership before chasing advanced scoring. If an identity cannot be attributed to a business or technical owner, the posture finding will usually remain open because no one can confirm whether the access is still needed.
What to verify: Check that the scoring model uses effective reach, not only assigned roles, and that it includes cloud federation, directory trust, standing privilege, and non-human credentials. If the score cannot change when a trust path or secret is added, the model is too shallow.
What good looks like: A mature programme produces one identity view across IdPs, one prioritised queue of risky access, and one remediation path that works for human, non-human, and AI identities. The best indicator is not volume of findings, but whether the same risky pattern is being removed repeatedly instead of reappearing in a different system.
Practitioner takeaway: ISPM becomes useful when it is run as an estate-wide visibility and reachability programme, not as a role-review exercise inside a single identity platform.
Related resources from NHI Mgmt Group
- How should public sector teams govern hybrid identity security across cloud and on-prem systems?
- How should security teams reduce identity sprawl across hybrid and multi-cloud environments?
- How should security teams implement continuous identity discovery across hybrid environments?
- How should security teams implement runtime identity controls across hybrid environments?