Because most frameworks ultimately ask who has access, what level of access they hold, and whether that access is justified. Compliance automation can document the control, but identity governance determines whether the underlying access decision is actually valid.
Why Compliance Frameworks Keep Coming Back to Access Decisions
Most compliance regimes are not really judging paperwork, they are judging whether access is controlled, explainable, and proportionate to the business need. That means the real control question is still identity governance: who got access, why they got it, whether it changed, and whether it was removed when it should have been.
Compliance automation can speed up evidence collection, but it does not validate the entitlement itself. If a framework asks for access reviews, segregation of duties, least privilege, or joiner-mover-leaver discipline, it is relying on governance over identities and entitlements rather than on reporting alone. See IAM and IGA Basics for the distinction between access administration and governance.
What Compliance Control Owners Are Really Testing
Frameworks tend to converge on the same operational proof points because access risk is universal. They want evidence that privileges are assigned intentionally, approvals are traceable, high-risk access is reviewed, and stale or excessive access is removed. That is why identity governance sits underneath so many different audit narratives, even when the framework itself is written in broader control language.
For machine and service access, the same logic applies. A token, key, certificate, or service account can satisfy authentication, but compliance still depends on whether the access was owned, scoped, reviewed, and retired correctly. NHIMG’s Ultimate Guide to NHIs, Lifecycle Processes for Managing NHIs and Joiner-Mover-Leaver (JML) Guide are useful because they show how lifecycle controls make that governance auditable.
Where organisations struggle is not usually in generating an attestation file. It is in proving that the underlying access model was current when the control operated. That is why access review quality, role design, and separation of duties matter more than simply having a workflow tool in place.
Why the Evidence Trail Must Follow the Identity Model
Compliance evidence is only persuasive when it reflects the actual identity state. If roles are bloated, access is inherited too broadly, or exceptions are left open indefinitely, the audit trail may be complete while the control is still weak. Identity governance closes that gap by tying evidence back to entitlement design, ownership, review cadence, and revocation.
That is also why role structure and conflict rules keep showing up across frameworks. Well-formed roles limit review noise, and segregation of duties prevents combinations of access that may be individually valid but jointly unsafe. Role Mining and Role Design Guide and Segregation of Duties (SoD) Guide both support that operational view.
For practitioners, the key point is that compliance frameworks rarely replace identity governance, they presuppose it. If access is not governed well, the control may still be logged, but it will not be trustworthy.
Risk and Threat Considerations
When identity governance is weak, compliance failures are usually a symptom of broader exposure: excessive privilege, orphaned access, unmanaged exceptions, and access that survives role changes or departures. Adversaries also benefit from the same conditions because stale entitlements and overbroad privileges create easier paths to persistence and lateral movement.
Failure mechanism: The framework records that a review or approval happened, but the identity data underneath is incomplete, stale, or poorly scoped, so the organisation certifies access that is no longer justified.
Impact: That gap can produce audit findings, control exceptions, unauthorized access, and higher blast radius after compromise, especially where privileged or third-party access is involved.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Identity governance depends on controlled account lifecycle and review evidence. |
| AC-6 — Least Privilege | Compliance frameworks rely on access being justified and limited to need. | |
| IA-5 — Authenticator Management | Governed identities require lifecycle control over credentials and authenticators. | |
| Recommendation — Define account ownership, review cadence, and removal triggers for every access-bearing identity. Restrict entitlements to the minimum access needed for each business function. Track issuance, rotation, and revocation for credentials that enable access. | ||
| ISO/IEC 27001:2022 | A.5.18 — Access rights | Identity governance underpins review, approval, and revocation of access rights. |
| A.5.15 — Access control | Compliance evidence depends on access control decisions being policy-driven and current. | |
| Recommendation — Review and revoke access rights when business need changes or ends. Apply and enforce access control rules consistently across identities and systems. | ||
Practitioner Guidance
What to verify: Verify that every compliance control claiming access oversight can trace back to an owner, an entitlement source, a review decision, and a removal path. If any of those four elements are missing, the evidence is descriptive rather than controlling.
Common mistake: Treating recertification as the control itself. A clean review report does not compensate for bad role design, unmanaged shared access, or long-lived exceptions that never get revisited.
What good looks like: Access decisions are tied to business justification, reviews are risk-based rather than purely periodic, and removal is automatic or at least tightly tracked when the justification ends. That is the point where compliance becomes an outcome of governance rather than a separate reporting exercise.
Practitioner takeaway: If you cannot prove the access decision is still valid, you do not have compliance maturity, you have documented uncertainty.