It is working when cyber, physical and operational access decisions produce one consistent outcome across onboarding, access review and offboarding. If a badge, account or contractor record can be removed in one domain while access persists in another, the programme is not yet converged. The test is whether controls line up around the same person, role or workload.
How do utilities know converged access governance is actually working?
converged access governance works only when the same access decision is enforced consistently across cyber, physical and operational controls. That means onboarding, role change, periodic review and removal all produce the same result for the same person, role or workload. A split outcome, where one system still grants access after another has removed it, is the clearest sign the model is not converged.
What does “one consistent outcome” look like in practice?
The simplest test is whether the organisation can answer the same question once, not three different ways: who is allowed in, who reviewed that access, and who can revoke it. In a converged model, an identity event such as joiner, mover or leaver should update entitlement decisions across badge systems, logical accounts and contractor records without manual reconciliation. IAM and IGA Basics is a useful reference point for the access-governance mechanics behind that consistency.
Consistency also means the governance record is authoritative enough to drive action. If a physical badge is revoked, the corresponding digital account or operational permit should not remain active by default. That is why access governance has to operate as a control plane, not just as a reporting layer.
Which control failures show that convergence is incomplete?
The usual failure mode is fragmented ownership. Facilities, OT operations, HR, IT and third-party managers each think they own part of the lifecycle, so removals happen in one domain while permissions persist in another. Access Reviews and Certification Guide is directly relevant because review campaigns only work when they close the loop on real revocation, not just approval tracking.
A second failure is mismatch between identity sources. If badge status, contractor status and account status are not tied to the same authoritative record, reviews can pass while residual access remains. That is especially visible in leaver cases, where revocation is the strongest proof that governance is truly converged. Joiner-Mover-Leaver (JML) Guide helps frame the lifecycle discipline needed to prevent those gaps.
Another sign of weak convergence is when review results are not actionable across all access types. If the process can certify accounts but cannot remove a badge, or can revoke a badge but cannot trigger application deprovisioning, the programme is still operating in silos.
Risk and Threat Considerations
When access governance is not converged, organisations get the worst of both worlds: duplicated approvals and incomplete revocation. That creates standing access after apparent offboarding, makes recertification unreliable, and gives attackers or insiders more than one path to persist after a change event. The risk grows quickly when contractors, shared roles or temporary access are involved.
Failure mechanism: Different systems hold different truth about the same person or workload, so a removal in one domain does not cascade to the others. That lets access survive beyond the intended end date, or lets a mover retain old entitlements after a role change.
Impact: Residual access expands the blast radius of credential theft, insider misuse and simple administrative error. It also undermines auditability, because the organisation can no longer trust that a completed review or leaver workflow really removed access everywhere it mattered.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Converged access governance depends on unified account lifecycle and removal across systems. |
| AC-6 — Least Privilege | Consistent outcomes should prevent residual access after role or status changes. | |
| IA-5 — Authenticator Management | Access convergence fails when credentials or authenticators remain active after offboarding. | |
| Recommendation — Align account lifecycle changes so access is provisioned, reviewed and removed consistently across domains. Reduce standing access and ensure each domain enforces only the minimum necessary access. Tie credential issuance, rotation and revocation to the same lifecycle state. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Access control governance must produce consistent enforcement across connected domains. |
| A.5.16 — Identity management | Convergence requires one authoritative identity view across systems and functions. | |
| A.5.18 — Access rights | The question is about whether access rights are granted and removed coherently. | |
| Recommendation — Define and enforce a single access-control policy across physical, cyber and operational environments. Maintain one authoritative identity record that drives access decisions across domains. Review and revoke access rights on a coordinated schedule across all connected control planes. | ||
| CIS Controls v8 | CIS-5 — Account Management | Access convergence is validated through consistent account lifecycle control and removal. |
| Recommendation — Centralize account lifecycle control and verify that removals propagate to every environment. | ||
Practitioner Guidance
What to verify: Test a small sample of joiner, mover and leaver events end to end. The important check is not whether each team completed its own task, but whether the final state matches across all three domains after the workflow closes.
What good looks like: A single authoritative event changes badge status, account status and contractor status together, and every exception is visible with an owner and an expiry. If exceptions are recurring, the issue is usually process fragmentation rather than isolated human error.
What practitioners underestimate: Review success is often overstated because approvals are counted, while actual revocation is not. The better measure is whether downstream systems reflect the decision without manual cleanup.
Practitioner takeaway: Convergence is proven by synchronized removal as much as by synchronized approval, so the most valuable test is whether offboarding and access review leave no surviving path in any domain.