The uncontrolled expansion of access rights that can happen when two organisations merge and large numbers of users are onboarded quickly. It usually appears when temporary access decisions are made for speed and then persist because no team owns the cleanup or review phase.
What Merger Access Sprawl Looks Like in Practice
Merger access sprawl is not just “too many accounts”, it is a temporary surge in entitlements that becomes permanent when onboarding outruns cleanup. The defining feature is that access is granted to keep the combined business moving, then left in place because ownership, review, and deprovisioning lag behind the transaction.
In real mergers, this often shows up as duplicated roles, inherited admin rights, shared credentials, and broad access that was approved for transition work but never revisited. The problem can also cross platforms, since each company may bring its own IAM model, naming conventions, and approval history into a single environment.
Why It Happens During Mergers
Access sprawl is created by speed and uncertainty. Integration teams need to connect systems, preserve operations, and avoid blocking finance, HR, customer support, and IT, so they often grant more access than they would in a steady-state environment.
The issue becomes durable when no one owns the post-close rationalisation step. If roles are mapped loosely, shadow approvals are accepted, or old access paths are never re-certified, the merged environment inherits the union of both estates instead of a deliberately reduced permission model.
Merger-driven expansion can also expose NHI lifecycle and ownership problems, because service accounts, automation, and application credentials are often overlooked during human account reconciliation.
Security and Governance Impact
Access sprawl weakens least privilege by making it harder to know who can reach what, why they can reach it, and whether that access is still needed. It also raises the chance that orphaned privileges, inherited admin rights, and stale accounts survive long after the merger work is complete.
The longer this state persists, the more it blurs accountability for approvals, recertification, and revocation. That can complicate incident response, audit evidence, and the eventual separation of duties model the combined organisation needs to enforce.
For non-human accounts and secrets, Top 10 NHI Issues is a useful reference point because merger cleanups often inherit excessive permissions, shared access, and stale credentials at the same time.
How to Recognise and Reduce the Sprawl Pattern
The clearest signal is a permission set that keeps expanding while no one can explain the original business need for each entitlement. In a merger, that usually means access was granted for transition work, then never collapsed into a smaller steady-state model.
Reducing the pattern requires treating access cleanup as part of integration, not as a follow-up task. The goal is to collapse temporary access, remove duplicate roles, and move from inherited permissions to a deliberately owned model that can be reviewed and revoked.
That is why a practical baseline is to centralise secrets and reduce long-lived access material while the merged estate is being rationalised. Temporary access should not become permanent simply because the organisations have already combined.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Merger access sprawl directly affects excessive permissions and privilege scope. |
| IA-5 — Authenticator Management | Mergers often leave stale credentials, tokens, and shared access material in place. | |
| AC-2 — Account Management | Access sprawl is fundamentally an account lifecycle and ownership problem after integration. | |
| Recommendation — Enforce least privilege and remove inherited access that no longer supports the merged business need. Rotate, revoke, and inventory credentials created during the merger before they become permanent risk. Centralize account ownership and retire duplicate or orphaned accounts created during the merger. | ||
| CIS Controls v8 | CIS-5 — Account Management | The term centers on uncontrolled account growth and persistent access after onboarding. |
| Recommendation — Consolidate account ownership and remove accounts that no longer have a justified business purpose. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access Control | Merger access sprawl is a direct access-control governance issue. |
| Recommendation — Define and enforce access rules that prevent temporary merger access from becoming standing access. | ||
Practitioner Guidance
Governance implication: merger access sprawl should be treated as a post-close control problem, not an unavoidable by-product of integration. The important question is who owns the cleanup, who signs off exceptions, and when temporary access expires.
Common misunderstanding: many teams assume the merger programme ends when systems are connected. In practice, the riskiest period is often after initial access has been granted, when review discipline starts to fade and inherited permissions begin to look normal.
Practitioner takeaway: if temporary access is not explicitly time-bound and owned, it tends to survive the merger and become part of the new security baseline.