Common signs include badge renewals that follow a different cadence from access reviews, contractor exits that remove VPN rights but not facility entry, and audit requests that require separate evidence from security and facilities. Those symptoms usually mean physical access is being managed as an exception, not as an identity control.
When physical access slips outside IAM governance
Physical access is outside IAM governance when the facility badge process, visitor approvals, or contractor entry rules are controlled by a separate operational system that does not share lifecycle ownership, review cadence, or deprovisioning triggers with the identity program. The clearest warning signs are mismatched evidence, inconsistent offboarding, and exceptions that persist after the person’s logical access has changed.
How to tell the control plane has split
A split control plane usually shows up first in the process, not the technology. If badge renewals, door permissions, and visitor sponsorship are reviewed on a different schedule than user access reviews, the organisation is already treating physical entry as a parallel process rather than a governed entitlement. That is a core access governance issue, even when the underlying badge system is owned by facilities.
Other signs include manual spreadsheets for site access, facility exceptions approved by email after the fact, or badge issuance that depends on local managers without a central record of who owns the decision. When the identity team cannot answer who has access, why they have it, and when it expires, physical access has moved outside the normal governance model. That is exactly the kind of lifecycle gap covered in the NHI Lifecycle Management Guide.
Audit friction is another signal. If security can produce logical access evidence but facilities must produce separate badge logs, sponsorship forms, or turnstile reports, then the organisation has no single authoritative access record. The split may be acceptable operationally, but it is a warning that reviews, attestations, and revocation checks are not being joined into one control story. For broader governance patterns, see Identity Security Programme Guide.
Where physical access becomes a risk problem
The risk is not simply that a badge exists, but that badge access can outlive the job, contract, or office need that justified it. That creates an exception path where someone may lose VPN, application, or privileged systems access while still walking into a site, lab, or secure area. In practice, that can preserve access to devices, printouts, network rooms, or reset stations long after the logical account has been removed.
This matters most when physical access enables other controls to be bypassed or undermined. A revoked contractor who still enters the building can reuse shared desks, unattended terminals, or local support workflows to regain reach into systems that should have been closed. The same pattern appears in reviews of badge-based access when teams do not treat entry rights as part of the broader identity and entitlement picture, which is why the Access Reviews and Certification Guide is relevant to both review design and closure discipline.
In hybrid environments, the problem is often cross-team rather than technical. Facilities may see the badge as a building-control matter, while IAM sees it as outside scope. The result is duplicated process without joined accountability. When that happens, the organisation can miss stale access, incomplete offboarding, and unowned exceptions until an audit, incident, or badge reconciliation exercise exposes them.
Risk and Threat Considerations
When physical access sits outside IAM governance, the main risk is that revocation stops at the screen while access to the site remains active. That creates a residual trust path that can support theft, unauthorised presence, or insider activity even after the person has been removed from systems access.
Failure mechanism: badge lifecycle and access reviews are managed in separate workflows, so termination, role change, or contractor exit does not trigger a synchronized physical deprovisioning event. The weakness is usually not a broken badge reader, but missing linkage between HR, IAM, and facilities records.
Impact: stale physical access can extend the blast radius of a departed employee or contractor, complicate investigations, and leave the organisation unable to prove that entry rights were removed on time. In higher-risk sites, that also creates a path to assets that are not protected by logical controls alone.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Badge and physical access tokens need lifecycle control and timely revocation. |
| AC-2 — Account Management | Access provisioning and deprovisioning must cover facility entry as well as logical access. | |
| Recommendation — Tie physical entry credentials to lifecycle events and revoke them on termination. Include physical access entitlements in joiner-mover-leaver processes. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Physical entry governance is part of access control policy and enforcement. |
| Recommendation — Define and enforce access control rules for facility entry. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account and access lifecycles should include non-logical entry paths that persist after offboarding. |
| Recommendation — Remove physical access when accounts or employment end. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Stale physical access after exit is an offboarding failure pattern. |
| Recommendation — Revoke entry credentials as part of offboarding. | ||
Practitioner Guidance
What to verify: confirm whether badge issuance, renewal, suspension, and termination are tied to the same authoritative source and event triggers as other access decisions. If facilities can approve or extend entry without an identity record update, the process is already fragmented.
Decision rule: if a person’s logical access has been removed but their physical access still exists, treat that as a deprovisioning defect, not a minor administrative mismatch. The right question is whether the remaining badge rights still provide a meaningful path to systems, spaces, or evidence, not whether the badge is “just for doors.”
What practitioners underestimate: physical access often becomes invisible because it is owned by a different team and reviewed with different artefacts. The best signal of healthy governance is not perfect tool integration, but a single answer to who can enter, why they can enter, and when that right is removed.
Practitioner takeaway: If physical access cannot be reviewed and revoked with the same discipline as logical access, it is outside IAM governance even if it is operationally convenient.
Related resources from NHI Mgmt Group
- What is the difference between role-based access and API key governance for NHI security?
- What is the difference between human IAM controls and NHI governance?
- What does the 144:1 NHI-to-human ratio mean for IAM governance programmes?
- What do IAM and IGA teams get wrong about physical access governance?