PACS is the door-control layer that decides whether a badge opens a door. PIAM is the governance layer that decides whether the person should still hold that badge at all, based on lifecycle events and access policy. Identity teams need PIAM if they want physical access to follow JML rules.
PIAM vs PACS: Governance Layer Versus Door-Control Layer
PIAM and PACS sit at different layers of the same physical access problem. PACS controls the door, reader, badge and site entry logic. PIAM governs whether that badge should still exist, who approved it, and whether it remains consistent with joiner, mover, leaver events, role changes and access policy.
The practical difference is scope. PACS answers “does this credential open this door right now?” PIAM answers “should this person, visitor or contractor still have that credential at all?” In a mature identity programme, PIAM is where physical access becomes part of identity governance rather than a standalone facilities concern.
That separation matters because a door system can enforce a local rule without fixing a bad entitlement decision. If a terminated employee still has an active badge, PACS can only keep operating as designed; PIAM is the control that should have removed the entitlement when the lifecycle event occurred. For teams aligning identity and access governance with physical access, PIAM is the layer that keeps access policy and human lifecycle in sync.
What PIAM Governs That PACS Usually Does Not
PIAM is concerned with entitlement governance, approvals, recertification, and revocation workflows. It tracks whether access is still justified, whether the right manager or sponsor approved it, and whether periodic review should remove it. PACS typically consumes the decision and enforces it at the reader or panel.
That means PIAM is normally where you handle policy questions such as badge eligibility, role-based access, contractor expiry, segregation of duties, and event-driven deprovisioning. PACS is where you handle operational questions such as credential presentation, door unlock, zone permissions, and offline panel behaviour.
When organisations compare the two, the most useful test is whether the control is deciding entitlement or enforcing entry. PIAM decides entitlement. PACS enforces entry. A badge lifecycle process that never reaches PIAM review is usually a governance gap, not a hardware gap. The same logic applies to joiner, mover and leaver events, which should drive badge issuance, change and removal.
Why the Difference Matters for Identity Governance
In identity governance, physical access should not be treated as a separate exception process. If PIAM is missing or weak, organisations often end up with badge sprawl, stale access, manual overrides and poor visibility into who can enter sensitive areas. That creates the same kind of entitlement drift seen in digital IAM, just in the physical domain.
The governance value of PIAM is that it lets security and facilities teams work from the same source of truth for access decisions. It also makes reviews auditable: who approved access, why the access existed, when it was last certified, and what event should remove it. Without that layer, PACS may still work technically, but access decisions become harder to justify and harder to remediate.
For teams building a broader governance model, this is where access reviews and certification become important. The review should ask whether the badge is still needed, not only whether the door works. That distinction is what turns badge administration into identity governance.
Risk and Threat Considerations
The main risk is assuming that physical access control is “covered” because doors still lock and unlock. A functioning PACS can still leave the organisation exposed if stale badges, borrowed badges, or overbroad site permissions are never governed upstream. The failure is often administrative first, then security-relevant.
Failure mechanism: Badges and physical privileges remain active after role changes, leave events, contractor expiry, or sponsor withdrawal, so the door system continues to enforce an outdated entitlement.
Impact: Unauthorized site entry, stronger insider threat conditions, and weak auditability for who should have had access to restricted areas.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Covers lifecycle control of badges and access credentials tied to physical access. |
| AC-2 — Account Management | PIAM governs provisioning, changes and removal of access entitlements across lifecycle events. | |
| AC-6 — Least Privilege | PIAM should constrain physical access to only the sites and areas required for the role. | |
| Recommendation — Enforce expiry, revocation and replacement rules for physical access credentials. Centralize access issuance, modification and removal through governed lifecycle workflows. Limit badge entitlements to the minimum physical areas needed for the role. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Physical access governance is an access-control decision about who may enter controlled areas. |
| A.5.18 — Access rights | PIAM manages the approval, review and removal of access rights over time. | |
| Recommendation — Define and enforce physical access rules through a formal access-control policy. Review and revoke physical access rights when roles or employment status change. | ||
| CIS Controls v8 | CIS-5 — Account Management | Badge lifecycle management maps to controlled provisioning, review and removal of access. |
| Recommendation — Automate issuance, review and removal of physical access entitlements. | ||
Practitioner Guidance
What to verify: Confirm that physical access is tied to the same joiner, mover, leaver or recertification workflow used for other governed access. If badge issue and badge removal are handled only by facilities tickets, PIAM is probably not the system of record for entitlement decisions.
What good looks like: PACS enforces the door in real time, while PIAM owns the approval, review, expiry and revocation logic. If those controls disagree, the governance layer should win and the badge should be removed or revalidated.
Practitioner takeaway: Treat PACS as enforcement and PIAM as entitlement governance. If you only control the door, you may still be distributing access that no longer has a valid business or identity basis.
Related resources from NHI Mgmt Group
- What is the difference between attack surface management and NHI governance?
- What is the difference between role-based access and API key governance for NHI security?
- What is the difference between human IAM controls and NHI governance?
- What is the difference between patching a vulnerability and reducing identity blast radius?