Yes, when the same incident can involve both a credential decision and a physical-security response. In regulated environments, separating them creates evidence gaps and slows accountability. Treat them as one control domain whenever the investigation, response, or audit outcome depends on linking identity events to physical actions.
When physical security and access governance become the same control problem
In regulated organisations, physical security and access governance are often operationally separate but evidentially joined. If one incident can start with an access decision and end with a physical act, then the control owner, investigation trail, and audit evidence need to connect both sides. That is especially true where badge, visitor, workstation, or restricted-area access can change the meaning of an identity event.
The practical test is whether the same control failure can create both cyber and physical exposure. If yes, split ownership may still exist, but the control domain should be treated as one outcome chain for review, logging, escalation, and remediation.
Why the boundary breaks down in real investigations
The boundary collapses when investigators must answer a single question: who was authorised, what access was used, and what physical action followed. A credential change, an access approval, or a revoked entitlement may be incomplete evidence if the site-access log, visitor record, or door event is missing. For that reason, the control design should favour end-to-end traceability rather than departmental convenience.
This is the same logic that drives stronger identity governance. When access reviews, lifecycle events, and privilege decisions are separated from physical entry controls, the organisation can prove one half of the story while losing the other half. The result is weaker accountability, slower containment, and more difficult audit defence.
For practitioners building or reviewing the control model, the most useful question is not whether the systems are technically different. It is whether a reviewer can reconstruct the full sequence without manual stitching across teams. Where they cannot, the organisation has a control design gap, not just a reporting gap.
What “one control domain” should mean in practice
Treating physical security and access governance as one domain does not mean one team must own every badge reader, camera, or access request. It means the control objectives should be unified around identity, authorisation, and evidence. A single person or system should not be able to bypass one layer without that action appearing in the combined record.
That usually means common ownership of policy, aligned approval criteria, and linked audit trails. It also means access recertification should consider physical privileges alongside logical ones when both can affect the same regulated process, area, or asset. IAM and IGA Basics is a useful reference point for this joined-up view because it frames authorisation, access reviews, and governance as a single lifecycle problem.
Where entitlement reviews are involved, the issue is not just who can log in. It is whether access remains appropriate across all enforcement points. A combined model is also easier to operationalise when teams need to remove access quickly after role changes, contract end, or incident response. Joiner-Mover-Leaver (JML) Guide supports that lifecycle approach by tying provisioning and deprovisioning to the removal of old access paths, including those that may affect physical access outcomes.
Risk and Threat Considerations
Separating these domains can leave a dangerous gap between authorisation and actual access. A user may lose system access but retain badge access, or gain an exception in one process that is invisible to the other. In regulated environments, that creates evidential blind spots, slows incident reconstruction, and can let abuse persist longer than expected.
Failure mechanism: control failure emerges when identity records, approval decisions, and physical-entry events are not correlated, so revoked, excessive, or exceptional access remains usable without being obvious in review or during response.
Impact: the organisation may be unable to prove who entered, who approved the access, or whether the physical act aligned with the authorised role. That weakens auditability, complicates forensics, and increases the chance that a security incident is only partially contained.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Unified access governance depends on consistent approval, revocation, and review across physical and logical access. |
| AU-2 — Event Logging | The question hinges on reconstructing incidents from linked identity and physical events. | |
| Recommendation — Centralize account and access lifecycle reviews so physical and logical privileges are removed together. Log identity decisions and physical access events in a way that supports end-to-end correlation. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | The subject is a shared access-control model spanning physical and governance evidence. |
| A.8.15 — Logging | Auditability depends on correlated records from access and physical security systems. | |
| A.5.16 — Identity management | The answer centers on linking identity events to physical actions and accountability. | |
| Recommendation — Define one access-control policy that covers approvals, exceptions, and review across both domains. Retain correlated logs that let auditors trace access decisions to physical events. Tie identity records to physical-entry authority and remove both on role change or termination. | ||
Practitioner Guidance
What to prioritise: define the control objective around the shared outcome, not the tooling. If physical access can affect regulated operations, treat access approval, review, revocation, and evidence retention as one governed workflow even when separate systems execute the steps.
What to verify: confirm that an investigator can link a person, the access decision, the physical event, and the remediation action from one case record. If any of those elements require manual reconciliation across teams, the control is not yet strong enough for a regulated environment.
Practitioner takeaway: if the same person can create both identity risk and physical risk, the control should be designed as one assurance chain, with separate implementation points but unified accountability and evidence.
Related resources from NHI Mgmt Group
- What is the difference between role-based access and API key governance for NHI security?
- Should organisations treat native cloud security tools as enough for privileged access control?
- Why does IAM create security debt when organisations treat access as a one-time setup?
- What breaks when organisations treat privileged access as a one-time project instead of an ongoing control?