They should move from perimeter-centric enforcement to identity-aware policy that can be applied continuously across users, devices, and sessions. The priority is to reduce dependence on manual firewall changes and broad VPN reach, because those mechanisms are slow to audit and hard to adapt during acquisitions, migrations, or third-party onboarding.
Why This Matters for Security Teams
Modern access control is now a financial control as much as a technical one. In regulated environments, the question is not only who can sign in, but which entitlements are approved, how long they remain valid, and whether access can be explained to auditors after the fact. Identity-aware policy helps reduce standing access, improve traceability, and support evidence-based reviews aligned to frameworks such as NIST Cybersecurity Framework 2.0.
That shift matters because perimeter controls and broad network access do not map cleanly to modern banking, payments, treasury, or outsourcing models. Mergers, cloud migrations, and third-party connectivity create short-lived exceptions that often become long-lived risk. Security teams also need to account for privileged users, service accounts, and automation that can bypass user-centric controls if governance is weak. In practice, many security teams encounter access sprawl only after audit findings, failed recertification, or a third-party incident has already exposed the gap.
How It Works in Practice
Modernisation usually starts by separating authentication, authorisation, and session risk decisions. Authentication proves the identity, but access control should also consider device posture, location, transaction sensitivity, and the application being reached. For financial environments, this often means moving toward least privilege, just-in-time elevation, strong approvals for high-risk actions, and continuous re-evaluation of session trust rather than one-time trust at login. The control intent is consistent with NIST SP 800-53 Rev 5 Security and Privacy Controls and identity assurance guidance in NIST SP 800-63 Digital Identity Guidelines.
A practical implementation usually includes:
- Mapping roles and entitlements to business functions, not to network segments alone.
- Using conditional access for sensitive applications, with step-up verification when risk rises.
- Replacing broad VPN reach with application-specific access paths where feasible.
- Reviewing privileged and non-human access separately, because service identities often outlive the human owner.
- Logging access decisions, denied requests, and privilege changes in a way auditors can reconstruct later.
Financial organisations should also examine machine and service credentials, because automation often carries production permissions that no one revisits after deployment. The OWASP Non-Human Identity Top 10 is particularly relevant where APIs, bots, and workload identities touch payment, fraud, or reporting systems. These controls tend to break down when entitlement data is fragmented across legacy IAM, PAM, cloud consoles, and manual spreadsheets because reviewers cannot see the full access path.
Common Variations and Edge Cases
Tighter access control often increases operational overhead, requiring organisations to balance assurance against latency, user friction, and support cost. That tradeoff is most visible in trading, call-centre, and payments operations, where business demand for fast access can conflict with step-up authentication or approval workflows. Best practice is evolving, and there is no universal standard for exactly how much friction is acceptable across every regulated workflow.
Edge cases usually appear in acquired entities, outsourced operations, and shared platforms. A parent company may enforce modern policy for core staff while inherited subsidiaries still depend on local accounts and exceptions. Likewise, third parties may need constrained access for maintenance or reconciliation, but those links should be time-bound, monitored, and removed after use. Where cardholder data is involved, PCI DSS v4.0 pushes teams toward stronger access review discipline, while CIS Controls v8 remains a practical baseline for inventory, account management, and secure configuration.
The biggest exception is where identity signals are incomplete, especially in legacy mainframe, vendor-hosted, or heavily brokered environments. In those cases, modern access policy should be introduced in phases, with compensating controls and clear ownership for exceptions rather than pretending all systems can be treated identically.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack surface, NIST CSF 2.0, NIST SP 800-63 and NIST AI RMF set the technical controls, and PCI DSS v4.0 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA | Identity and access assurance underpin modernisation in regulated finance. |
| NIST SP 800-63 | IAL/AAL/FAL | Identity assurance levels help set trust requirements for access decisions. |
| NIST AI RMF | GOVERN | Risk governance is needed when access policy becomes continuous and adaptive. |
| OWASP Non-Human Identity Top 10 | NHI lifecycle governance | Non-human identities often carry privileged access in financial systems. |
| PCI DSS v4.0 | 7 | Cardholder environments require strict restriction of access by need-to-know. |
Inventory service identities, rotate secrets, and review non-human access separately from human users.
Related resources from NHI Mgmt Group
- How should security teams control privileged access in Salesforce environments?
- How should security teams control vendor access in water utility OT environments?
- How should security teams implement policy-based access control in existing IAM environments?
- How should security teams validate role-based access controls in regulated environments?
