TL;DR: Financial institutions face overlapping compliance pressure from DORA, NIS2, GDPR, and related identity governance demands, and Omada Identity’s white paper frames identity governance and administration as the control layer that helps evidence access, reduce privilege creep, and support audit readiness. The practical issue is less about policy intent than proving who has access, why they have it, and when it should be removed.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Omada Identity's blog post: Identity governance supports overlapping regulatory obligations in financial institutions, with governance needing to prove access, entitlement justification, and removal timing.
Why it matters: It matters because IAM, IGA, and PAM teams in regulated environments need evidence that access is controlled, reviewable, and revocable across both human and non-human identities.
Context
Financial institutions are dealing with overlapping compliance demands that span cyber resilience, access governance, and data protection. In this white paper, the primary question is not whether policy exists, but whether identity governance can prove who has access, why the access exists, and when it should be removed.
Identity Governance and Administration is the operational layer that connects approval, provisioning, review, and revocation across the identity lifecycle. For financial institutions, that lifecycle has to support regulatory evidence as well as day-to-day security control, especially where entitlement sprawl and delayed offboarding create audit exposure.
Key questions
Q: What breaks when identity governance is not aligned to NIS2?
A: NIS2 compliance becomes hard to defend when access changes, revocation, and audit evidence remain manual or fragmented. Organisations then struggle to show who had access, whether it was appropriate, and how quickly risky entitlements were removed. That weakens incident reporting, supplier oversight, and the ability to prove resilience under audit.
Q: Why do entitlement sprawl and standing access create compliance risk in financial services?
A: They increase the number of access decisions that must be explained later. When roles, exceptions, and inherited permissions accumulate, teams lose visibility into who has effective access and why, which makes recertification less reliable and offboarding less complete. The risk is both operational and regulatory.
Q: How can IAM teams tell whether access review coverage is actually meaningful?
A: They should measure what was excluded as well as what was approved. A strong completion percentage over a weak denominator hides the systems, roles, and accounts that never entered the campaign, and those blind spots are often where stale access survives longest.
Q: What should financial institutions do when access review findings keep repeating?
A: Treat repeated findings as a design problem, not a reviewer problem. Recurrent exceptions usually mean role models are too broad, approval paths are inconsistent, or offboarding is lagging behind business change. The fix is to reduce the number of entitlements that require judgement in the first place.
Technical breakdown
Why identity governance becomes a compliance control layer
Identity governance is the control plane that turns access policy into auditable entitlement decisions. In regulated financial environments, that means linking joiner-mover-leaver processes, access reviews, role design, and provisioning evidence to concrete compliance requirements. The article’s core message is that governance is not just administration overhead. It is the mechanism that lets institutions show who approved access, what business reason justified it, and whether the access was removed when it was no longer needed.
Practical implication: treat IGA records as compliance evidence, not just operational workflow data.
How DORA and NIS2 change the access governance bar
DORA and NIS2 raise the expectation that controls are demonstrable, repeatable, and resilient under scrutiny. That shifts attention from static policy statements to lifecycle proof, including access certification, privileged access oversight, and timely deprovisioning. In practice, the challenge is not only whether access is granted correctly, but whether the organisation can reconstruct access decisions fast enough to satisfy audit, incident response, and supervisory review.
Practical implication: align entitlement evidence, review cadence, and offboarding records with regulatory reporting and audit timelines.
Where entitlement sprawl creates the biggest governance gap
Entitlement sprawl occurs when access accumulates across systems, roles, and exceptions faster than governance teams can review it. In financial institutions, this becomes a compliance problem because excess access weakens least privilege, complicates certification, and blurs accountability across business units and third parties. The article points to a familiar risk pattern: if access cannot be explained cleanly, it will be difficult to defend during examination or after an incident.
Practical implication: inventory high-risk entitlements first and remove stale access paths before broadening review scope.
Threat narrative
Attacker objective: The end state is not just access misuse, but a governance gap that leaves the institution unable to evidence control over entitlements.
- Entry occurs through routine access expansion, where users, service accounts, or third parties accumulate entitlements faster than governance teams can validate them.
- Privilege escalation follows when standing access, exceptions, or inherited roles create broader reach than the original business need justified.
- Impact appears as audit failure, compliance exposure, and weaker containment because the organisation cannot prove who had access or when it was removed.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity governance is becoming the evidentiary layer for regulated access control. Financial institutions do not just need access policies, they need provable lifecycle records that show approvals, reviews, and removals. DORA and NIS2 make that distinction operationally important because unproven control is often treated as weak control. The practical conclusion is that IGA has moved from support function to compliance-critical infrastructure.
Entitlement sprawl is now a regulatory risk, not just an IAM hygiene issue. When roles, exceptions, and manual grants accumulate across business lines, the organisation loses the ability to explain effective privilege. That weakens least privilege, complicates certification, and creates audit friction when access must be reconstructed under time pressure. Practitioners should treat unmanaged entitlement growth as a governance defect with direct supervisory consequences.
Access review quality matters more than review volume. A large certification campaign does not help if reviewers cannot judge business need, ownership, or expiration. This is where identity governance must connect to asset context, role design, and exception management rather than operate as a checkbox workflow. Financial institutions need reviews that produce defensible outcomes, not just completed tasks.
Lifecycle evidence is the decisive concept here. The compliance question is whether every entitlement can be traced from request to approval to removal with enough fidelity to satisfy regulators. That traceability is what turns identity governance into an audit-ready control rather than a process layer. Practitioners should design governance around evidence retention as much as around access administration.
Financial services compliance is converging on the same governance core. Whether the pressure comes from DORA, NIS2, GDPR, or related obligations, the common requirement is controlled and explainable access. That convergence suggests the market is moving toward lifecycle-based identity programmes rather than regulation-by-regulation point fixes. Teams that build one evidence model across access, privilege, and offboarding will be better placed to absorb new rules without rework.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
- Read next: NHI Lifecycle Management Guide
What this signals
Lifecycle evidence is the control that turns identity governance into audit resilience. Financial institutions will not reduce regulatory pressure by adding more reviews alone. They need evidence chains that connect access grant, business justification, and removal so supervisors can see control, not just policy intent.
The convergence of DORA, NIS2, and GDPR suggests that regulators are effectively asking the same question from different angles: can you prove access is current, justified, and revoked when needed? That makes entitlement governance a cross-framework discipline rather than a regulation-specific project.
For practitioners
- Map regulatory requirements to entitlement evidence Create a single entitlement evidence model that ties request, approval, recertification, and revocation records to DORA, NIS2, and GDPR obligations.
- Prioritise high-risk access reviews Start with privileged accounts, third-party access, and long-lived exceptions because those entitlements are hardest to defend in an audit or incident review.
- Tighten offboarding and exception expiry Track leaver events, role changes, and temporary access approvals so stale entitlements do not survive past their business need.
- Standardise reviewer accountability Assign explicit business owners for each review campaign so certification decisions can be challenged and explained instead of accepted as batch approvals.
Key takeaways
- Identity governance is doing more of the work that used to be treated as back-office administration, because regulators now expect provable access control.
- The hardest part is not policy wording but the ability to explain and evidence who has access, why they have it, and when it should disappear.
- Financial institutions that centralise entitlement evidence, review quality, and offboarding discipline are better positioned to survive overlapping compliance demands.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while NIS2 and DORA define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on proving and reviewing access permissions across regulated financial environments. |
| GV.RM-01 — Risk Management Strategy | The white paper frames identity governance as part of managing regulatory and access risk. | |
| Recommendation — Align entitlement review and removal workflows to PR.AA-05 so access decisions remain explainable and auditable. Embed identity governance evidence into your risk management strategy and review it alongside compliance obligations. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article addresses account lifecycle control, entitlement review, and removal of stale access. |
| Recommendation — Use account management discipline to reduce standing access and remove outdated entitlements before audit. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege is a central control objective behind the governance model discussed here. |
| IA-5 — Authenticator Management | The article’s lifecycle and evidence focus includes credential and access administration across the identity estate. | |
| Recommendation — Apply least privilege review to ensure each entitlement is justified by current business need. Manage credential lifecycle records so access can be revoked and evidenced when business need ends. | ||
| NIS2 | Cybersecurity risk management measures | The white paper explicitly situates identity governance within NIS2 compliance pressure. |
| Recommendation — Map access governance controls to NIS2 security obligations and retain proof of review and revocation. | ||
| DORA | ICT risk management | DORA is a primary compliance driver in the article and depends on demonstrable control evidence. |
| Recommendation — Document identity governance evidence as part of ICT risk management and operational resilience reporting. | ||
Key terms
- Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
- Entitlement Sprawl: The gradual accumulation of too many discrete permissions, often with overlapping access and unclear ownership. It makes access review noisy and offboarding fragile. Grouping entitlements into profiles is one way to reduce that sprawl, provided the groups are designed around real work patterns.
- Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
- Lifecycle Evidence: The operational proof that identity events such as provision, review, rotation, and revocation actually happened. For NHIs and AI-linked credentials, lifecycle evidence matters because a control cannot be trusted if the system cannot show who changed what, when, and why.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 25, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org