Identity security and business continuity at Nationwide Building Society

At a glance

What this is: This is a SailPoint blog about Nationwide Building Society using identity security to support business continuity through seamless authentication, automation, and governance for critical applications.

Why it matters: It matters because IAM teams should treat identity controls as continuity controls, especially where manual approvals and fragmented governance can slow recovery or weaken risk posture.

Context

Business continuity planning often focuses on infrastructure, recovery, and availability, but identity controls are part of the same operational chain. When authentication, approvals, and access governance remain manual, they become a point of failure during disruption rather than a control that supports resilience.

In Nationwide Building Society's case, the article frames identity security as a strategic capability tied to the organisation's wider security posture. The point for IAM teams is that critical applications cannot be treated as isolated access problems when continuity depends on predictable, governed, and automated access decisions.

Key questions

Q: How should organisations include identity controls in business continuity planning?

A: Treat authentication, access approvals, and governance checks as recovery dependencies, not separate IAM tasks. Map them into continuity scenarios, test whether critical applications can still be accessed during disruption, and confirm that recovery runbooks account for the identity steps needed to restore trusted access.

Q: Why do manual access processes create risk in critical infrastructure environments?

A: Manual processes create risk because access changes depend on human follow-up, which is slow and inconsistent when roles, contractors, and operational priorities change quickly. In critical infrastructure, that delay can leave leavers, contractors, or excess privileges active after the business need has ended. The result is avoidable exposure and weaker compliance evidence.

Q: What are the signs that identity governance is too fragmented to stop risky access?

A: Common signs include manual access reviews, slow revocation when users change roles, unclear ownership of entitlements, and heavy reliance on IT teams to spot anomalies by hand. Another warning sign is that legitimate users are repeatedly blocked by controls that do not fit their workflow. Fragmented governance usually shows up as both friction and blind spots.

Q: How should security teams include identity in business continuity planning?

A: They should treat identity as a recovery dependency, not just an administration task. That means defining which applications are continuity-critical, automating the control steps around them, and documenting how access is approved, reviewed, and revoked during disruption. Continuity plans should answer who can get in, under what authority, and how control is restored after the event.

Technical breakdown

Seamless authentication as a continuity dependency

Seamless authentication means users can prove identity and gain access without introducing avoidable delays or brittle handoffs during normal operations and recovery events. In a continuity context, the issue is not convenience alone. Authentication flows must keep working when systems are under stress, because access failure can slow recovery as effectively as an outage. For an organisation like Nationwide, the continuity question is whether identity can still function when other operational controls are degraded.

Practical implication: test authentication paths as part of resilience exercises, not only as a login experience issue.

Automating manual controls for critical applications

Manual access controls create latency, inconsistency, and dependency on specific people being available at the right time. Automating those controls does not remove governance. It shifts enforcement into the operational path so that approval, provisioning, and policy checks happen reliably for the applications that matter most. That is especially important for continuity because critical systems often need access decisions to remain predictable during disruptions, when human coordination is weakest.

Practical implication: identify which approvals and access checks for critical applications still depend on manual intervention.

Identity governance as risk posture, not just administration

Identity governance is the control layer that makes access decisions explainable, auditable, and repeatable. In this article, the important shift is from treating governance as back-office administration to treating it as part of risk management for continuity. When organisations can demonstrate control over who can access critical applications, they reduce both operational friction and audit exposure. That is why identity programmes increasingly sit inside broader resilience conversations rather than beside them.

Practical implication: align identity governance evidence with continuity and risk reporting for critical systems.

NHI Mgmt Group analysis

Identity security becomes a continuity control when access is part of the recovery path. If critical applications cannot be accessed cleanly, the business cannot recover cleanly. That makes authentication and governance part of resilience design rather than a separate IAM concern. Practitioners should treat access continuity as a service dependency in the same way they treat hosting, networking, or backup readiness.

Manual control points are continuity debt. Every approval step that relies on human availability adds delay and variance to a recovery process. In steady state that may be tolerable, but under pressure it turns into an operational bottleneck. The governance lesson is straightforward: continuity programmes should inventory where identity still depends on people rather than policy.

Critical application governance is where identity strategy proves its value. The article centres on the highest-risk applications because that is where continuity and control intersect most sharply. If the identity programme cannot show stronger control over those systems, it is not yet embedded in business resilience. Practitioners should prioritise the applications whose outage or access failure would most directly interrupt operations.

Continuity through governed access: The article points to a practical model where authentication, automation, and compliance evidence reinforce one another. That combination matters because resilience is not only about restoring systems, but about restoring trusted access at the same pace. For identity leaders, the implication is to connect governance controls to operational continuity objectives, not to report them separately.

Resilience programmes fail when identity is treated as an afterthought. Business continuity planning that excludes access control assumes the organisation can function without timely identity decisions, which is rarely true for critical applications. The practitioner conclusion is to place identity controls inside continuity scenarios, recovery tests, and risk reporting from the outset.

What this signals

Business continuity and identity governance should be planned together, because recovery depends on access as much as on infrastructure. When organisations leave approvals and authentication flows manual, they create recovery bottlenecks that only show up when operations are already under stress.

Continuity through governed access: the useful shift is to treat identity controls as part of resilience engineering, not as an administrative overlay. That means testing whether critical applications can still be reached, approved, and governed when normal operating assumptions no longer hold.

For practitioners

• Map identity controls into continuity planning Identify where authentication, access approvals, and governance checks sit on the path to restoring critical applications, then include those controls in continuity scenarios and recovery runbooks.
• Automate manual controls for critical applications Replace people-dependent approvals and access checks with policy-driven automation for the applications that would most affect operations if access were delayed.
• Prioritise the applications that carry recovery risk Rank business-critical systems by the operational damage caused by delayed access, then focus governance improvements on the highest-impact applications first.
• Evidence control in resilience reporting Capture access governance evidence alongside continuity metrics so the organisation can show that identity controls support, rather than slow, recovery.

Key takeaways

• Identity security is not just an access management issue when it sits inside the business continuity plan for critical applications.
• Manual approval steps and fragmented governance can slow recovery even when core technology is available.
• The practical response is to automate critical access controls and tie identity evidence to resilience reporting.

Key terms

• Business Continuity: Business continuity is the capability to keep essential services operating through disruption and recover them afterward. In identity programmes, continuity depends on access control, authentication, and recovery governance remaining dependable when normal workflows are stressed or unavailable.
• Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
• Critical Application: A critical application is a system whose failure would materially affect business operations, regulatory obligations, or service delivery. For identity teams, these applications deserve the strongest access governance because an access error can quickly become an operational incident.
• Automated Access Management: Automated access management uses software rules and workflows to handle access requests, approvals, monitoring, and revocation with less manual intervention. It reduces delays and inconsistency by applying predefined policy logic, improving visibility and making it easier to enforce controls across large and changing environments.

Deepen your knowledge

NHI governance, identity lifecycle management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or IAM programme maturity, it is worth exploring.