ISO 27001 maintenance exposes the access governance gap for NHIs

At a glance

What this is: This article explains how ISO 27001 maintenance works and why the certification cycle can mask gaps in NHI access governance.

Why it matters: It matters because IAM and IGA teams may meet audit cadence while still lacking lifecycle control over service accounts, secrets, and other non-human identities.

By the numbers:

• Organizations must undergo ISO 27001 certification renewal every three years.
• ISO 27001 audit costs total roughly $15,000 annually.

Context

ISO 27001 maintenance is the work that keeps an information security management system in certified condition after the initial audit. In practice, that means recurring control reviews, internal audits, annual external audits, evidence collection, and training across a three-year certification cycle.

The governance gap is that this cadence is built around organisational compliance artefacts, not the full lifecycle of non-human identities. Service accounts, API keys, tokens, certificates, and workload access can drift outside the review rhythm if teams do not govern them as first-class identity assets.

Key questions

Q: What breaks when ISO 27001 maintenance does not cover non-human identities?

A: The certification model can still pass while service accounts, secrets, and certificates remain unmanaged. That creates a gap between documented compliance and actual access control, because machine identities may outlive their owners, retain standing privilege, or escape review entirely. In practice, the ISMS looks complete while the highest-risk access paths remain least governed.

Q: Why do recurring ISO 27001 audits not fully solve NHI governance?

A: Recurring audits measure whether controls are operating, but they do not automatically prove that non-human identities are inventoried, owned, or revoked on time. NHI risk is lifecycle-driven, so the important question is whether the identity still needs access, not whether the last audit found evidence. Audit cadence and access reality often move on different clocks.

Q: How do security teams know if NHI controls are actually working?

A: Look for complete inventory coverage, clear ownership, enforced rotation, and evidence that unused credentials are removed on time. If secrets remain active after changes to applications, vendors, or pipelines, the control is not working. Monitoring should also show whether machine access stays within the expected workload scope.

Q: Which ISO 27001 controls matter most for service account lifecycle management?

A: The most relevant controls are the ones that tie access permissions, evidence collection, and ongoing review together. For machine identities, that means governance over issuance, scope, monitoring, and retirement, with clear accountability for each identity. If those duties are split across teams, the lifecycle usually fails at the handoff points.

Technical breakdown

Three-year certification cycles and surveillance audits

ISO 27001 certification is not a one-time event. Organisations must keep the information security management system active through ongoing internal audits, annual external audits, management review, training, and corrective action until recertification at the three-year mark. The standard is process-based, so auditors look for evidence that controls are monitored, updated, and improved as the environment changes. That is why the maintenance burden is continuous rather than episodic. For identity teams, the challenge is that audit evidence often reflects organisational discipline without proving that machine-facing credentials are actually governed end to end.

Practical implication: Treat ISO 27001 maintenance as a continuous control-evidence problem, not a certificate renewal event.

Why NHI access is the blind spot in certification evidence

Non-human identities do not fit neatly into the human-oriented habits many certification programmes inherit, such as role review meetings, training attestations, and periodic manager sign-off. Service accounts and secrets can persist beyond the people or systems that created them, while certificates and tokens may outlive the business need that justified them. If those identities are not inventoried, reviewed, and offboarded with the same rigor as other controls, the ISMS can appear healthy on paper while standing access quietly accumulates. That is an access governance gap, not a documentation gap.

Practical implication: Map NHI inventory, ownership, and revocation evidence into the same audit trail used for other ISO controls.

Access logs are necessary but not sufficient for NHI governance

The article emphasises logs, audits, and real-time termination of problematic log-ins. Those are useful controls, but NHI governance depends on more than detection after the fact. A log proves activity occurred; it does not prove the identity should still exist, still be authorised, or still be scoped correctly. For NHI, the deeper control question is whether access was issued with lifecycle boundaries, short enough validity, and accountable ownership. Without that, organisations end up proving usage instead of proving control.

Practical implication: Pair logging with lifecycle controls that define when NHI access begins, ends, and must be revoked.

Threat narrative

Attacker objective: Use stale or over-scoped non-human access to move beyond the control assumptions that ISO 27001 maintenance is meant to preserve.

1. Entry occurs through the long tail of maintenance failure, where outdated controls or stale access remain in place between certification checkpoints.
2. Credential access becomes possible when non-human identities retain secrets, tokens, or certificates beyond the business need that created them.
3. Escalation follows when those identities keep standing privileges or broad access scopes that are never revisited with the same rigor as human accounts.
4. Impact is audit exposure, weakened security posture, and a larger breach surface if dormant NHI access is abused.

NHI Mgmt Group analysis

ISO 27001 maintenance exposes an access governance gap, not just an audit burden: The article is strongest when it shows that certification is a living process of evidence, review, and remediation. That process can still leave NHI access outside the governance model if machine identities are not treated as auditable assets in their own right. The practitioner implication is that certification discipline must extend to service accounts, tokens, and certificates, or the ISMS will certify the wrong level of control.

Recurring audits do not equal lifecycle governance for non-human identities: Internal and external audit cadence is designed for organisational assurance, but NHI behaviour is often faster and more fragmented than the review cycle. Secrets can be created, delegated, reused, and forgotten between audits, which means the control assumption is already outdated by the time evidence is collected. Teams should recognise that a compliant control environment can still hide unmanaged machine identity sprawl.

Evidence collection is only valuable when it proves ownership and revocation: The article highlights logs, audits, and monitoring as core maintenance tasks, but those artefacts do not by themselves establish who owns a service account or when it should be removed. That is the named concept here: auditable but ungoverned NHI access. The issue is not lack of documentation, it is lack of lifecycle closure. Practitioners should interpret every audit request as a test of ownership, expiry, and offboarding for non-human access.

Automation changes the economics of ISO 27001 maintenance, but not the governance obligation: The article argues that a single source of truth and automated controls can reduce manual effort. That is directionally right, but automation only helps if it is tied to explicit identity lifecycle rules for non-human access. Otherwise, automation speeds up the collection of evidence around a control model that still leaves standing machine privileges in place. The lesson is to automate governance, not merely reporting.

ISO 27001 maturity can coexist with NHI drift unless identity scope is explicit: The article treats certification as a sign of security culture and operational discipline, which is fair. But culture alone does not prevent service accounts from accumulating privileges or surviving ownership changes. The more mature programme is the one that can show which non-human identities exist, why they still exist, and how they are revoked when the need ends. That is where ISO 27001 maintenance becomes a real identity governance test.

What this signals

Auditable but ungoverned NHI access: ISO 27001 programmes often prove that controls exist, but not that every service account or secret has a clear owner and expiry. That distinction matters because access can remain active long after the business need has changed.

Maintaining certification should force identity teams to close the loop between issuance, review, and retirement. If the lifecycle is not explicit for machine identities, evidence collection becomes a retrospective exercise instead of a governance control.

For practitioners

• Inventory non-human identities as auditable assets Build a complete register of service accounts, API keys, tokens, certificates, and workload identities, then assign ownership and business purpose to each record.
• Tie certification evidence to NHI lifecycle events Require proof of creation, review, rotation, and revocation for machine identities so audit packs show lifecycle control, not just access logs.
• Align access reviews with NHI ownership Make every review confirm who owns the identity, what system depends on it, and whether the access scope still matches the current business need.
• Reduce standing privilege before the next audit cycle Set expiry or rotation boundaries on machine credentials and remove dormant access paths that have no current operational justification.
• Document offboarding for machine identities Define how service accounts, secrets, and certificates are retired when applications change, vendors leave, or workloads are decommissioned.

Key takeaways

• ISO 27001 maintenance can look disciplined while leaving non-human identities outside the core governance model.
• The key weakness is not audit frequency alone, but whether service accounts, tokens, and certificates have explicit lifecycle ownership.
• Teams that want certification-grade assurance need proof of issuance, review, rotation, and revocation for machine access.

Key terms

• Non-Human Identity Lifecycle: The Non-Human Identity Lifecycle is the full sequence of creation, use, control, review, and retirement for identities that are not tied to a person. It covers service accounts, API keys, certificates, tokens, bots, and AI agents, including issuance, rotation, monitoring, revocation, and secure decommissioning across systems and environments.
• Certification Evidence: Certification evidence is the documentation used to prove that required controls are actually operating. For cybersecurity regulations, that usually includes access reviews, exception approvals, inventory records, incident logs, and configuration proof retained long enough to support executive sign-off.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Auditable Access Control: Auditable access control is access governance that leaves a complete evidence trail showing who or what was allowed to act, under which policy, and for what reason. In regulated environments, logs alone are not enough unless they connect identity, approval, and action into one defensible record.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.