Notifications
Clear all
Topic starter
11/07/2026 1:53 pm
TL;DR: Financial regulators are moving from asking whether institutions are protected to asking whether they can keep operating through disruption, with evidence now centred on scenario testing, service dependencies, incident reporting speed, and recovery performance, according to Illumio. The governance burden has shifted from proving control coverage to proving operating resilience under stress.
NHIMG editorial — based on content published by Illumio: From “Are You Protected?” to “Can You Operate?” Why Regulators Want Resilience, Not Just Controls
Questions worth separating out
Q: How should security teams build resilience into identity and access governance?
A: Security teams should treat identity governance as part of service continuity, not only access control.
Q: Why do non-human identities matter in operational resilience programmes?
A: Non-human identities often sit inside the workflows that keep services running, so their failure can become an operating failure.
Q: What breaks when incident reporting is treated as a paperwork exercise?
A: Reporting breaks when teams wait until an incident is underway to decide who owns facts, approvals, and external communications.
Practitioner guidance
- Map critical services to identity dependencies Identify which business services depend on privileged users, service accounts, API keys, certificates, and third-party access paths.
- Test incident reporting as an operating process Run exercises that force legal, security, risk, and executive teams to produce a consistent incident narrative from incomplete information.
- Review non-human identity ownership and failover Assign explicit business ownership for service accounts and AI-driven workflows, then test what happens when those identities need to be suspended, rotated, or reassigned during an incident.
What's in the full article
Illumio's full article covers the operational detail this post intentionally leaves for the source:
- The article expands on how supervisors assess scenario testing, service mappings, and evidence of recovery performance in financial services.
- It includes Phil Park's commentary on escalation speed, leadership alignment, and cross-functional incident coordination.
- It discusses how AI adoption increases governance pressure when agents and automated systems are embedded in critical operations.
- It outlines the reporting burden across U.S. and European supervisory environments.
👉 Read Illumio's analysis of resilience-driven cyber regulation in financial services →
Cyber resilience in finance: what regulators now expect from teams?
Explore further
11/07/2026 2:04 pm
Operational resilience is becoming an identity governance test, not only a cyber control test. When regulators ask whether a business can operate through disruption, they are implicitly asking whether access, escalation, and service dependencies are governable under stress. That matters for IAM and PAM because the weakest response path is often the one that depends on a privileged account, a service credential, or a delayed approval chain. Practitioners should treat continuity of identity workflows as part of resilience design.
A question worth separating out:
Q: Who is accountable when identity failures disrupt critical services?
A: Accountability should sit with the business owners of the service, the security teams that govern access, and the executives responsible for operational resilience. If the issue involves service accounts, machine credentials, or delegated access, the responsible owner must be able to explain lifecycle control, escalation paths, and recovery decisions. Regulators care about whether accountability is clear before disruption, not after.
👉 Read our full editorial: Resilience is replacing control checklists in financial cyber risk
