Notifications
Clear all
Topic starter
09/07/2026 1:39 pm
TL;DR: A practical identity governance program starts with high-risk systems, clear ownership, access reviews, lifecycle controls, remediation tracking, and audit evidence, according to SecurEnds. The article argues that IGA fails when access decisions stay fragmented across email, tickets, and spreadsheets instead of being governed as a repeatable control model.
NHIMG editorial — based on content published by SecurEnds: identity governance programme implementation guidance
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should teams start an identity governance programme without overwhelming reviewers?
A: Start with the highest-risk applications and the smallest review scope that still proves the control works.
Q: Why do identity governance programmes fail when access ownership is unclear?
A: They fail because reviewers cannot make defensible decisions when nobody is accountable for approving, remediating, or validating access.
Q: What breaks when deprovisioning is not tied to joiner, mover, and leaver workflows?
A: Access accumulates. Users keep old roles after transfers, contractors retain accounts after departure, and service accounts continue to exist after the system or owner changes. That creates privilege creep, orphaned access, and weak audit evidence because nobody can prove the control kept pace with the lifecycle event.
Practitioner guidance
- Start with high-risk systems first Limit the first governance wave to finance, payroll, customer data, privileged administration, and other systems where access exposure has the highest consequence.
- Map ownership for every access area Assign named owners for application access, business-role access, sensitive data access, privileged access, and evidence handling.
- Build lifecycle-triggered deprovisioning Tie joiner, mover, and leaver events to provisioning and revocation tasks so old permissions are reviewed before new access is added, and so departures cannot leave stale access behind.
What's in the full article
SecurEnds' full post covers the operational detail this post intentionally leaves for the source:
- Step-by-step guidance for selecting the first applications to bring into scope.
- Workflow examples for access reviews, remediation tracking, and evidence capture.
- Practical ownership models for application owners, business managers, and IAM teams.
- Common implementation mistakes to avoid when scaling from pilot to programme.
👉 Read SecurEnds' guide to building an identity governance programme from scratch →
Identity governance programs: where should teams start first?
Explore further
09/07/2026 1:43 pm
Identity governance fails first when ownership is unclear. The article correctly centres ownership because access controls do not survive ambiguity about who approves, who reviews, and who remediates. That is the same failure mode we see across NHI and human IAM programmes: when accountability is split, the control exists on paper but not in execution. Practitioners should treat ownership mapping as the first enforceable governance control, not administrative housekeeping.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
A question worth separating out:
Q: Who is accountable when a rejected access entitlement is not removed?
A: The organisation is accountable, but the control owner should be clearly assigned before the review starts. Governance only works when the reviewer, the remediation owner, and the evidence owner are distinct and when the workflow records completion, exception status, and removal verification.
👉 Read our full editorial: Identity governance programs need lifecycle control before audit pressure
