Topic starter
25/06/2026 5:18 pm
TL;DR: Nationwide Building Society says identity security is part of its wider business continuity strategy, with a focus on seamless authentication, automated manual controls, and stronger governance for critical applications, according to SailPoint. The practical lesson is that resilience programmes fail when identity controls remain manual, fragmented, or outside the continuity plan.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “Nationwide Building Society Meets Business Continuity Plans with Identity Security”.
Key questions
Q: How should organisations include identity controls in business continuity planning?
A: Treat authentication, access approvals, and governance checks as recovery dependencies, not separate IAM tasks.
Q: Why do manual access processes create risk in critical infrastructure environments?
A: Manual processes create risk because access changes depend on human follow-up, which is slow and inconsistent when roles, contractors, and operational priorities change quickly.
Q: What are the signs that identity governance is too fragmented to stop risky access?
A: Common signs include manual access reviews, slow revocation when users change roles, unclear ownership of entitlements, and heavy reliance on IT teams to spot anomalies by hand.
Practitioner guidance
- Map identity controls into continuity planning Identify where authentication, access approvals, and governance checks sit on the path to restoring critical applications, then include those controls in continuity scenarios and recovery runbooks.
- Automate manual controls for critical applications Replace people-dependent approvals and access checks with policy-driven automation for the applications that would most affect operations if access were delayed.
- Prioritise the applications that carry recovery risk Rank business-critical systems by the operational damage caused by delayed access, then focus governance improvements on the highest-impact applications first.
Bottom line: Identity security is not just an access management issue when it sits inside the business continuity plan for critical applications.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:55 pm
Identity security becomes a continuity control when access is part of the recovery path. If critical applications cannot be accessed cleanly, the business cannot recover cleanly. That makes authentication and governance part of resilience design rather than a separate IAM concern. Practitioners should treat access continuity as a service dependency in the same way they treat hosting, networking, or backup readiness.
A question worth separating out:
Q: How should security teams include identity in business continuity planning?
A: They should treat identity as a recovery dependency, not just an administration task. That means defining which applications are continuity-critical, automating the control steps around them, and documenting how access is approved, reviewed, and revoked during disruption. Continuity plans should answer who can get in, under what authority, and how control is restored after the event.
👉 Read our full editorial: Identity security and business continuity at Nationwide Building Society