Topic starter
11/06/2026 11:03 pm
TL;DR: Compliance failures are not just policy problems; they become breach, audit, and remediation problems when data quality, change control, audit logging, and access control are weak, according to Cerbos. The governing lesson is that compliance has to be built into identity and authorization design from the start, because late controls cannot fix broken assumptions.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “Staying compliant - What you need to know”.
By the numbers:
- British Airways faced a fine of £183 million after a 2018 data breach for failing to safeguard customer data.
- Capital One was ordered to pay an $80 million penalty after a breach exposed 106 million customer records.
Key questions
Q: What breaks when identity data is stale in a compliance programme?
A: When identity data is stale, access control, reporting, and audit evidence all start reflecting an outdated reality.
Q: Why do compliance failures become so expensive after an incident?
A: Because the cost is not limited to penalties.
Q: Where does change management fail in identity governance practice?
A: It fails when access policy edits, logging changes, and exception handling are treated as routine configuration rather than control changes.
Practitioner guidance
- Define identity data quality controls Establish ownership for accuracy, completeness, timeliness, uniqueness, and consistency of identity records that drive access decisions and audit reports.
- Put authorization changes under formal change control Require review, testing, and rollback planning for access policy updates, logging changes, and exceptions before they reach production.
- Validate revocation against authoritative status data Reconcile HR or source-system status against active accounts so leavers, contractors, and dormant identities do not retain access past policy.
Bottom line: Compliance failures often start as identity governance failures, because weak records and weak control change processes undermine the evidence regulators expect.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
12/06/2026 7:33 am
Compliance is an identity governance problem before it is a legal one. The article is right to treat access control, auditability, data quality, and change management as one compliance system, because each control depends on the others to produce trustworthy evidence. When identity records are stale or inconsistent, authorisation cannot be defended and audit output loses credibility. The practitioner conclusion is simple: compliance has to be designed into the identity fabric, not appended after deployment.
A question worth separating out:
Q: How should teams prove that audit logs support compliance?
A: They should be able to show that logs are complete, retained, protected from tampering, and actually reviewed. If investigators cannot reconstruct access, changes, and decisions from the logs, the organisation does not have compliance evidence, only stored data.
👉 Read our full editorial: Compliance needs identity governance, not later-stage clean-up
This post was modified 5 days ago by NHI Mgmt Group