Topic starter
11/08/2026 3:12 pm
TL;DR: Traditional IGA metrics still assume access is corrected at checkpoints, but modern identity states change continuously across people, projects, contracts, risk signals, and non-human identities, according to Fischer Identity. That makes delayed certification a control gap, not a governance model, because stale access can remain active long before review begins.
Editorial analysis by NHI Mgmt Group, based on content published by Fischer Identity: “Continuous Identity Governance Is Not the Future. It Is the Standard.”.
Key questions
A: Security teams should combine lifecycle automation with continuous behavioral monitoring so access can be granted, adjusted, and revoked without waiting for manual review.
Q: Why do periodic access reviews leave stale access in place?
A: Because reviews only correct access after a delay, they assume the entitlement can safely remain unchanged until the next checkpoint.
Q: What signs show that an IGA programme is still checkpoint driven?
A: Long certification cycles, heavy reviewer workload, large numbers of cleanup tickets, and frequent discovery of access that should have expired earlier all point to a checkpoint-driven model.
Practitioner guidance
- Define authoritative access conditions Map each entitlement to a current business condition such as role, project, affiliation, sponsorship, contract, or enrollment so the platform can recalculate access when that condition changes.
- Instrument the full governance loop Measure source-to-governance latency, policy evaluation latency, provisioning latency, and reconciliation latency so you can see where access becomes stale in the control chain.
- Extend lifecycle rules to non-human identities Assign owners, purposes, expected duration, and retirement conditions to service accounts, tokens, and other machine identities instead of leaving them outside the same lifecycle policy.
Bottom line: Periodic certification is no longer enough to keep identity state aligned with a modern enterprise that changes continuously.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:26 pm
Continuous governance is now the baseline for IGA, not an advanced feature. Checkpoint-based certification was built for slower identity environments in which access changed infrequently and review cycles could plausibly keep pace. That assumption no longer holds in enterprises where people, contracts, projects, and machine identities move continuously. The governance model itself has to shift from retrospective correction to live policy enforcement, or the organisation is measuring drift after it has already happened.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What should teams do when access is tied to multiple identities or relationships?
A: They should model each relationship separately so that a change in one role does not disrupt access that belongs to another. This matters for employees who are also students, contractors who become staff, or faculty with multiple appointments. Continuous governance works when each business condition is evaluated on its own terms.
👉 Read our full editorial: Continuous identity governance is the new IGA standard