Topic starter
12/06/2026 12:40 am
TL;DR: Omdia says legacy IAM and MDM were built for a controlled device and app estate, but SaaS, BYOD, shadow IT, and AI have left unmanaged access outside the reach of traditional compliance and cyber insurance checks, according to 1Password’s summary of the report. The compliance problem is now an identity governance problem, because auditability collapses when access is not bound to managed devices, applications, or vendors.
Editorial analysis by NHI Mgmt Group, based on content published by 1Password: “Why Omdia recommends Extended Access Management to simplify compliance”.
Key questions
Q: What breaks when non-human access is left outside IAM controls?
A: Healthcare teams lose visibility into who or what changed data, touched records, or moved through administrative workflows.
Q: Why do auditors and cyber insurers ask similar identity questions?
A: Both are testing whether access is controlled well enough to limit loss, prove accountability, and reduce exposure.
Q: What are the signs that compliance controls are missing unmanaged access?
A: Common signals include incomplete access logs, unclear ownership of third-party accounts, unmanaged devices reaching sensitive apps, and audit questions that cannot be answered without manual exception handling.
Practitioner guidance
- Audit unmanaged access paths Inventory SaaS, BYOD, shadow IT, and contractor workflows that can reach company data without passing through a managed device or sanctioned application.
- Test your audit evidence chain Verify that your logs can join identity, device posture, authentication method, and application context for the same access event across IdP and endpoint sources.
- Reconcile insurer and auditor questions Use the questions in cyber insurance assessments to identify gaps in MFA enforcement, RBAC coverage, and third-party access governance.
Bottom line: Extended access management reveals that compliance failures often begin as visibility failures in identity governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 10:04 am
Compliance gaps in extended access management are really governance gaps in the access estate. The problem is not that enterprises lack IAM policies, but that those policies were designed for a controlled environment where IT could see and manage every endpoint, app, and vendor connection. Once access extends into SaaS, BYOD, and shadow IT, the compliance model stops being comprehensive. Practitioners should read this as a signal that auditability now depends on coverage across the full access estate, not just the managed core.
A question worth separating out:
Q: Should organisations treat shadow IT access as an identity risk or a compliance risk?
A: Both, but the governance response should start with identity. Shadow IT becomes a compliance problem when it creates access paths that the organisation cannot authenticate, authorize, or evidence consistently across audits, insurers, and internal reviews.
👉 Read our full editorial: Compliance gaps in extended access management now expose IAM blind spots
This post was modified 1 day ago by NHI Mgmt Group