Notifications
Clear all
Topic starter
16/09/2026 9:21 am
TL;DR: Documented IAM controls do not satisfy auditors unless organisations can prove the control was effective for a specific system and time, according to Nexis. The article argues that compliance evidence must be captured continuously, validated against defined criteria, and kept current rather than reconstructed at audit time.
NHIMG editorial — based on content published by Nexis: IAM Documented Is Not Proven: The Case for Continuous Compliance Monitoring
Questions worth separating out
Q: What breaks when IAM compliance is based on documentation instead of evidence?
A: Documentation can describe a control, but it cannot prove the control was effective on a specific system at a specific time.
Q: Why do auditors care so much about current compliance evidence?
A: Because an effective control must be defensible at the moment of review, not merely described in a policy.
Q: How do security teams know if continuous compliance is actually working?
A: Look for shorter time-to-detect on control drift, fewer undocumented exceptions, and access review results that lead to measurable revocation.
Practitioner guidance
- Define evidence requirements with the control Attach required proof types, acceptance criteria, and ownership to each governed item so teams know exactly what must be submitted and why.
- Set evidence validity windows Give each proof artefact an expiry period and require fresh submission when the window closes so status never depends on outdated screenshots or exports.
- Validate submissions against fixed criteria Use a consistent review model that checks each artefact against centrally defined criteria, preserves the original item unchanged, and records confidence or reasoning where automation is used.
What's in the full article
Nexis' full analysis covers the operational detail this post intentionally leaves for the source:
- How the evidence collection workflow is structured from request to validation
- How the browser plugin captures proof at the source for application owners
- How NICO applies governance-defined criteria and records confidence and reasoning
- How evidence history, status, and expiry are kept together for audit readiness
👉 Read Nexis' analysis of continuous compliance monitoring for IAM evidence →
IAM compliance evidence: is your control status actually provable?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
16/09/2026 9:21 am
Compliance evidence debt is the real governance gap: documented controls create the appearance of readiness, but stale artefacts and late reconstruction leave organisations unable to prove effectiveness when it matters. That gap is not an audit inconvenience. It is a governance failure because the control state being defended no longer matches the state that existed when the evidence was collected. Practitioners need to treat evidence freshness as part of control design, not as an administrative follow-on.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: Should organisations centralise evidence validation or leave it to application owners?
A: The governance team should define what compliant means, while validation can be applied consistently by a control layer or workflow. Owners provide the proof, but they should not be left to invent the criteria. That separation keeps accountability clear and makes the result traceable under audit.
👉 Read our full editorial: Continuous compliance monitoring turns IAM controls into evidence
