Notifications
Clear all
Topic starter
09/07/2026 1:40 pm
TL;DR: IAM tools can authenticate users and grant access, but audits often require proof of approval, review, remediation, and removal, according to SecurEnds. The compliance gap is not broken access control, but missing governance evidence that turns valid access into unproven access.
NHIMG editorial — based on content published by SecurEnds: IAM compliance gaps and how IGA closes them
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should security teams close IAM compliance gaps without replacing IAM?
A: Security teams should keep IAM for authentication and access enforcement, then add IGA for approvals, access reviews, remediation tracking, and audit reporting.
Q: Why do access reviews fail to satisfy audits even when they are completed?
A: Access reviews fail when they do not produce a closed evidence chain.
Q: What do security teams get wrong about IAM and IGA?
A: Teams often assume IAM lifecycle tasks are enough to satisfy governance and compliance requirements.
Practitioner guidance
- Map every critical entitlement to a named owner Assign approval and review ownership for financial, customer, privileged, and regulated application access so auditors can see who is accountable for each entitlement.
- Bind access reviews to remediation completion Require every rejected or modified entitlement to produce a tracked removal, exception, or reapproval record before the certification can close.
- Trigger access revalidation on joiner, mover, and leaver events Connect HR and identity workflows so role changes, transfers, and departures automatically reopen access decisions for review.
What's in the full article
SecurEnds' full article covers the operational detail this post intentionally leaves for the source:
- A practical breakdown of the specific audit evidence reviewers expect for approvals, certifications, and removals.
- Examples of how the IGA layer supports remediation tracking across review workflows and access exceptions.
- A more detailed comparison of IAM and IGA responsibilities in SOX, HIPAA, SOC 2, and FFIEC contexts.
👉 Read SecurEnds' analysis of IAM compliance gaps and IGA →
IAM compliance gaps and IGA: what audit teams need to close?
Explore further
09/07/2026 1:44 pm
IAM controls access, but IGA proves accountability. The article’s central point is structurally correct: authentication and provisioning are not the same as governance evidence. Access can exist in a system and still be indefensible in an audit if approval history, review decisions, and remediation status are missing. The implication is that security leaders should stop treating entitlement data as proof of control.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: Who should own evidence for access approvals and removals?
A: Business owners should approve access, application owners should review it, and identity teams should preserve the evidence and enforce completion. If ownership is unclear, reviews drift into shared responsibility with no one accountable for the final decision. Clear ownership is what makes access governance auditable.
👉 Read our full editorial: IAM compliance gaps show why governance must go beyond access
