Notifications
Clear all
Topic starter
23/06/2026 9:14 pm
TL;DR: ITGCs and ITACs both protect integrity, availability and confidentiality, but they operate at different layers of the enterprise control stack, according to Zluri. The practical issue is not choosing one over the other, but matching broad infrastructure controls and application-specific controls to the right governance problem.
NHIMG editorial — based on content published by Zluri: Access Management ITGC vs ITAC, and what is the difference between the two?
Questions worth separating out
Q: What is the difference between ITGC and ITAC in audit and access governance?
A: ITGC governs the broader IT environment, including access management, change management, patching, backup and physical security.
Q: When should organisations prioritise ITGC over ITAC?
A: Organisations should prioritise ITGC when the main risk is infrastructure-wide weakness, such as poor access governance, weak change control or unreliable recovery.
Q: What breaks when application controls do not cover service accounts and integrations?
A: Application controls break when non-human identities can write, move or approve data without the same review path as human users.
Practitioner guidance
- Separate infrastructure and application control evidence Build two evidence packs, one for ITGC and one for ITAC, so auditors can test platform governance and application integrity independently.
- Tie application permissions to business workflow Review who can enter, change, approve and export records inside each critical application, then align those permissions to segregation of duties.
- Include non-human identities in application reviews Check service accounts, tokens and integration identities that write to or move data between applications, because those identities can bypass human review paths.
What's in the full article
Zluri's full article covers the operational detail this post intentionally leaves for the source:
- Line-by-line breakdown of the six ITGC components and three ITAC components
- Examples of input, processing and output controls in business applications
- The access review workflow used to identify and remediate permission mismatches
👉 Read Zluri's comparison of ITGC vs ITAC for audit and access control →
ITGC vs ITAC: what IAM and audit teams need to know?
Explore further
25/06/2026 2:26 am
ITGC and ITAC are complementary control layers, not interchangeable options. The article correctly shows that broad infrastructure controls and application-specific controls answer different governance questions. That distinction matters because access risk can exist in the estate even when the application logic is sound, and vice versa. Practitioners should treat the two as separate lines of assurance rather than a single control decision.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: How should security teams prove that IT controls are working?
A: Security teams should prove control effectiveness with recurring tests that show the control operating, not just documented. That means checking access restrictions, change approvals, backup recovery, input validation and output integrity against real evidence. If the test results do not match the policy, the control exists on paper but not in practice.
👉 Read our full editorial: ITGC vs ITAC: where general and application controls diverge
