Notifications
Clear all
Topic starter
12/06/2026 12:55 am
TL;DR: Manual onboarding, offboarding, and mid-lifecycle access changes create audit and breach exposure when identity governance is still handled by hand, according to Zluri’s analysis of compliance-driven lifecycle management. For IAM teams, the real issue is not speed but provable access control, evidence trails, and deprovisioning discipline across human and non-human identities.
NHIMG editorial — based on content published by Zluri: Lifecycle Management and Regulatory Compliance
Questions worth separating out
Q: How should organisations automate lifecycle management for compliance?
A: Organisations should tie access provisioning and removal to authoritative lifecycle events such as hire, transfer, and separation.
Q: Why does manual offboarding create compliance risk?
A: Manual offboarding creates risk because access can remain active after the business relationship ends, and auditors need proof that it was removed on time.
Q: What should security teams track to prove lifecycle compliance?
A: Security teams should track who approved access, what changed, when it changed, when it was removed, and whether the identity still has inactive or orphaned access.
Practitioner guidance
- Automate joiner-mover-leaver workflows Bind role changes, transfers, and departures to policy-driven access updates so provisioning and removal happen from authoritative state changes, not ad hoc tickets.
- Enforce offboarding as a completed state Require every connected SaaS and cloud account to be revoked or transferred before HR separation is closed, and verify the result in the identity system of record.
- Separate visibility from evidence Track approval history, entitlement changes, inactive accounts, and deprovisioning events so audit requests can be answered from logs rather than manual reconstruction.
What's in the full article
Zluri's full article covers the operational detail this post intentionally leaves for the source:
- How its lifecycle workflow maps onboarding and offboarding to app access decisions.
- Examples of how playbooks trigger automated provisioning and deprovisioning.
- Details on collecting audit logs and evidence trails for compliance reviews.
- The way the platform shows access by role and identifies inactive users.
👉 Read Zluri's analysis of how lifecycle management supports regulatory compliance →
Lifecycle management and the compliance gap teams keep missing?
Explore further
12/06/2026 10:27 am
Manual lifecycle management is a compliance control failure, not a process inconvenience. When onboarding and offboarding rely on human handling, the organisation cannot consistently prove that access followed policy at every state change. That is why audit outcomes often expose lifecycle weaknesses before security teams do. The practitioner conclusion is to treat lifecycle automation as a control baseline, not an efficiency project.
A few things that frame the scale:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches, according to The 2025 State of NHIs and Secrets in Cybersecurity.
- 62% of all secrets are duplicated and stored in multiple locations, causing unnecessary redundancy and increasing the risk of accidental exposure.
A question worth separating out:
Q: Who is accountable when access is not removed on time?
A: Accountability sits with the organisation that owns the lifecycle process, not the departing user. HR, IT, and identity governance teams need clear ownership for separation events, including who triggers removal, who verifies it, and where evidence is stored. That accountability must be explicit before an audit or incident exposes the gap.
👉 Read our full editorial: Lifecycle management and regulatory compliance: where manual IAM fails
