Topic starter
11/07/2026 1:59 pm
TL;DR: Public sector cyberattacks now account for 34% of incidents in Spain, and 2025 activity rose 40% year over year, according to Soffid, as bot-driven scanning industrializes access exploitation and turns identity control into a service continuity issue. Compliance now depends on governance that can verify, recertify, and revoke without disrupting operations.
Editorial analysis by NHI Mgmt Group, based on content published by Soffid: “Digital identity in the public sector: how to simplify regulatory compliance and strengthen cybersecurity”.
Key questions
Q: Where does public-sector IAM fail when access reviews are still manual?
A: It fails when review cycles cannot keep pace with the number of identities, roles, and exceptions in use.
Q: Why does identity sprawl increase risk in government environments?
A: Because more identities mean more permissions, more ownership ambiguity, and more chances for weak access paths to persist unnoticed.
Q: What are the signs that identity governance is not working in practice?
A: Common warning signs are repeated access workarounds, ignored approval workflows, super admins holding too much power, and teams bypassing the process because it is too slow or hard to use.
Practitioner guidance
- Inventory all identity classes across public-sector systems Separate employees, contractors, citizens, and non-human entities so each class has an explicit owner, review cadence, and revocation path.
- Automate recertification for high-risk access Use periodic permission validation for privileged and citizen-facing accounts so stale access is removed without manual bottlenecks.
- Tie audit logging to identity lifecycle events Ensure access grants, permission changes, revocations, and incident responses generate records that can satisfy regulatory evidence requests.
Bottom line: Public-sector attacks now expose a governance problem as much as a security problem, because unmanaged identity access turns compliance failures into service disruption.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:09 pm
Identity governance is now a service-continuity control in the public sector. The article shows that access control failures do not stay in the security domain when public services must remain available to citizens. In government, healthcare, education, and defense, identity sprawl becomes operational risk because every unmanaged account expands the chance of disruption. The practical conclusion is that identity governance is no longer a compliance overlay; it is part of core service resilience.
A question worth separating out:
Q: How should public-sector teams balance access control with service availability?
A: They should separate the decision to correct access from the ability to keep essential services running. The goal is to make revocation, recertification, and monitoring low-friction enough that governance improves uptime rather than interrupting it.
👉 Read our full editorial: Public sector digital identity compliance depends on stronger IAM