Notifications
Clear all
Topic starter
12/06/2026 1:14 am
TL;DR: Risk management frameworks are presented as structured ways to identify, assess, mitigate, monitor, and govern security risk across IT systems, with Zluri arguing they also support access control and compliance. The deeper issue is that RMF only works when identity governance is already disciplined, visible, and continuously reviewed.
NHIMG editorial — based on content published by Zluri: Best Practices Risk Management Framework: Key Components & Best Practices
Questions worth separating out
Q: What breaks when risk management frameworks do not include identity governance?
A: The framework becomes a documentation exercise rather than a control system.
Q: Why do service accounts and other NHIs complicate risk governance?
A: Because they often outnumber human identities, change faster, and are less visible to business owners.
Q: How do you know if access review is actually working?
A: It is working only when the review produces a verified change in access state.
Practitioner guidance
- Build an identity-first RMF inventory Classify systems together with the human and non-human identities they rely on, including service accounts, API keys, certificates, and privileged human roles.
- Tie risk reviews to entitlement change Make access review outputs actionable by requiring a removal, revalidation, or documented exception for every questionable entitlement.
- Measure control effectiveness with identity telemetry Track orphaned accounts, stale credentials, excessive privileges, and unresolved review findings as risk indicators.
What's in the full article
Zluri's full article covers the operational detail this post intentionally leaves for the source:
- A step-by-step explanation of the NIST-style RMF workflow from categorise through monitor.
- Comparative descriptions of ISO 31000, COBIT 5, FAIR, OCTAVE, TARA, FISMA, and COSO ERM.
- The vendor's own access review positioning and how it maps to its platform context.
- Examples of how RMF best practices are presented for teams choosing a framework.
👉 Read Zluri's guide to risk management framework components and best practices →
Risk management frameworks and IAM controls: what teams miss?
Explore further
12/06/2026 11:02 am
Risk management frameworks fail when identity inventory is incomplete: RMF assumes the organisation can categorise systems and the identities attached to them before it decides which controls to apply. That assumption breaks when service accounts, API keys, and privileged human access are scattered across tools and owners. The implication is not that RMF is wrong, but that identity visibility is the precondition for making RMF real.
A few things that frame the scale:
- From our research: 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- NHIMG research also finds that only 5.7% of organisations have full visibility into their service accounts, which means most RMF programmes are assessing a partial identity picture at best.
A question worth separating out:
Q: Who should be accountable for RMF when identities span IAM, PAM, and NHI?
A: Accountability should sit with the teams that own identity decisions, not just the teams that run the tooling. IAM, PAM, IGA, and NHI owners need shared responsibility for inventory, review, and remediation so that risk does not fall between operational silos.
👉 Read our full editorial: Risk management frameworks expose the governance gap in IAM
