Notifications
Clear all
Topic starter
24/06/2026 10:33 pm
TL;DR: UK universities now face compliance expectations that require proof of who had access, why it was granted, and when it was removed, because regulators and funding bodies increasingly test identity control in practice rather than policy, according to SailPoint. Identity governance has moved from an IT housekeeping issue to a leadership-level control for funding, research credibility, and regulatory exposure.
NHIMG editorial — based on content published by SailPoint: Regulatory and compliance, why identity control matters in UK higher education
Questions worth separating out
Q: What fails when universities rely on policy instead of proof for access control?
A: Policies alone do not satisfy auditors, regulators, or funding bodies if the institution cannot prove who had access, why it was granted, and when it was removed.
Q: Why do joiner, mover, leaver gaps create compliance risk in higher education?
A: Because identity changes in universities often follow staff moves, student status changes, and research affiliation endings.
Q: What do security and IAM teams get wrong about research access?
A: They often treat research access as a one-time approval rather than a time-bound entitlement.
Practitioner guidance
- Bind access to authoritative source records Connect identity events to HR, student, and research systems so role changes and departures trigger access updates without manual ticket handling.
- Replace spreadsheet evidence with audit-ready logs Record who approved access, why it was granted, and when it was removed in a system of record that auditors can verify.
- Automate leaver and mover revocation checks Test whether a staff move, graduation, or contract end removes access immediately from finance, research, and collaboration systems.
What's in the full article
SailPoint's full blog covers the operational detail this post intentionally leaves for the source:
- How the university access lifecycle maps to HR, student, and research source systems in practice.
- Examples of audit evidence that satisfy compliance reviews without relying on spreadsheets or email chains.
- Why automated mover and leaver controls reduce the risk of lingering access after role changes or contract end.
- How research and export-control scenarios change the requirements for time-bound external access.
👉 Read SailPoint's analysis of identity control and compliance in UK higher education →
UK universities and identity control: what compliance now expects?
Explore further
25/06/2026 7:15 am
Compliance-by-policy is no longer sufficient in higher education. Universities are being judged on whether access can be evidenced, not whether a policy exists on paper. That changes identity governance from an administrative function into a control that directly affects funding and regulatory standing. Practitioners should treat proof of enforcement as the actual compliance deliverable.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to GitGuardian & CyberArk research.
A question worth separating out:
Q: Who is accountable when access remains after a role change or contract end?
A: Accountability sits with the institution, but operational ownership usually spans HR, IAM, research administration, and local system owners. The question is whether the university can demonstrate a clear removal path, not whether someone intended to remove access. That proof is what determines whether the control stands up under scrutiny.
👉 Read our full editorial: Identity control is now a compliance issue in UK higher education
