Notifications
Clear all
Topic starter
25/06/2026 1:36 pm
TL;DR: Utilities face rising cyber and compliance pressure as digitalization, internal risk, and manual access governance strain critical infrastructure operations, according to SailPoint and Ponemon Institute research cited in the post. Identity automation becomes the practical control that improves visibility, accelerates access changes, and strengthens auditability across cloud, hybrid, and legacy environments.
NHIMG editorial — based on content published by SailPoint: Three Ways Identity Security Protects Critical Infrastructure for Utilities
By the numbers:
- 54% of utilities expect their operational technology to be attacked within the next year.
- 30% of all data breaches at utilities are caused by internal actors.
Questions worth separating out
Q: How should utilities automate access governance across cloud, hybrid, and legacy systems?
A: Utilities should connect access decisions to authoritative identity events, then enforce provisioning, review, and removal through a central governance workflow.
Q: Why do manual access processes create risk in critical infrastructure environments?
A: Manual processes create risk because access changes depend on human follow-up, which is slow and inconsistent when roles, contractors, and operational priorities change quickly.
Q: How can security teams tell whether identity governance is working in a utility?
A: Look for evidence that access reviews are completed on schedule, stale access is removed quickly, and entitlement history is traceable across cloud, hybrid, and legacy systems.
Practitioner guidance
- Map every identity path that can touch utility operations Inventory employee, contractor, service, and privileged access across cloud, hybrid, and legacy systems, then assign each path to an accountable owner.
- Automate joiner-mover-leaver workflows for time-bound access Trigger provisioning, recertification, and removal from authoritative HR and vendor events so access changes happen when roles change, not after a manual cleanup cycle.
- Build audit-ready access evidence into the identity platform Retain policy decisions, approval history, and entitlement changes in a form that can be exported for compliance review.
What's in the full article
SailPoint's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step explanation of how the identity platform centralises access visibility across utility environments
- Specific examples of how automated onboarding and offboarding reduce manual effort for employees and contractors
- Practical guidance on using policy controls and audit trails to support NERC CIP compliance
- A utility-focused framing of how to manage access across cloud, hybrid, and legacy systems
👉 Read SailPoint's identity security guidance for utilities →
Utilities identity security: where visibility and automation close gaps?
Explore further
25/06/2026 3:36 pm
Identity visibility is the control plane utilities need before automation can be effective. Utilities cannot govern what they cannot see, and the article correctly frames visibility as a prerequisite for access control across cloud, hybrid, and legacy systems. In infrastructure sectors, hidden entitlements create governance blind spots that outlast any one application or workflow. The practitioner conclusion is simple: identity programmes fail first at inventory, then at enforcement.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, which broadens the attack surface and makes entitlement review a governance issue rather than a clean-up task.
A question worth separating out:
Q: What frameworks matter most for utility identity governance and compliance?
A: NERC CIP is central for utility compliance, and identity controls should also align with the NIST Cybersecurity Framework 2.0 for governance, access control, and continuous improvement. The practical test is whether the programme can demonstrate least-privilege access, prompt removal, and auditable decision trails across the full estate.
👉 Read our full editorial: Identity security for utilities depends on visibility and automation
