Topic starter
12/02/2026 8:56 pm
TL;DR: Zero Trust, least privilege, JIT access, RBAC and ABAC, auditing, and centralized logging should form the baseline for reducing access risk, according to StrongDM’s IAM best-practices guide, which cites a study showing 85% of credentials had not been used in the last 90 days. The practical shift is that IAM hygiene now has to extend to non-human identities as well as workforce access.
Editorial analysis by NHI Mgmt Group, based on content published by StrongDM: “Identity and Access Management (IAM) Best Practices”.
Key questions
Q: What breaks when organisations keep standing access in place for too long?
A: Standing access breaks least-privilege governance because permissions remain usable long after the original need ends.
Q: Why do unused credentials increase the risk of credential stuffing and unauthorized access?
A: Unused credentials create risk because they often remain valid after the person who owned them no longer needs access.
Q: How do security teams know whether least privilege is actually working?
A: Least privilege is working when identities have narrowly scoped permissions, unused credentials are removed or quarantined, and repeated access reviews consistently shrink entitlements.
Practitioner guidance
- Define a Zero Trust access policy baseline Require re-verification for access to sensitive systems instead of relying on remembered sessions or inherited trust.
- Replace standing elevation with JIT access Use task-scoped access windows for admin and sensitive operations so elevated permissions do not remain available between requests.
- Map RBAC and ABAC together Use roles for coarse access assignment and attributes for context-specific narrowing so access does not depend on manual exception handling.
Bottom line: Zero Trust, least privilege, JIT access, RBAC, ABAC, auditing, and centralized logging are best understood as a single governance stack rather than separate hygiene items.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
07/10/2026 9:37 pm
Standing access is the governance debt that Zero Trust is meant to reduce. When identity systems remember trust, they create a long-lived permission state that is easier to abuse than to review. That is why least privilege only works when it is paired with continuous verification and a real deprovisioning discipline, especially where machine identities are involved. Practitioners should treat standing access as a lifecycle defect, not a policy preference.
A question worth separating out:
Q: Should organisations treat NHI access control separately from user access control?
A: Yes. The governance mechanics overlap, but the identity subjects behave differently and require different lifecycle assumptions. Human access can follow HR events, while NHI access often depends on application ownership, secrets handling, and rotation. Treating them as the same process usually hides risk in the machine layer.
👉 Read our full editorial: Identity and access management best practices for NHI governance