Topic starter
02/01/2026 11:29 am
TL;DR: Identity governance that stops at audit evidence can still miss active abuse, because quarterly reviews, manual workflows, and disconnected controls do not see real-time access risk, according to RSA Security. Compliance remains necessary, but risk-aware governance is the operating model that closes the gap between certification and security.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “Compliance Isn’t Security: Why Identity Governance Needs a Risk Lens”.
Key questions
Q: What breaks when governance relies only on quarterly access reviews?
A: Quarterly reviews miss the day-to-day drift that accumulates between certification cycles.
Q: Why do compliance-focused governance programmes still miss identity-based attacks?
A: Because compliance tells you that controls existed, not that they were timely enough to stop abuse.
Q: How can security teams know if cloud identity governance is actually working?
A: The clearest signals are fewer unresolved access findings, shorter evidence-collection cycles, lower counts of stale keys, and reduced reliance on manual review.
Practitioner guidance
- Prioritise access reviews by risk signal Move away from flat quarterly certification queues and rank reviews by user risk, sensitive system access, and anomalous context.
- Add behavioural context to governance decisions Use location, device, and time of access as governance inputs so reviewers see whether access is ordinary or suspicious.
- Map toxic combinations before certification cycles Identify separation-of-duties conflicts and privileged access combinations continuously, not after evidence has already been packaged for audit.
Bottom line: Compliance evidence alone does not prevent identity-based abuse when access reviews are periodic and manual.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 3:32 am
Compliance-first governance leaves a security gap by design: A certification process can prove that access was reviewed, but it cannot prove that access was safe when it mattered. RSA Security's point is that audit evidence and exposure reduction are not the same outcome, and treating them as equivalent creates blind spots in modern identity programmes. Practitioners should separate proof of review from proof of risk control.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should financial institutions use identity governance for DORA and NIS2 compliance?
A: They should use identity governance as the evidence layer for access approval, review, and removal. The practical goal is to show that every entitlement has an owner, a business reason, and a lifecycle path. That makes compliance traceable and reduces the chance that stale access becomes an audit finding or operational weakness.
👉 Read our full editorial: Identity governance needs a risk lens, not a compliance lens