Security teams should define segregation of duties policies that apply across both legacy ERP and cloud applications, then enforce them consistently as processes move. The key is to map sensitive transactions, identify toxic combinations, and automate preventive controls so access does not drift during migration. Cross application governance matters because gaps often appear when one system is modernised faster than the other.
Why This Matters for Security Teams
segregation of duties becomes harder, not easier, during Oracle cloud migration because control boundaries shift while business processes stay live. The risk is not just excessive access in one platform, but toxic combinations that span legacy ERP, integration layers, and the new cloud estate. NIST frames this as a governance and access control problem, not a one-time migration task, in the NIST Cybersecurity Framework 2.0.
In practice, teams often inherit role structures that were built for system administration convenience rather than transaction risk. That means procurement, payments, vendor master changes, journal approvals, and emergency access can be separated inside one system yet combined through interfaces or service accounts across two systems. The same issue is visible in NHIMG guidance on the Top 10 NHI Issues, where standing privileges and lifecycle drift undermine policy enforcement. If you are not mapping the end-to-end transaction path, SoD is already leaking.
NHIMG research from the 2024 ESG Report: Managing Non-Human Identities found that 72% of organisations have experienced or suspect a breach of non-human identities. In hybrid Oracle programs, that matters because service identities, API keys, and automation accounts often carry the authority that humans no longer need directly. In practice, many security teams encounter SoD failures only after a migrated process is already being used in production, rather than through intentional control design.
How It Works in Practice
The practical approach is to treat SoD as a cross-platform control model tied to business events, not to individual applications. Start by identifying the sensitive Oracle transactions that create fraud, operational, or audit risk, then define which duties must never be combined by a human, service account, or automation workflow. That control set should be enforced in legacy ERP and cloud ERP alike, with the same toxic-combination logic applied to role assignment, workflow approval, and privileged support access.
Security teams typically need three layers:
- Transaction mapping that traces each risky activity across Oracle modules, integrations, and downstream tools.
- Role and entitlement analysis that flags conflicting access before migration cutover.
- Preventive controls that block access requests, approvals, or emergency elevation when a toxic pair is detected.
For control design, the NIST SP 800-53 Rev. 5 Security and Privacy Controls provides useful anchors for least privilege, separation of duties, and auditability. NHIMG’s NHI Lifecycle Management Guide is especially relevant where Oracle integrations use non-human identities, because those accounts need provisioning, review, and revocation rules that mirror human control objectives. Where manual approvals exist, they should be backed by policy-as-code or role mining so the same toxic combination cannot reappear in the cloud target.
Operationally, the best migration pattern is to baseline SoD in the source environment, re-test it in the target tenant, then continuously reconcile drift during coexistence. These controls tend to break down when legacy customizations, shared service accounts, and emergency admin pathways are left outside the migration workstream because the effective authority chain becomes invisible.
Common Variations and Edge Cases
Tighter SoD controls often increase migration overhead, requiring organisations to balance audit assurance against delivery speed. That tradeoff is most visible when Oracle customisations, third-party connectors, or batch jobs cannot be cleanly re-authored before cutover. Current guidance suggests treating those exceptions as time-bound and compensating, not as permanent policy gaps.
One common edge case is the shared responsibility between Oracle application owners and cloud platform teams. A role may look compliant in the application, yet still gain prohibited power through infrastructure-level access, service integration, or support tooling. Another is emergency access: break-glass accounts are sometimes justified, but they should be tightly logged, reviewed, and excluded from normal entitlement paths. The Ultimate Guide to NHIs — Regulatory and Audit Perspectives is useful here because auditors usually care less about the tool and more about evidence that conflicts were identified, approved, and monitored.
For hybrid Oracle migrations, the most practical control is a living SoD matrix that spans both estates, including human roles, service identities, and workflow automations. If the matrix is not updated as interfaces, privileges, and business ownership change, the migration will create a new set of hidden conflicts rather than reducing the old ones. That is where the control model becomes advisory instead of enforceable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-4 | SoD depends on least-privilege access enforcement across hybrid Oracle estates. |
| NIST SP 800-63 | Identity assurance matters when humans and service accounts share authority. | |
| OWASP Non-Human Identity Top 10 | NHI-03 | Hybrid Oracle migration often exposes non-human identities with excessive standing access. |
| CSA MAESTRO | Cross-system governance is central when automation and cloud orchestration span estates. |
Apply MAESTRO to govern identities, approvals, and runtime controls across hybrid workflows.
Related resources from NHI Mgmt Group
- How should security teams extend segregation of duties controls across cloud procurement apps and ERP environments?
- How should security teams manage privileged access and secrets governance at large industry events and in hybrid environments?
- How should security teams protect identities across Microsoft on-premises and cloud environments?
- How should security teams modernise privileged access when moving from legacy PAM to a unified platform across on-premise and cloud environments?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
