Should IAM teams prioritise zero standing privilege over broader access reviews?

Why zero standing privilege beats review-only governance when exposure is the real problem

zero standing privilege is the better first control when you are trying to stop persistent privilege from existing in the first place. Access reviews are still useful for proving ownership, surfacing drift, and cleaning up entitlement sprawl, but they are retrospective. If a privilege can be activated only when needed, the exposure window shrinks before the next certification cycle can even begin.

That matters because the control objective is different. Reviews answer, “Who has what?” Zero standing privilege answers, “Who can act right now?” In fast-moving environments, the second question is often the one that determines whether misuse is possible at all.

Zero standing privilege also changes the operating model for privileged access. Instead of leaving powerful roles continuously available and hoping review hygiene catches excess, teams move toward eligible access, time-bounded activation, and stronger session oversight. NHIMG’s Just-in-Time Access and Zero Standing Privilege Guide and Privileged Access Management Guide both reflect that shift from continuous privilege to controlled activation.

Why access reviews still matter, even if they should not be the primary control

Access reviews remain important when the problem is unknown ownership, inherited entitlements, or stale access that nobody has formally accepted responsibility for. They are especially useful as a governance mechanism for recertification, exception handling, and proving that the entitlement model is being governed rather than merely accumulated. NHIMG’s Access Reviews and Certification Guide and IAM and IGA Basics are relevant because they focus on the review-and-certify layer that keeps access inventories honest.

The limitation is timing. A review cycle can confirm that access was acceptable at the point of attestation, but it does not inherently reduce the time between approval, activation, abuse, and eventual cleanup. If the environment is already sensitive, review-only governance leaves a gap between certification events that attackers, insiders, or automation errors can exploit.

That is why lifecycle controls and review controls should be treated as complementary, not interchangeable. NHIMG’s NHI Lifecycle Management Guide is useful here because it ties provisioning, rotation, offboarding, and visibility together, which is the practical way to reduce both privilege persistence and entitlement drift.

What a sensible priority order looks like for IAM teams

If the immediate failure mode is standing privilege, start by reducing the number of accounts, roles, and secrets that can act with power all the time. Then use reviews to validate who should remain eligible, who should lose access, and which exceptions still exist for operational reasons. NHIMG’s Top 10 NHI Issues is helpful because it frames over-privilege, stale access, and unmanaged credentials as recurring control failures rather than isolated hygiene problems.

The practical decision rule is simple: if the risk is misuse during the lifetime of standing access, prioritise just-in-time or eligible-only access first; if the risk is unclear ownership or broad entitlement sprawl, use reviews to clean the inventory, then convert the most sensitive access paths to zero standing privilege. In mature programs, both controls support each other, but they are not equal substitutes.

Risk and Threat Considerations

Persistent privilege creates a larger attack window than most review cycles can comfortably cover. Once an account, role, or secret can act continuously, compromise only needs to happen once, while detection or recertification may happen much later.

Failure mechanism: Excess privilege remains active between review points, allowing misuse, lateral movement, or unintended administrative action before the next certification removes it.

Impact: The blast radius is larger, the window for abuse is longer, and the organisation can be technically “reviewed” while still being operationally exposed.

Practitioner Guidance

What to prioritise: Put zero standing privilege first for the highest-impact roles and systems, then backfill with reviews for entitlement hygiene. That sequencing matters most where privileged actions can cause immediate business or security damage.

What to verify: Confirm that “eligible” really means “inactive until activated,” that activation is time-bound, and that emergency access is separately governed. A program is not zero standing privilege if powerful access still sits continuously available in practice.

Practitioner takeaway: Use access reviews to govern entitlement truth, but use zero standing privilege to reduce exposure. The best control choice is the one that shortens the time an attacker, insider, or mistake has to do harm.

Related resources from NHI Mgmt Group

• When should teams prioritise zero standing privilege over broader access convenience?
• When should organisations prioritise zero standing privilege over broader access convenience in secrets management?
• When should teams prioritise privilege controls over broader IAM projects?
• How should security teams run access reviews for non-human identities?