They should sequence both together, but change management has to start early. Identity controls fail when managers and users do not understand request, approval, and responsibility changes, especially across many applications. Technology delivers the mechanism, but the operating model determines whether lifecycle governance actually works.
Why the sequence matters for identity programmes
Identity programmes are not won by tooling alone. If you roll out controls before people understand new request paths, approval rules, ownership boundaries, and exception handling, the process is technically live but operationally fragile. Business change management gives the rollout a workable operating model, while technology gives it enforcement.
The practical question is not which stream is more important, but which one must begin first so the other can land cleanly. In identity, that means defining the future-state process, ownership, and decision rights early enough that application teams, approvers, and end users can adapt before enforcement bites.
What technology rollout can and cannot solve
Technology is the mechanism that enforces policy, captures evidence, and scales governance across many systems. It is what turns a design into an access request flow, an approval workflow, a recertification cycle, or a deprovisioning control.
But technology cannot compensate for unclear accountability or inconsistent business rules. If one manager approves access on the assumption that another team owns the application, or if users do not know when to request access versus when to ask for an exception, the control will create friction, delays, and shadow work instead of governance.
That is why identity teams should treat rollout as an implementation stream, not the programme itself. The tool should reflect the policy and process that the business can actually sustain, especially where identity and access governance depends on many local owners rather than one central team.
How to sequence change management and rollout together
Start change management as soon as the target operating model is defined, then shape the technology rollout around that model. The most effective sequence is usually: confirm ownership and decision rights, socialise the new request and approval flow, pilot the control with a limited set of applications, then expand enforcement once the workflow is understood.
For broad estates, this is especially important when the programme touches role design, access reviews, provisioning, or offboarding. A control set can be perfectly designed and still fail if managers are not prepared to make timely decisions or if application owners have not agreed what good approval evidence looks like.
The strongest programmes treat process adoption and platform deployment as one change event. That is consistent with the lifecycle view in the NHI Lifecycle Management Guide, where ownership, rotation, and offboarding only work when the operating rhythm is established alongside the mechanism.
Risk and Threat Considerations
When change management lags the rollout, the main risk is not just user frustration. The control can generate workarounds, stale approvals, orphaned access, and inconsistent exceptions, which weakens lifecycle governance and can leave excessive access in place longer than intended.
Failure mechanism: New technology enforces a process that the business does not understand or trust, so approvers shortcut decisions, users bypass the process, and ownership gaps appear between the control design and the actual operating model.
Impact: Identity governance becomes incomplete in practice, with higher risk of dormant access, delayed revocation, audit evidence gaps, and a rollout that appears successful while the underlying access model remains weak.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Access requests and approvals need defined ownership and lifecycle handling. |
| AC-6 — Least Privilege | Rollouts should preserve minimal access while managers adapt to new decision paths. | |
| PS-5 — Personnel Transfer | Lifecycle changes rely on timely role changes and coordinated business process updates. | |
| Recommendation — Define account ownership and approval workflows before enforcing access automation. Align approval changes to least-privilege rules and remove exceptions quickly. Synchronise transfer and access-change workflows so entitlements change with business moves. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Identity rollout affects how access rules are defined, approved, and enforced. |
| Recommendation — Document access rules and decision rights before broad enforcement. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | The question is about sequencing access governance controls with business adoption. |
| Recommendation — Implement access-control processes only after roles, owners, and approvals are clear. | ||
Practitioner Guidance
What to prioritise: Lock the business decisions first, meaning request path, approver ownership, exception handling, and what evidence is required at approval time. If those are still moving, the technology rollout should remain in pilot rather than broad deployment.
What to verify: Check that application owners, managers, and service owners can each explain their role in the new process without relying on the project team. If they cannot describe the new workflow in their own words, the rollout is ahead of adoption.
Decision rule: If the change affects many applications or approval chains, begin communications, training, and local ownership mapping before full enforcement. If the change only alters a narrowly scoped control, you can compress the sequence, but you should still avoid a pure technology-first launch.
Practitioner takeaway: Identity controls scale when the organisation is ready to operate them, not when the software is installed. The right order is early change management, then technology rollout shaped to that operating model.
Related resources from NHI Mgmt Group
- Should teams prioritise MFA rollout or lifecycle management first?
- What should MSP teams prioritise first when rolling out identity and access management improvements for new clients?
- What should IAM teams prioritise first in a modern identity strategy?
- What controls should teams prioritise first in a Zero Trust rollout?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 6, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org