The main failure is governance fragmentation. When entitlements are managed separately across platforms, no single team can reliably prove who has access, whether it is still needed, or whether privileged sessions are controlled. That creates audit gaps, stale permissions, and inconsistent enforcement across citizen services.
Why fragmented public-sector IAM fails across cloud, legacy, and local systems
Public-sector IAM breaks down when access decisions are split across separate control planes. Cloud platforms, legacy directories, and local system accounts often each carry their own roles, groups, and exceptions, so entitlement ownership becomes unclear. The result is not just duplication, but a loss of authoritative visibility over who can access what, under which approval, and through which privilege path.
That fragmentation matters because IAM is only as reliable as the weakest place where access is granted or retained. If one system still allows a dormant account, a shared admin credential, or a stale local exception, the overall governance model no longer reflects actual access.
In mixed public-sector estates, the technical problem is usually not a single missing control. It is inconsistent state: cloud permissions may be reviewed on one cadence, legacy directories on another, and local system access informally by administrators. The organisation then loses a consistent answer to basic questions such as whether access is current, whether it is justified, and whether it can be revoked everywhere at once.
That is why governance fragmentation is the core failure mode. The control surface becomes distributed faster than the operating model can track it, and the access record that auditors, security teams, and service owners rely on stops matching the real environment. A useful baseline for restructuring that model is Identity Security Programme Guide, which frames identity governance as an operating model rather than a collection of disconnected tools.
Where the fragmentation shows up in practice
Fragmented IAM usually shows up in three places: entitlement sprawl, weak lifecycle control, and uneven privilege enforcement. Entitlement sprawl means the same person or service may have overlapping access in cloud, on-prem, and local contexts. Weak lifecycle control means joiner, mover, and leaver actions are not completed everywhere at the same speed. Uneven privilege enforcement means privileged sessions, break-glass paths, and delegated admin rights are governed by different teams or standards.
In public-sector environments, those gaps often survive because each platform seems “covered” in isolation. cloud iam may be mature, yet a legacy application still relies on local admin groups. A mainframe or departmental system may be stable, yet it has no modern recertification workflow. A local exception may be logged, but never reconciled back to the central directory. The system therefore looks controlled at the platform level and uncontrolled at the enterprise level.
The practical consequence is that access review becomes an exercise in reconciliation, not assurance. Teams spend time comparing reports from different systems, but they cannot easily prove whether a permission is duplicated, inherited, stale, or still necessary for a business function. That is why lifecycle management and access governance need to be treated together, not as separate tasks. The NHI Lifecycle Management Guide is useful here because it shows how provisioning, rotation, offboarding, and recertification belong to one continuous control loop.
Why audit, privilege, and service continuity suffer
Once access is split across systems, audit evidence becomes incomplete by design. An auditor may see that a user was removed from one directory, yet the same person still has local access on a server or in a departmental application. Likewise, a privileged session may be approved in one tool while standing privileges remain elsewhere. This creates a mismatch between policy evidence and operational reality.
Public-sector teams also underestimate how quickly fragmentation turns into service risk. When access is distributed, emergency changes, incident response, and service transitions become harder because no single team can confidently trace the blast radius of an account, role, or token. That slows revocation, complicates incident scoping, and makes it harder to prove least privilege after the fact. The issue is not only theft or abuse, but the inability to restore trustworthy control quickly.
For organisations with significant cloud and legacy overlap, the control question is whether entitlement decisions are being enforced through one authoritative process or through local exceptions that drift over time. Cloud-specific privilege management is often the missing bridge between policy and execution, which is why Cloud PAM and CIEM Guide is a strong companion for understanding how effective permissions, escalation paths, and just-in-time access reduce hidden privilege.
Risk and Threat Considerations
Fragmented IAM increases the chance that stale access, overprivilege, or orphaned local accounts survive after a role change or offboarding event. It also creates hiding places for abuse, because attackers and insiders can keep using the weakest path even after central controls appear to be tightened.
Failure mechanism: Access is revoked in one environment but remains valid in another, or privileged control is split so no team sees the full access path. That breaks assurance, delays containment, and leaves audit evidence out of sync with reality.
Impact: The organisation faces unauthorized access, slower incident response, failed recertification, and inconsistent enforcement across citizen-facing services and internal systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Fragmented access across systems is fundamentally an account lifecycle and entitlement tracking problem. |
| AC-6 — Least Privilege | Distributed entitlements often create excess access and uncontrolled privilege paths. | |
| AU-6 — Audit Review, Analysis, and Reporting | Fragmentation creates audit gaps that require correlation across inconsistent access sources. | |
| Recommendation — Centralise account inventory and deprovisioning so removed access is revoked across every platform. Review effective permissions and remove redundant privilege across cloud, legacy, and local systems. Correlate access and privilege events from all systems to verify who actually has access. | ||
| CIS Controls v8 | CIS-5 — Account Management | Public-sector IAM fragmentation is visible as unmanaged accounts and inconsistent lifecycle control. |
| Recommendation — Inventory accounts and remove stale access across every environment on a fixed cadence. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | The subject concerns enterprise access control consistency across multiple systems. |
| Recommendation — Define one access-control policy that covers cloud, legacy, and local systems. | ||
Practitioner Guidance
What to prioritise: Establish one authoritative view of entitlement ownership before trying to optimise reviews. If a team cannot name the system of record for access decisions, it cannot reliably remove stale access or prove privilege boundaries.
What to verify: Check whether the same identity can still authenticate through legacy, cloud, and local paths after offboarding, role change, or privilege removal. If any path remains active, the control is fragmented even if the central directory looks clean.
Common mistake: Treating cloud IAM, on-prem IAM, and local admin practice as separate hygiene workstreams. In public-sector estates, that usually preserves audit gaps because the enterprise never gets a single recertification and revocation model.
Practitioner takeaway: Fragmentation is the risk, but inconsistent authority is the failure. The right response is not more reporting, it is one governance model that can explain and enforce access end to end.
Related resources from NHI Mgmt Group
- How should public-sector teams govern access across legacy systems and cloud services?
- What breaks when sensitive data is spread across cloud, SaaS, and legacy systems without unified controls?
- How should banking teams implement IAM across hybrid cloud and legacy systems without creating access gaps?
- How should security teams govern privileged access across cloud and legacy systems?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org