Onboarding establishes the initial governance baseline for an application, including ownership, entitlements, service accounts, and approval workflows. Sustaining application governance keeps that baseline accurate by continuously reconciling entitlement data, reviewing access, removing stale privileges, and updating controls when the application, its integrations, or its data exposure changes.
How onboarding sets the governance baseline
Onboarding is the point where an application first enters governance scope. The practical goal is to make the application visible, owned, and reviewable before it starts accumulating access paths that nobody can explain later. That usually means defining an owner, recording the entitlements it needs, identifying service accounts, and putting approval and review workflows around future changes.
Onboarding is therefore a control-design activity as much as a registration step. It asks, “what should this application be allowed to do, who can approve it, and how will we know if that answer changes?” For teams bringing apps under formal governance, an intake process like New Application Security Intake Questionnaire helps establish that baseline early, before access sprawl becomes the default.
What sustaining governance is responsible for after go-live
Sustaining governance starts after onboarding is complete. Its job is to keep the original baseline accurate as the application, its integrations, and its data exposure evolve. In practice, that means reconciling entitlement data, reviewing access against current need, removing stale privileges, and updating controls when the system changes rather than waiting for the next formal intake cycle.
This is where governance stops being a one-time approval exercise and becomes an operating discipline. Application teams often change integrations, add new data stores, or accumulate exception access long after the original onboarding review. A guide such as Entitlement Catalogue and Application Onboarding Guide is useful here because it ties application ownership and entitlement tracking to the ongoing review model that sustaining governance depends on.
Why the difference matters in practice
Onboarding answers “what should exist now,” while sustaining governance answers “is that still true.” The difference matters because the highest-risk failures usually appear after initial approval, when entitlements drift, service accounts outlive their purpose, or a newly connected system expands the access surface without a corresponding review. A governance model that only focuses on onboarding creates a false sense of control.
That is also why a lifecycle view matters for any application that uses machine-to-machine access. If the application depends on credentials, tokens, or service identities, those access paths need the same lifecycle discipline as user access. The difference between starting governance and sustaining it is often the difference between a clean baseline and a slowly growing set of unowned privileges.
Risk and Threat Considerations
When sustaining governance is weak, the main risk is entitlement drift: access that was once justified remains in place after the business need disappears, the integration changes, or the data scope expands. That creates unnecessary exposure, makes access reviews less trustworthy, and increases the chance that an old access path becomes the easiest path for misuse or compromise.
Failure mechanism: Governance breaks when ownership, entitlement records, and actual application behavior diverge, so approvals keep referencing a stale baseline instead of current reality.
Impact: Stale privileges, orphaned service accounts, and unreviewed integration access can persist long enough to widen blast radius, complicate incident response, and weaken audit evidence for who can access what and why.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Application governance relies on managing and reviewing access rights over time. |
| AC-6 — Least Privilege | The question centers on keeping application access aligned to current need. | |
| AU-6 — Audit Review, Analysis, and Reporting | Sustaining governance depends on reconciling changes and detecting access drift. | |
| Recommendation — Review and update application access regularly, removing stale or excessive entitlements. Continuously restrict application privileges to the minimum required for current operations. Use audit review to detect entitlement drift and trigger remediation when access changes. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Application governance differentiates initial access definition from ongoing access enforcement. |
| A.5.18 — Access rights | Sustaining governance requires periodic review and adjustment of application rights. | |
| Recommendation — Define and maintain access rules for applications throughout their lifecycle. Periodically review application rights and revoke access that no longer has a business need. | ||
Practitioner Guidance
What to verify: Treat the onboarding record as a starting point, not proof of ongoing control. Verify that the application owner, entitlement catalogue, approval path, and service-account inventory still match the live application and its integrations.
What good looks like: Sustaining governance has a measurable cadence, with entitlement reconciliation, access review, and change-triggered revalidation tied to application updates, not left to annual cleanup.
Common mistake: Teams often equate “approved at onboarding” with “governed forever.” The more integrations and data flows an application accumulates, the less credible that assumption becomes.
Practitioner takeaway: Onboarding creates the control baseline, but sustaining governance is what preserves its accuracy as the application changes; without that second phase, governance becomes historical documentation rather than current control.
Related resources from NHI Mgmt Group
- How should security teams reduce application onboarding backlog without weakening governance?
- How should teams balance speed and governance in application onboarding?
- How should teams scale application onboarding without turning identity governance into a backlog?
- How should security teams implement IAM governance documentation for application onboarding and access reviews?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org