What should IAM teams measure to know whether identity governance is working?

Why This Matters for Security Teams

identity governance is only working when security teams can prove, not assume, that access is owned, reviewed, and removed on time. For human users this is already hard; for service accounts, API keys, workload tokens, and delegated access, it is where account-centric programmes usually fail. NHI Management Group research on lifecycle discipline and audit readiness shows that identity control has to be measured at the point of creation, use, and revocation, not just at provisioning.

That matters because stale access is rarely visible until an incident or audit forces a full inventory. The NIST Cybersecurity Framework 2.0 treats governance as an operating discipline, not a quarterly spreadsheet exercise, and NHIMG’s Regulatory and Audit Perspectives page reinforces that audit evidence must show continuous control, not retroactive cleanup. If the measure is only how many identities exist, the programme will miss the real question: which identities can still do harm.

In practice, many security teams discover orphaned credentials and delayed revocation only after a failed audit or a compromise investigation has already exposed them.

How It Works in Practice

Effective measurement starts by separating identity types and tracking governance signals for each one. A human user, a machine identity, and a delegated AI agent do not have the same lifecycle, so they should not be judged with the same metrics. A useful governance baseline combines ownership, review cadence, revocation latency, and evidence quality. NHIMG’s Lifecycle Processes for Managing NHIs and Top 10 NHI Issues are useful references for the control points that typically fail first.

Security teams should measure at least four things:

• Coverage: the percentage of identities with a named owner and a documented business purpose.
• Timeliness: median time to revoke access after termination, role change, or task completion.
• Freshness: the share of identities reviewed within the approved cadence and remediated when access is no longer needed.
• Evidence quality: whether audit logs, approvals, and change records can show who approved access, why it existed, and when it was removed.

For non-human identities, those metrics should be paired with secret hygiene. Static credentials that never rotate, service accounts with no clear owner, and API keys embedded in code all signal weak governance even if the access review was technically completed. The NIST Cybersecurity Framework 2.0 supports this kind of control evidence by linking asset, identity, and protective controls into a single risk picture. Where teams also operate agentic systems, current guidance suggests measuring whether the identity can be constrained at runtime, since autonomous tools can generate access demand that traditional review cycles never anticipated. These controls tend to break down in environments with sprawling SaaS sprawl and unmanaged service accounts because ownership records and revocation paths are fragmented across too many platforms.

Common Variations and Edge Cases

Tighter governance metrics often increase operational overhead, so organisations have to balance visibility against review fatigue and false positives. That tradeoff is especially visible when dozens of machine identities are created automatically by CI/CD, cloud services, or data pipelines. In those environments, a quarterly review alone is usually too slow, but reviewing everything manually is not sustainable either.

Current guidance suggests using risk-based cadences: high-privilege identities should be reviewed more often, while low-risk workload identities can be validated through automated attestations, policy checks, and revocation triggers. That is where the distinction between account-centric and identity-centric governance becomes important. If a platform can show that each identity has an owner, an expiry, and a reliable revocation event, the review is more meaningful than a long list of untouched entitlements. For broader NHI maturity, NHIMG’s 2024 ESG report on managing non-human identities is a useful reminder that compromise rates rise quickly when control is only partial.

There is no universal standard for the perfect set of governance metrics yet, but the practical minimum is consistent: named ownership, short revocation windows, documented reviews, and proof that stale access is actually removed rather than merely noted.

Related resources from NHI Mgmt Group

• How do IAM teams know whether identity governance is actually working?
• How can security teams tell whether identity governance is working in a utility?
• How do teams know whether healthcare IAM is actually working?
• How do IAM teams know whether ITSM integration is actually improving governance?