What should organisations do if physical access badges are outside IAM control?

How should physical badge access be governed when IAM does not own it?

Physical access should be treated as part of the same identity lifecycle, even if the badge system sits outside the IAM platform. The practical goal is not technical convergence, it is governance convergence, so badge issuance, deactivation, exceptions and periodic review stay aligned with the identity record that drives digital access decisions.

When buildings and systems use separate tooling, the risk is that one side becomes the source of truth while the other drifts. That creates gaps in joiner-mover-leaver handling, weakens joiner and leaver controls, and makes access reviews incomplete unless the physical access state is reconciled back to the identity lifecycle.

Organisations should define a control owner for badge governance, a revocation trigger tied to identity changes, and evidence that proves badge status was checked at the same cadence as account status. The operating model can remain federated, but the control objective should be unified: no active badge without a current business reason and an accountable owner.

What breaks when physical access is left outside the identity lifecycle?

The most common failure mode is lifecycle mismatch. A user can lose digital access, change roles, or leave the organisation, while badge access remains active because the facility process is not connected to the identity process. That creates stale access, orphaned exceptions, and blind spots in recertification.

Another failure mode is exception sprawl. If facilities teams approve badges independently, the organisation may end up with local approvals that are never reviewed against entitlement changes, termination events, or segregation-of-duties expectations. Over time, the badge becomes a parallel privilege system instead of a controlled extension of identity governance.

Physical access also broadens the blast radius of compromise. A badge that persists after digital offboarding can support facility entry, workstation access, tailgating opportunities, or insider misuse. The control weakness is not the door itself, it is the absence of a coherent revocation and review trigger across both physical and digital access states.

What should the operating model look like in practice?

Use the identity record as the coordination point, even if the badge application remains separate. Badge issuance should require a named owner, a valid employment or contractor state, and a mapped purpose. Badge removal should be triggered by termination, transfer, contract end, or loss of sponsorship, not by a local administrative calendar.

Review processes should reconcile badge lists against active identities and approved exceptions. If the badge tool cannot be directly integrated, the organisation can still run a manual or batch reconciliation process, but it must produce evidence that stale access was found, reviewed, and removed. The important point is control consistency, not platform sameness. See the IAM and IGA Basics for the lifecycle and access-review concepts that should anchor this governance model.

Where physical access supports sensitive areas, badge governance should sit alongside broader identity programme ownership, not only facilities operations. That is especially important when the same user also has application, workstation, or privileged access, because a failure in one channel often signals a wider lifecycle or approval issue. NHIMG’s Identity Security Programme Guide is useful for structuring that shared ownership model.

Risk and Threat Considerations

Physical badges outside IAM control create a control gap that attackers and insiders can exploit. If offboarding only revokes digital credentials, a valid badge may still provide building access, access to desks or sensitive spaces, and a path to opportunistic misuse before anyone notices the mismatch.

Failure mechanism: Badge status drifts from identity status because issuance, renewal, exception handling, and deactivation are managed in a separate workflow with no enforced reconciliation or evidence trail.

Impact: Organisations can retain stale physical privileges after role change or termination, making insider misuse, unauthorised entry, and audit failure more likely, especially where physical access is a prerequisite for further compromise.

Practitioner Guidance

What to verify: Confirm that every active badge has an accountable owner, a current business justification, and a revocation path tied to the same joiner-mover-leaver events that drive digital access. If you cannot evidence that reconciliation, treat physical access as a governance gap rather than a facilities-only issue.

Implementation sequence: Start by mapping where badge issuance, emergency access, visitor access, and exception approvals happen today. Then define the minimum shared controls, identity match, timely deactivation, periodic review, and exception expiry, before attempting any tooling integration.

Practitioner takeaway: The key decision is not whether one platform owns both systems, it is whether one lifecycle owns both decisions. If physical access can outlive identity state, the organisation has already accepted a privilege control inconsistency.

Related resources from NHI Mgmt Group

• How should organisations govern physical access as part of IAM?
• How should organisations separate identity proofing from access control in IAM?
• How should organisations replace physical ID cards without creating new access control gaps?
• Which IAM control matters most when organisations need to keep access available during identity provider outages?