Who is accountable when ISO 27001 certification is at risk because migration is delayed?

Why This Matters for Security Teams

When iso 27001 certification is threatened by a delayed migration, the issue is rarely just project slippage. It is a governance problem that affects scope, control operation, evidence quality, and the organisation’s ability to demonstrate leadership commitment. ISO 27001 expects the ISMS to be resourced, monitored, and improved, which means accountability stays with leadership even if the technical work sits elsewhere. NIST’s NIST Cybersecurity Framework 2.0 reinforces the same basic idea: risk decisions need ownership, not optimism.

For NHI-heavy environments, migration delays are especially risky because credentials, service accounts, API keys, and certificates often remain active long after a target state was planned. NHIMG research shows that NHIs outnumber human identities by 25x to 50x in modern enterprises, which turns a delayed migration into a broad exposure window rather than a narrow implementation inconvenience. In practice, many security teams encounter certification risk only after evidence gaps and overdue control changes have already accumulated.

How It Works in Practice

Accountability for certification risk should be mapped to the ISMS governance chain, not only the technical delivery plan. Leadership owns the risk decision, the CISO or ISMS owner owns the control narrative, and project owners own execution against milestones. If migration is delaying control changes, the organisation should treat that delay as a tracked risk with a defined owner, due date, compensating controls, and board visibility.

Practically, teams should separate three questions: what is still in scope, what has changed in the control environment, and what evidence is needed to prove controls remain effective. That means documenting temporary approvals, validating whether legacy systems still process sensitive data, and checking whether access controls, logging, backup, and incident response evidence still match the certified scope. For NHI-driven migrations, current guidance suggests using short-lived credentials, revocation checks, and access review evidence to prove that old identities were retired, not merely renamed. NHIMG’s Top 10 NHI Issues and Ultimate Guide to NHIs — Key Challenges and Risks are useful references for understanding why stale secrets and unmanaged service accounts often become certification findings.

• Assign the migration risk to a named executive sponsor, not just a project manager.
• Refresh the ISMS risk register whenever timelines change.
• Record compensating controls where the target state is not yet live.
• Collect evidence that legacy NHIs, secrets, and privileged access are being removed on schedule.
• Escalate any control gap that could affect audit scope, not only production uptime.

These controls tend to break down when migration spans multiple business units and no single owner can approve risk acceptance across the full ISMS scope.

Common Variations and Edge Cases

Tighter certification governance often increases coordination overhead, requiring organisations to balance audit readiness against delivery speed. That tradeoff is real, especially when a migration touches shared platforms, regulated data, or outsourced operations. There is no universal standard for how long a project delay can remain “acceptable” before certification risk becomes material; current guidance suggests the answer depends on scope impact, control degradation, and evidence drift.

One common edge case is a migration that is technically late but operationally harmless. Even then, leadership still needs to decide whether the delay affects control design or only implementation timing. Another edge case is a programme that replaces one identity platform with another while leaving legacy NHIs active for compatibility. In those situations, the question is not whether migration is complete, but whether residual access has been explicitly governed, monitored, and scheduled for removal. This is where ISO 27001, Oasis Security & ESG findings, and broader NHI governance intersect: delayed cleanup often matters more than delayed cutover. For teams aligning with agentic or machine-driven workflows, the same principle applies to OWASP NHI Top 10 risks, where stale identities and uncontrolled privileges are common failure paths.

In practice, certification risk becomes unavoidable when leadership assumes “migration in progress” is evidence of control effectiveness, rather than proof that the control gap still exists.

Related resources from NHI Mgmt Group

• How should security teams govern non-human identities for ISO 27001?
• Why do non-human identities create more audit risk than human accounts?
• Why do non-human identities create audit risk in modern environments?
• Why do non-human identities create compliance risk even when policies exist?