Who should own identity governance in a small organisation?

Why This Matters for Security Teams

In a small organisation, identity governance fails fastest when it is treated as an IT task instead of a shared control plane for access, accountability, and lifecycle change. That is true for human accounts and even more so for NHIs, which often outnumber people and are harder to see, review, and retire. NHIMG’s Ultimate Guide to NHIs notes that only 5.7% of organisations have full visibility into their service accounts, which means ownership gaps are usually hidden until something breaks.

The practical issue is not who clicks the approval button. It is who is accountable when access changes, a person leaves, a service is repurposed, or a secret is never revoked. That is why governance should be distributed across IT, security, HR, and business owners, even if one person wears multiple hats. The NIST Cybersecurity Framework 2.0 reinforces that identity-related risk needs clear ownership, ongoing review, and measurable response, not one-time admin setup. In practice, many small organisations discover ownership confusion only after an access review, audit finding, or credential leak has already exposed the gap.

How It Works in Practice

Effective identity governance in a small organisation works best when ownership is split by function, not by system alone. IT or the platform administrator usually operates the tools, but security defines control requirements, HR triggers joiner-mover-leaver events for employees, and business system owners confirm that access is still needed. For NHIs, the owner should be the team that depends on the identity and can attest to its purpose, rotation, and retirement. That operating model aligns with the lifecycle emphasis in Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs.

A simple ownership model usually includes:

• IT: provisions accounts, groups, and access paths, and maintains the tooling.
• Security: sets policy, review cadence, exception handling, and control testing.
• HR: initiates onboarding, transfers, and offboarding for workforce identities.
• Managers or system owners: approve access based on business need and validate continued necessity.
• Application or service owners: own NHIs, secrets, rotation, and offboarding for workloads they operate.

For evidence-based governance, teams should tie reviews to inventory, privilege level, and lifecycle stage. NHIMG’s Top 10 NHI Issues highlights how long-lived secrets, poor rotation, and missing offboarding repeatedly drive exposure. A small organisation does not need a large committee, but it does need a named owner for each identity class, a backup approver, and a recurring review cycle. These controls tend to break down when system ownership is unclear across contractors, shared admin accounts, and shadow IT because nobody can reliably attest who should retain access.

Common Variations and Edge Cases

Tighter ownership often increases process overhead, requiring organisations to balance governance quality against limited staffing. That tradeoff is real in small teams, where one person may hold several roles and approvals can slow work if the process is too rigid. Current guidance suggests keeping the ownership model simple, but not informal: use one accountable owner per identity, with clearly documented delegate support and escalation paths.

Edge cases often appear with founders, outsourced IT, shared mailboxes, and automation accounts. In those environments, best practice is evolving, but the principle is consistent: the person or team closest to the business purpose should own the access decision, while IT administers it and security verifies it. For service accounts, the owner is usually the application or service owner, not the infrastructure team. For temporary contractors, the business sponsor should own the justification and end date. For regulated environments, Ultimate Guide to NHIs — Regulatory and Audit Perspectives is a useful reminder that clear ownership is also an audit question, not just an operational one. In small organisations, the model fails when ownership is assigned by convenience instead of by accountability, especially when a single admin account is shared across multiple business functions.

Related resources from NHI Mgmt Group

• Who should own identity governance in a small business?
• Who should own identity governance when Industry 4.0 links plant systems to enterprise applications?
• Why do small businesses need identity governance if they already use IAM tools?
• How should SMBs start implementing identity governance without overwhelming small teams?