Who should participate in strategic identity discussions with peers?

Why This Matters for Security Teams

Strategic identity discussions shape how organisations allocate trust, approve access, and measure control effectiveness across both human and non-human identities. When the wrong people are absent, roadmap decisions tend to skew toward tool administration instead of risk reduction. That gap matters because identity failures are rarely isolated. NHIMG’s Ultimate Guide to NHIs notes that 97% of NHIs carry excessive privileges, which makes identity governance a board-relevant issue, not a narrow ops task.

Peer discussions are most useful when they include the people who own policy, architecture, and assurance outcomes. IAM practitioners see lifecycle problems, identity architects understand integration constraints, CISOs set risk appetite, and compliance and risk leads translate identity decisions into audit and control language. That mix is especially important when organisations are trying to align identity practice with NIST SP 800-53 Rev 5 Security and Privacy Controls and real-world breach lessons from 52 NHI Breaches Analysis. In practice, many security teams discover that the business impact of identity gaps only becomes visible after privilege creep or secret sprawl has already affected production systems.

How It Works in Practice

The best strategic identity conversations are cross-functional by design. Start with the people accountable for the outcome, then add the operators who can explain current-state friction and the stakeholders who can approve change. In a mature session, IAM owns the lifecycle view, architecture describes integration patterns, security leadership frames risk, and compliance confirms what evidence is required. That keeps the discussion focused on decisions rather than status updates.

A practical agenda usually covers four questions: what identities exist, who can approve them, how access is reviewed, and what breaks when the organisation changes platforms or adopts new agentic workflows. For NHI-heavy environments, the conversation should also include secrets handling, rotation, and offboarding, because poor visibility and weak revocation remain common failure modes. NHIMG’s Top 10 NHI Issues is useful here because it frames the operational risks that most teams underestimate.

• Include IAM practitioners to describe current controls and exceptions.
• Include identity architects to test whether the target model is technically viable.
• Include CISOs or security leaders to decide acceptable risk and priority.
• Include compliance and risk leads to connect identity decisions to audit evidence and policy.

For identity programmes that touch cloud, CI/CD, or autonomous systems, it also helps to anchor discussion in NIST SP 800-53 Rev 5 Security and Privacy Controls so control owners can map proposals to actual safeguard requirements. These discussions tend to break down when the meeting includes tool owners but excludes the people who can approve policy changes, because the team leaves with implementation notes instead of a decision.

Common Variations and Edge Cases

Tighter identity governance often increases meeting overhead, requiring organisations to balance decision quality against speed. That tradeoff is real, especially when peers span infrastructure, application, cloud, and GRC teams. The current guidance suggests keeping the core strategic group small, then inviting subject matter experts only when a specific identity domain is under review.

One common edge case is a highly decentralised organisation where product teams own much of the identity surface. In that model, the strategic conversation should still be led by accountable security and identity owners, but product and platform leaders must be present when their services issue, consume, or broker credentials. Another edge case is M&A or rapid cloud migration, where the discussion may need temporary participation from incident response and enterprise architecture because identity risk is changing faster than the steady-state operating model.

There is no universal standard for who should attend every identity forum, but best practice is evolving toward decision-makers plus evidence owners, not large standing committees. That principle applies equally to NHI-heavy environments, where secret sprawl and revocation gaps can be severe. NHIMG’s Ultimate Guide to NHIs remains a strong reference for the broader lifecycle context, while 52 NHI Breaches Analysis is a reminder that identity discussions only matter if they translate into measurable control change.

Related resources from NHI Mgmt Group

• How should security leaders prepare for AI-driven defence discussions without losing focus on core identity risks?
• When does a machine identity become a compliance problem?
• Why is it important to integrate identity and data governance?
• When does secret exposure become a broader identity risk?