M&A identity cleanup

Expanded Definition

M&A identity cleanup is the post-transaction work of reconciling who and what can access systems after a merger or acquisition. It covers human identities, service accounts, API keys, certificates, group memberships, and policy exceptions that often arrive from two or more security models at once. The goal is not merely account de-duplication; it is to remove inherited privilege, collapse overlapping roles, and normalise control baselines before the new organisation inherits a larger attack surface.

In practice, this term sits at the intersection of identity governance, privileged access management, and NHI lifecycle control. Guidance varies across vendors, but the operational pattern is consistent: discover all identities, map business ownership, validate necessity, and retire access that no longer supports an active function. That work is closely aligned with the control intent in the NIST Cybersecurity Framework 2.0, especially where access governance and asset visibility must be re-established after organisational change. The most common misapplication is treating M&A cleanup as a one-time IT migration task, which occurs when teams merge directories without revalidating inherited entitlements against current business need.

Examples and Use Cases

Implementing M&A identity cleanup rigorously often introduces short-term disruption, requiring organisations to weigh speed of integration against the cost of preserving unsafe access paths.

• Two acquired companies both use a finance application, but each has different admin groups and emergency access rules. Cleanup removes duplicate admins and consolidates approvals under one policy baseline.
• A newly acquired SaaS environment contains dormant service accounts and legacy API keys. Cleanup identifies ownership, rotates or revokes secrets, and closes access that no longer maps to an active workload, a pattern echoed in the Ultimate Guide to NHIs.
• During directory federation, role names match but underlying entitlements do not. Cleanup prevents a false sense of equivalence by rechecking permissions against the actual systems in scope, rather than relying on label matching alone.
• An acquired engineering team has CI/CD tokens stored outside a secrets manager. Cleanup requires inventory, ownership validation, and removal of embedded credentials before the combined estate normalises around one control model, consistent with Top 10 NHI Issues.
• Access exceptions granted for the deal close period linger for months. Cleanup converts temporary exceptions into tracked, time-bound decisions or removes them once integration stabilises.

Where identity and secret sprawl are involved, the cleanup effort often needs to follow the same visibility and offboarding discipline described in NHI governance literature and in the NIST Cybersecurity Framework 2.0, rather than ad hoc ticket closure.

Why It Matters in NHI Security

M&A identity cleanup matters because acquisitions rarely inherit just people. They inherit stale service accounts, duplicated certificates, overbroad roles, and exceptions that were acceptable in a smaller trust boundary but become dangerous when exposed to a larger one. NHIMG data shows that 97% of NHIs carry excessive privileges and that only 20% of organisations have formal processes for offboarding and revoking API keys, which makes post-deal rationalisation a high-value control point. The problem is especially severe when inherited access is invisible, since only 5.7% of organisations report full visibility into their service accounts.

This is where NHI governance becomes operational, not theoretical. If the combined enterprise fails to clean up identities early, old privileges survive under a new brand, and compromise paths multiply across shared infrastructure, partner links, and automation pipelines. The risk is not limited to users; secrets left behind in code, config, or CI/CD systems can persist long after the transaction closes, as illustrated by incidents documented in the 52 NHI Breaches Analysis and the Cisco DevHub NHI breach. Organisations typically encounter the consequences only after an integration audit, credential leak, or post-merger incident review, at which point M&A identity cleanup becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Non-Human Identity Access Management
• Overprivileged Identity
• What is the difference between local account cleanup and full identity governance?
• What is the difference between secrets rotation and identity posture cleanup after a compromise?