Many identity governance and administration (IGA) programmes pass their audits while leavers keep access for weeks, access reviews approve almost everything and service accounts are never reviewed at all. IGA maturity is not the number of applications onboarded to a platform; it is how reliably the right access is granted, changed and removed, and how well you can prove it. This model scores IGA maturity across eight dimensions on the five-level Ad hoc to Optimised scale used by the NHI Mgmt Group NHI Governance Maturity Model, with an IGA maturity assessment method, concrete self-assessment questions, a staged IGA roadmap and a mapping to NIST SP 800-53, CIS Controls v8.1, NIST CSF 2.0 and CISA's Zero Trust Maturity Model. It is for IAM and IGA programme owners, internal audit and CISOs. For maturity across the whole identity estate, including authentication and privileged access, use the Identity Security Maturity Model; this page covers identity governance only.
Key takeaways
- Score eight dimensions separately: identity data and authoritative sources, lifecycle automation, application coverage, access requests, roles and policies, access certification, segregation of duties, and non-human identity coverage.
- Leaver speed and revocation are the truest tests. A mature programme can show the time from HR termination to the last account disabled, and proof that access marked for removal in a review actually left the target system.
- Level 3 (Defined) is the right first target: HR-driven joiner, mover and leaver processes for in-scope applications, a request catalogue with owner approval, risk-based reviews with closed-loop removal and SoD rules for financial systems.
- Application coverage limits everything else. Disconnected and SaaS applications outside the IGA platform are where orphaned accounts and unreviewed access accumulate.
- NHI coverage separates Level 3 from Level 2. Service accounts, API keys, OAuth apps and AI agents need owners, reviews and decommissioning just as people do.
The five levels
| Level | Name | Description |
|---|---|---|
| 1 | Ad hoc | Access is created from emails and tickets and copied from a colleague. No link exists between accounts and an authoritative source, leavers are removed when someone remembers and reviews, if any, are spreadsheets sent to managers. |
| 2 | Developing | An HR feed creates and disables directory accounts and a few applications are provisioned automatically. Requests go through the service desk. Annual spreadsheet certifications cover audit-scoped applications and SoD conflicts are known informally. |
| 3 | Defined | An IGA platform runs HR-driven joiner, mover and leaver processes for in-scope applications. Users request access from a catalogue with owner approval, reviews are risk-based with closed-loop removal, SoD rules exist for financial and other high-risk systems, and non-human identities are inventoried with owners and included in reviews. |
| 4 | Managed | Most applications, including SaaS, are connected. Birthright roles come from role mining, mover events trigger targeted reviews, SoD is checked before access is granted, analytics flag outlier access and metrics are reported monthly. |
| 5 | Optimised | Governance is continuous and policy driven: access follows attributes and is removed automatically when they change, reviews are targeted by risk analytics, people, workloads and AI agents share one lifecycle model, and audit evidence is generated by the platform. |
The eight dimensions
Levels 2 and 4 sit between the descriptions shown; the roadmap below lists what moves you from each level to the next.
| Dimension | Level 1 Ad hoc | Level 3 Defined | Level 5 Optimised |
|---|---|---|---|
| Identity data and authoritative sources | Accounts not linked to any person record; contractors unknown | HR and a contractor register are authoritative; every in-scope account correlated to an identity or flagged as orphaned | All identity sources integrated; correlation continuous; attribute quality measured |
| Lifecycle automation (joiner, mover, leaver) | Manual tickets; leavers missed | Joiner and leaver automated for connected apps; movers lose old access after a defined overlap; disconnected apps handled by tracked tasks | Lifecycle events drive all provisioning and removal across every app, within minutes |
| Application coverage | No list of applications holding identities | Inventory of applications with owners; critical and regulated apps connected or governed by tracked fulfilment | Discovery finds new SaaS and cloud apps and brings them under governance automatically |
| Access requests and approvals | Email requests; access copied from a colleague | Request catalogue with business-readable entitlement descriptions; owner approval; time-bound access available | Policy decides most requests automatically; humans approve only exceptions and high risk |
| Roles and policies | No roles, or roles nobody maintains | Birthright access defined for main job families; role owners and review cycle (CIS Safeguard 6.8) | Roles and attribute policies maintained from usage analytics; unused access removed automatically |
| Access certification | Annual spreadsheets; no proof of removal | Risk-based reviews (quarterly for privileged and regulated access); revocations fulfilled and verified in the target system | Event-driven micro-reviews on mover, risk and usage signals; reviewer decisions supported by usage data |
| Segregation of duties | Conflicts unknown | SoD rule set for financial and other high-risk processes; detective checks with mitigating controls recorded | Preventive SoD at request time across applications; fine-grained, entitlement-level rules |
| Non-human identity coverage | Service accounts and API keys outside governance | Service accounts, OAuth apps and agents inventoried with owners and purpose; included in reviews; decommissioned on owner departure | NHIs and AI agents created, reviewed and retired through the same lifecycle as people, with short-lived credentials |
How to score an IGA maturity assessment
Score each dimension from 1 to 5 against the table, using evidence (reports, logs, samples) rather than policy statements. A dimension reaches a level only when every element of that level is true for the applications in scope. Record the evidence beside each score so the next assessment can be compared like for like. Your overall IGA maturity is the lowest score among the dimensions that protect your critical and regulated applications, not the average, because an attacker or auditor finds the weakest dimension first. The illustrative scorecard below shows a common pattern: strong certification on paper, weak leaver speed and almost no NHI coverage.
| Dimension | Score | Evidence |
|---|---|---|
| Identity data | 3 | HR and contractor feeds; 2% of accounts uncorrelated |
| Lifecycle automation | 2 | Median leaver removal 6 days in disconnected apps |
| Application coverage | 2 | 40 of 120 apps connected |
| Access requests | 3 | Catalogue live; 30% of entitlements lack descriptions |
| Access certification | 3 | Quarterly; 1% revoked; fulfilment verified |
| Non-human identity coverage | 1 | No owners recorded for service accounts |
This example is illustrative, not survey data. It scores Level 1 overall, and the fastest gain is NHI ownership and leaver automation for disconnected apps, not more review campaigns.
How this model relates to other frameworks
Microsoft frames identity governance around four questions, ending with "Can auditors verify that the controls are working effectively?", and the dimensions above are built to answer them with evidence. CISA's Zero Trust Maturity Model includes a Governance function in its Identity pillar. At the Initial stage the enterprise "defines and begins implementing identity policies for enterprise-wide enforcement with minimal automation and manual updates"; at Optimal it "implements and fully automates enterprise-wide identity policies for all users and entities across all systems with continuous enforcement and dynamic updates". NIST CSF 2.0 places IGA mainly under PR.AA-01 ("Identities and credentials for authorized users, services, and hardware are managed by the organization") and PR.AA-05 ("Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed"), and its Tiers (Partial, Risk Informed, Repeatable, Adaptive) describe governance rigour rather than control strength. As a rough guide, Level 1 resembles the ZTMM Traditional stage and CSF Tier 1, Level 2 the Initial stage and Tier 2, Levels 3 and 4 the Advanced stage and Tier 3, and Level 5 the Optimal stage and Tier 4; that alignment is NHI Mgmt Group's judgement, not an official crosswalk.
| Dimension | NIST SP 800-53 Rev. 5 | CIS Controls v8.1 | CISA ZTMM identity function |
|---|---|---|---|
| Identity data | AC-2 items a and d (account types, authorised users) | 5.1 inventory of accounts; 5.6 centralise account management | Identity Stores |
| Lifecycle automation | AC-2 items f, h and l; AC-2(1) Automated System Account Management; AC-2(3) Disable Accounts | 6.1 access granting; 6.2 access revoking; 5.3 disable dormant accounts | Automation and Orchestration |
| Application coverage | AC-2 item a | 6.6 inventory of authentication and authorisation systems; 6.7 centralise access control | Identity Stores |
| Access requests | AC-2 items c, e and i | 6.1 | Access Management |
| Roles and policies | AC-6 Least Privilege; AC-2(6) Dynamic Privilege Management | 6.8 role-based access control | Governance |
| Access certification | AC-2 item j; AC-6(7) Review of User Privileges | 5.1 (validate quarterly); 6.8 (review at least annually) | Governance |
| Segregation of duties | AC-5 Separation of Duties | No direct safeguard | Governance |
| NHI coverage | AC-2 item a; AC-2(4) Automated Audit Actions | 5.5 inventory of service accounts (owner, purpose, quarterly review) | Automation and Orchestration |
Two control details are worth quoting because auditors test them literally. NIST AC-2 asks organisations to "Align account management processes with personnel termination and transfer processes", and CIS Safeguard 5.3 sets a concrete threshold: "Delete or disable any dormant accounts after a period of 45 days of inactivity, where supported."
Self-assessment questions
- Identity data: in your 20 most critical applications, how many active accounts do not correlate to a current employee, contractor or owned non-human identity?
- Leavers: what was the median and the longest time from HR termination date to the last account disabled, for connected and for disconnected applications, over the last quarter?
- Movers: how many people who changed role more than 90 days ago still hold access from their previous role?
- Coverage: how many applications hold identities, and how many are connected for automated provisioning and removal?
- Requests: what percentage of requestable entitlements have a description a business approver can understand?
- Certification: in the last campaign, what percentage of items were revoked, and what percentage of those removals were verified in the target system?
- Reviewer quality: how many reviewers approved every item in their campaign, and what was the median time spent per decision?
- SoD: how many SoD violations are open today, and how many lack an approved mitigating control?
- Non-human identities: what percentage of service accounts, API keys, OAuth apps and AI agents have a named owner, and were they in the last review?
- Audit: how long would it take to show an auditor who approved one user's access to the finance system and when it was last reviewed?
Moving up a level
Scale changes the route. A smaller organisation with one directory and mostly SaaS can reach Level 3 with the governance features of its identity provider (lifecycle workflows, access packages, access reviews) and SCIM provisioning. A large or regulated organisation with many on-premises and custom applications will need a dedicated IGA platform, a connector strategy and a fulfilment process for disconnected apps. Either way, phase rollouts by application tier and run every new automated removal in report-only mode first.
From Ad hoc to Developing
- Make HR and a contractor register the authoritative sources and connect them to the directory so joiners and leavers flow automatically. See the Joiner-Mover-Leaver Guide.
- List the applications that hold identities, with owners, and rank them by risk.
- Run a first certification of privileged and audit-scoped access and record every removal. See the Access Reviews Guide.
From Developing to Defined
- Select and deploy an IGA capability against written requirements. See the IGA Buyer's Guide.
- Connect critical and regulated applications first, starting with leaver removal in report-only mode, then enforcing once the report matches HR records for two cycles. Keep manual removal tasks as the rollback.
- Launch a request catalogue with owner approval and time-bound options; retire email requests.
- Move to risk-based certification with closed-loop removal and verify each revocation in the target system.
- Define SoD rules for financial and other high-risk processes. See the Segregation of Duties Guide.
- Inventory service accounts, OAuth apps and agents with owners and add them to reviews. See the NHI Ownership Guide.
From Defined to Managed
- Connect most remaining applications, including SaaS, through SCIM or connectors.
- Mine roles from current access, pilot birthright roles with one department and compare grants against the old manual process before expanding. See the Role Mining and Role Design Guide.
- Trigger targeted reviews on mover events instead of waiting for the next campaign.
- Check SoD before access is granted and report violations and exceptions monthly.
From Managed to Optimised
- Drive access from attributes and policies so that it changes automatically when attributes change.
- Use usage and peer-group analytics to target reviews and remove unused access automatically.
- Bring AI agents and workloads into the same lifecycle model. See the Identity Governance for AI Agents Guide.
- Generate audit evidence from the platform rather than by hand.
Metrics that show maturity
- Orphaned accounts: active accounts in critical apps with no current owner (target zero).
- Leaver removal time: median and maximum hours from HR termination to last account disabled.
- Application coverage: percentage of identity-holding applications connected or under tracked fulfilment.
- Verified revocation rate: percentage of review revocations confirmed removed in the target system within the agreed period.
- Open SoD violations: violations without an approved mitigating control.
- NHI ownership: percentage of non-human identities with a named, current owner.
See the Identity Security Metrics Guide for reporting.
Common failure patterns
- Rubber-stamp reviews: managers approve everything because entitlements are unreadable and campaigns are too large. Fix the descriptions and target the reviews before adding more campaigns.
- Revocation without fulfilment: the review marks access for removal but nobody removes it in a disconnected application, so the report and reality differ.
- Dormant and forgotten accounts: in the Colonial Pipeline ransomware attack, a single unused VPN account was enough. Dormant account detection is an IGA control, not just a directory clean-up.
- Movers who accumulate: new access is added on every role change and old access is never removed, so long-serving staff hold the most.
- Role explosion: roles are created for every exception until there are more roles than people, and nobody owns them.
- Humans only: service accounts and OAuth apps are excluded from governance because they have no manager to review them.
Practitioner checklist
- Set Level 3 as the 12-month target for critical and regulated applications.
- Measure leaver removal time across connected and disconnected apps before buying more tooling.
- Verify every review revocation in the target system.
- Give every non-human identity an owner and include it in reviews.
- Write entitlement descriptions business approvers can understand.
- Define SoD rules for financial processes and record mitigating controls.
- Reassess every 12 months, using the same evidence so results are comparable.
Standards and references
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
- NIST: The NIST Cybersecurity Framework (CSF) 2.0
- Microsoft: CISA Zero Trust Maturity Model, Identity pillar
- CIS: Controls Assessment Specification, Control 5 Account Management
- CIS: Controls Assessment Specification, Control 6 Access Control Management
- Microsoft: Microsoft Entra ID Governance overview
Related NHI Mgmt Group resources: Identity Security Maturity Model · IAM and IGA Basics · Access Reviews Guide · Joiner-Mover-Leaver Guide · NHI Governance Maturity Model