What Is Identity Governance?
Identity governance manages user access throughout the employment lifecycle to prevent privilege creep and unauthorized access.
What Identity Governance Does
Identity governance platforms provide the operational infrastructure for joiner-mover-leaver lifecycle management: automating account provisioning when employees join, adjusting access when roles change, and revoking access when employees leave. They provide access request and approval workflows that create auditable records of access grants. They enable access reviews — periodic certification campaigns where managers confirm that each employee's access is appropriate for their current role. And they provide the reporting and dashboards that show compliance with access management policies.
Role-Based Access Control
RBAC organizes access grants by role rather than by individual: a financial analyst role has access to specific financial systems; a sales role has access to CRM and sales tools. When an employee moves from finance to sales, their access changes by changing their role assignment, rather than requiring individual access grants to be manually added and removed. RBAC makes access management scalable but requires ongoing maintenance to keep role definitions current with organizational structure.
Access Reviews: The Most Skipped Security Process
Access reviews — periodic campaigns where managers certify that each employee's access is still appropriate — are required by most compliance frameworks including SOC 2, ISO 27001, HIPAA, and PCI DSS. They are also among the most frequently skipped security processes in mid-market organizations, because they require manager time and operational coordination that is difficult to sustain consistently. Organizations that do not conduct access reviews accumulate privilege creep: employees who have changed roles retain previous access indefinitely, creating the over-privileged accounts that attackers target for lateral movement.
IGA for PE Portfolio Companies
Identity governance assessment should evaluate: Is there a defined joiner-mover-leaver process, and is it actually followed? How quickly are accounts terminated when employees leave? When was the last access review conducted, and what was its coverage? Are privileged accounts included in access review cycles? Is there an automated system for managing access requests and approvals, or are access changes managed through informal requests to IT? These questions reveal whether identity governance is a functioning security process or a compliance documentation exercise.
Related Reading
Frequently Asked Questions
What is the difference between IGA and IAM?
IAM (Identity and Access Management) is the broader discipline that includes authentication, authorization, and access enforcement. IGA (Identity Governance and Administration) is the specialized subset that focuses on lifecycle management, access reviews, segregation of duties, and policy compliance. IAM authenticates the user and enforces access; IGA governs whether that user should have the access in the first place and whether they should continue to have it as their role evolves. IGA platforms typically integrate with IAM infrastructure rather than replace it.
What is the joiner-mover-leaver process?
The joiner-mover-leaver (JML) process is the access lifecycle that governs how access is provisioned when an employee joins, modified when they change roles, and revoked when they leave. Joiner processes provision standard role-based access on day one. Mover processes adjust access when roles change — ideally removing previous access as new access is added rather than only adding. Leaver processes terminate all access on the employee's last day. In most mid-market organizations, joiner processes work reasonably well, mover processes are inconsistent, and leaver processes have systematic gaps that produce orphaned accounts.
How often should access reviews happen?
For standard user access: annually at minimum, ideally semi-annually. For privileged access and access to sensitive data: quarterly. For terminated employees and role changes: immediately as part of the leaver and mover processes (not waiting for the next periodic review). Most compliance frameworks (SOC 2, ISO 27001, HIPAA, PCI DSS) require access reviews at minimum annually; quarterly is the modern best practice for organizations with elevated security or compliance requirements.
What are the leading IGA platforms?
SailPoint IdentityIQ and IdentityNow lead the enterprise IGA category. Saviynt provides cloud-native IGA with strong cloud platform integration. Microsoft Entra ID Governance (formerly Azure AD Identity Governance) provides IGA capabilities integrated with Microsoft 365 environments. Omada and One Identity serve mid-market IGA needs. Selection depends on environment complexity, integration requirements, and existing identity infrastructure.
What is RBAC vs ABAC for governance?
Role-Based Access Control (RBAC) assigns access based on job roles and is the dominant access model in most organizations. RBAC is straightforward to govern: define roles, assign users to roles, review role membership. Attribute-Based Access Control (ABAC) makes access decisions based on multiple attributes (role, device, location, time, data sensitivity). ABAC enables fine-grained policies but is significantly harder to govern — the same user may have different access in different contexts, making access review and certification more complex.
Why do most organizations have over-privileged accounts?
Privilege accumulation through role changes is the structural cause. When an employee moves from finance to operations, they receive operations access but rarely have their finance access removed — the manager who approved the role change doesn't necessarily know what finance access existed, and the JML process doesn't systematically remove previous-role access. Over years and multiple role changes, the cumulative effect is accounts with broader access than any current role requires. Access reviews are designed to identify and remove this accumulation, but they require sustained operational discipline that most organizations don't maintain.
What is privilege creep?
Privilege creep is the gradual accumulation of access rights beyond what is currently needed, through role changes, project-based access grants that become permanent, and exceptions that are never reviewed. Over time, employees accumulate access that exceeds the principle of least privilege. Privilege creep is the primary reason that an estimated 40% of enterprise user accounts have access privileges beyond what their current role requires — making these over-privileged accounts the primary targets for post-compromise lateral movement and insider threat scenarios.
Real-World Example: Former Employee Access Enables Insider Incident
A Cloudskope client's identity governance assessment discovered 23 active user accounts belonging to employees who had left the organization over the prior 18 months. Three of these accounts still had access to production systems. One had been used for authentication 11 days after the employee's departure date — indicating either continued unauthorized access or credential sharing. The finding revealed a systematic offboarding process failure: accounts were being terminated from HR systems but not from IT systems, because the offboarding process relied on manual notification from HR to IT that was inconsistently executed.
Of enterprise user accounts have access privileges beyond what their current role requires, accumulated through privilege creep during role changes and organizational restructuring. These over-privileged accounts are the primary targets for post-compromise lateral movement.