explainer · Identity & Cybersecurity
What identity governance is, in plain words
Identity governance sounds like something for large organisations with compliance teams. It is really a simple idea: decide who should have access to what, write it down as rules, and check regularly that reality still matches.
Why access drifts
Access is added easily and removed rarely. Someone needs a folder, a system or an approval, and it is granted. Nobody schedules the day it is taken away. Over a few years, people accumulate access that no longer matches their job.
This is not carelessness. It is what happens when the only trigger is a request, and there is no trigger for removal.
What governance adds
Governance puts three things around access so that it stops drifting.
- Rules: which roles should have which access, and who decides exceptions
- Owners: a named person who is accountable for each application and each set of permissions
- Reviews: a regular point at which owners confirm what is still needed, and anything else is removed
What it is not
It is not a product you buy and switch on, and it is not a once-a-year audit exercise. Tools can carry out the rules and collect the evidence, but the rules and the ownership are decisions the business has to make.
Where to start
Start with one application that holds sensitive information and one question: who can reach this today, and should they? Answering it honestly for a single system shows how the rest looks, and it produces the first rule you can write down.
Related service: Identity & Cybersecurity
Want to talk it through?
Tell us what you are dealing with, and we will start from there.