5 pitfalls: identity and access management (NIS2 Guide)
Part 2 of our NIS2 and cybersecurity law guide: Common pitfalls in identity and access management, and what it takes to overcome them.
Identity and access management is central to your entire IT environment – and a core requirement under cybersecurity regulations. It determines who can access which systems and what information they can reach. When management isn't systematic, risks emerge that often go unnoticed day-to-day but quickly become critical when something goes wrong.
Here are five common pitfalls in identity and access management, and what it takes to overcome them.
1. Too many permissions – for too many people
Challenge:
Permissions are often granted generously so people can "work efficiently". Over time, access accumulates. Users gain rights to systems they rarely use or no longer work with. The result is an environment where it's difficult to know who actually has access to what – and why.
Response:
Apply the principle of least privilege. Grant access based on actual role and need, and review regularly. Permissions shouldn't be permanent by default, but adjustable as roles change.
Here's everything in one shareable PDF.
2. Unclear ownership of identities and accounts
Challenge:
When responsibility is unclear, nothing happens. IT manages the technology, HR manages employment, managers oversee operations – but no one takes full ownership of the identity as a whole. This means decisions about access, changes, and deprovisioning are delayed or never made.
Response:
Make ownership explicit. Who is responsible for keeping an identity accurate over time? Who approves permissions? Who removes access when something changes? When responsibility and authority are clear, both risk and friction decrease.
3. Accounts that outlive the relationship
Challenge:
When employees change roles, consultants finish assignments, or partnerships end, permissions don't always follow. Accounts and access remain – sometimes out of habit, sometimes from fear that something will stop working.
Response:
Tie identities and permissions to lifecycles. When the relationship to the organization changes, access should change too. Deprovisioning needs to be as routine as provisioning.
4. Protections exist but aren't used consistently
Challenge:
Multi-factor authentication and other protections are often available but not used everywhere. Exceptions are made for certain systems, user groups, or legacy platforms. This creates a false sense of security, while attackers typically find exactly those weak links.
Response:
Aim for consistency. Protections should apply broadly and be monitored over time. Exceptions need to be deliberate, justified, and documented – not just left in place.
5. Identity is seen as technology, not governance
Challenge:
Identity and access management is often treated as a technical issue. But fundamentally, it's about decisions, responsibility, and risk. When identity is left to IT without clear business ownership, both prioritization and buy-in are often missing.
Response:
Elevate identity to a governance issue. When leadership and business units are involved, it becomes clearer what matters, what constitutes acceptable risk, and how work should be monitored. Only then can identity become real protection, not just a technical implementation.
Control, not perfection
Identity and access management isn't about perfection – it's about control. When responsibility, lifecycles, and processes align, the risk of breaches decreases and the organization is better prepared when something happens.