Identity governance and administration (IGA) is the practice of deciding who should have which accounts and permissions, granting them through an approved process, removing them when they no longer apply, and keeping evidence of each step. It joins account administration with oversight, so access is both provisioned and reviewable.
Is IGA a standard?
IGA is an industry term, not a named NIST framework. The ideas, though, are written into NIST SP 800-53 Rev. 5, the control catalog many compliance programs draw on. Three controls carry most of the weight: AC-2 Account Management, AC-5 Separation of Duties and AC-6 Least Privilege.
Seeing the controls is more useful than a product category description, because an auditor asks for evidence against them, whatever tool you run.
What does the account lifecycle require?
AC-2 reads like a checklist for the whole lifecycle. It asks you to define the types of accounts allowed and prohibited, assign account managers, require approvals for requests to create accounts, and create, enable, modify, disable and remove accounts according to a defined process. It also asks you to monitor account use and to notify account managers when accounts are no longer required, when users are terminated or transferred, and when usage or need-to-know changes.
The enhancements push further. AC-2(3) calls for disabling accounts that have expired, no longer belong to a user, violate policy or have been inactive past a set period. AC-2(4) calls for automatically auditing account creation, modification, enabling, disabling and removal.
That gives four phases to plan around: joiner (create with approval), mover (change access when roles change), leaver (disable and remove promptly), and periodic review.
What do separation of duties and least privilege add?
AC-5 asks you to identify and document the duties that must be separated, and to define access authorizations that support the separation. A familiar case: the person who requests a payment should not also approve it.
AC-6 states the principle of least privilege: allow only authorized accesses necessary to accomplish assigned tasks. In an IGA setting, this is what an access review checks. A reviewer asks "does this person still need this?" and removes anything that fails.
Where does it go wrong?
A constructed example shows the usual gap. An engineer moves from the payments team to the platform team. The new role's access is added on day one. Nobody removes the old payments database role, because no workflow connects "transfer" to "revoke."
Six months later a quarterly review lists the engineer with both. The reviewing manager approves everything on the page because it is long and the names look familiar. The access remains. The control exists on paper, and the evidence looks fine, but least privilege is not met.
Non-human accounts make it worse. Service accounts and API keys have no leaver event, so they accumulate. AC-2 applies to them too: someone must be the named account manager.
How to check or apply this
- Inventory every system that holds accounts, including SaaS tools, cloud consoles, databases and CI systems.
- For each, record the account types, who approves new accounts and who owns removal.
- Connect HR events (hire, transfer, termination) to access changes, so moves trigger revocation, not just grants.
- List separation-of-duties pairs, such as request and approve, and check no single account holds both.
- Run an access review on your most sensitive system. Give reviewers a short list, show last-used dates, and require a reason to keep access.
- Set an inactivity limit and disable accounts that pass it, then check the audit trail shows who did it and when.
- Assign a named owner to every service account and key, and review them on a schedule.
Quick check
Is IGA the same as single sign-on?
No. Single sign-on controls how users authenticate to applications. IGA controls which accounts and permissions exist and whether they are still justified. They complement each other.
Which NIST controls map most directly to IGA?
AC-2 Account Management, AC-5 Separation of Duties and AC-6 Least Privilege in SP 800-53 Rev. 5, with the AC-2 enhancements on disabling accounts and automated auditing of account actions.
Sources
Last reviewed: 18 October 2026.
