Technology
Most teams take 5–8 days to grant access. World-class teams: 1–2.
The gap between slow access provisioning and fast isn't automation magic—it's governance discipline. Here's what separates organizations that verify identity correctly from those that create compliance disasters while trying to move fast.
Access request resolution time depends on whether identity governance is centralized or fragmented across systems, whether access templates are pre-built or custom-created per request, and whether provisioning workflows are automated end-to-end or require manual handoffs. Organizations achieving 1–2 day resolution have integrated their identity platform with resource systems, established role-based access templates, and automated the verification workflow. Most organizations operating at 5–8 days are managing access through disconnected ticketing, email approval chains, and manual system provisioning.
What good looks like
| Metric | Minimum | Strong | World-class |
|---|---|---|---|
| Access Request Resolution TimeAverage calendar days required to provision, modify, or revoke user access from initial request submission to completion and verification. | 5-8 | 2-4 | 1-2 |
| Privileged Access Review Completion RatePercentage of scheduled privileged account reviews (admin, service accounts, elevated permissions) completed on or before their scheduled certification date within a fiscal period. | 65-75 | 85-93 | 96-99 |
| Unprovisioned Access Violation RatePercentage of active user identities with resource access permissions that lack documented approval or have expired authorization records relative to total access grants. | 8-15 | 2-6 | 0.5-1.5 |
| Identity Lifecycle Onboarding-to-Productive-Access DurationMedian number of business days from new hire system record creation to provision of all primary role-required system and application access. | 7-12 | 3-5 | 1-2 |
| Orphaned and Stale Account Remediation CyclePercentage of dormant or unowned accounts (inactive >90 days or missing business owner) identified and disabled or remediated within 30 days of detection. | 50-65 | 80-90 | 94-99 |
The performance spread reveals where governance breaks. Access request resolution time (1–2 days vs. 5–8) reflects workflow automation and system integration depth. Privileged access review completion (96–99% vs. 65–75%) shows the difference between enforced governance discipline and voluntary compliance. Unprovisioned access violations (0.5–1.5% vs. 8–15%) indicate whether continuous validation controls exist or rely on periodic reviews. Onboarding duration (1–2 days vs. 7–12) depends on HR-IT integration and pre-built identity staging. Orphaned account remediation (94–99% vs. 50–65%) separates organizations with automated dormancy detection from those managing cleanup manually. The gap between tiers is not marginal—it reflects whether access governance is a designed system or a reactive process.
Industry-Specific Benchmarks
These ranges are cross-industry. The figures differ materially by sector and company size.
Find benchmarks for your industry →Why the gap exists
World-class teams treat access governance as a connected system, not a collection of isolated tasks. They pre-stage identities before hire, route requests through automated workflows that check role eligibility and resource availability in real time, and provision across multiple systems in parallel rather than sequentially. Crucially, they build verification into the request itself—risk signals like unusual location, time, or access pattern trigger additional authentication layers automatically, not as a separate review step weeks later. The provisioning decision happens fast because the governance decision was already embedded in the request design.
Middle-tier organizations have some of these pieces. They may have role templates and automated provisioning to their primary systems, but cloud applications, legacy systems, or departmental tools fall outside the workflow. They complete privileged access reviews, but the process is annual or semi-annual rather than continuous, so unprovisioned violations accumulate between review cycles. They onboard new hires, but identity creation happens in sequence—HR system, then directory, then application access—rather than in parallel. The operational cost is visible: more staff hours spent on manual approvals, more time spent on remediation when violations are discovered, more audit friction when reviewers cannot explain why a specific person has access to a specific system.
Smaller organizations often have an advantage here because their access matrix is simpler and their staff closer to identity decisions. A 200-person firm can maintain access discipline through documented role definitions and a single approval chain more easily than a 40,000-person organization can through email. However, size alone does not guarantee performance—the difference is whether governance rules are written down and enforced consistently, or whether access decisions depend on who asks and who approves.
What leading organizations do
Identity and Access Management Governance: Build the System, Not Just the Tools
Identity governance is not a software product you install; it is a decision framework you embed into every access request. The mechanism is simple: define who should have access to what (role definitions), establish who can approve access requests (approval rules), document what triggers a review (change events, time-based recertification, risk signals), and create a workflow that routes requests through these gates automatically. When this framework is centralized—meaning a single system of record holds role definitions, approval authorities, and access logs—every person in the organization sees the same ruleset, and every access decision produces an audit trail.
What changes when an organization builds this is visibility and speed simultaneously. A new hire in an organization with mature governance receives their identity and initial application access within 1–2 days because role definitions are pre-built, systems are connected, and approvals route to the right person automatically. The same hire in an organization without governance governance takes 7–12 days because someone manually determines which applications they need, submits requests to different system owners, and waits for separate approvals. Equally important: world-class organizations catch orphaned accounts, stale credentials, and privilege creep because their governance framework includes continuous validation—a dormant account triggers a review, a permission that no longer matches the role triggers a remediation workflow, an access request from a user whose peer group has never needed that access triggers additional scrutiny. Middle-tier organizations discover these problems during annual audits, months after they became risks.
The roadmap for implementing identity governance runs in three phases: first, document role definitions and approval authorities for your highest-risk systems; second, integrate your identity platform with those systems so provisioning is automated; third, extend the framework to lower-risk systems and build continuous validation into your monitoring. Most organizations can execute phase one in weeks, though the ongoing discipline of keeping role definitions current requires dedicated ownership.
Leading Practice Report
Full detail: Identity and Access Management Governance
The full report covers:
- Expected benefits
- Core principles
- Key success factors
- Key metrics
- Risks and mitigations
- Implementation roadmap
Zero Trust Architecture: Replace 'Who You Are' With 'Prove It Every Time'
Zero Trust Architecture removes the assumption that being on the corporate network or having valid credentials makes you trustworthy. Instead, every access request—whether from an employee at their desk, a contractor on public WiFi, or a system calling another system—must prove identity, device health, and intent before permission is granted. The verification happens in real time, using contextual signals: where is the request coming from, what device is it using, does the behavior match historical patterns, what is the actual request trying to do. If any signal is weak, access is denied or additional authentication is required. This model sounds resource-intensive, and it is in organizations that implement it poorly. It becomes efficient when the verification logic is automated and runs in parallel with the request, not as a separate step that adds delay.
What Zero Trust prevents is lateral movement after initial compromise. In a traditional network, once an attacker has valid credentials, they move freely across systems. In Zero Trust, every system enforces its own verification. An attacker who steals a user's password can authenticate as that user, but if they then try to access a resource the user never accesses from that location, the system challenges them again. The compromise is detected and contained faster, and breach dwell time drops significantly. The second benefit is simpler compliance audits: because every access decision is verified and logged in real time, auditors see proof of continuous access control rather than relying on periodic reviews of who has access.
Zero Trust requires investment in identity infrastructure—the ability to authenticate users and devices quickly across all systems—and continuous monitoring to generate the signals that drive access decisions. It is not cheaper than traditional network security in the short term. Organizations with hybrid workforces and significant cloud footprints benefit most because they have the most dispersed access patterns and the fewest assumptions about which requests are legitimate based on location alone. Even in smaller organizations, Zero Trust principles reduce insider threat risk and simplify the task of revoking access quickly when someone leaves.
Leading Practice Report
Full detail: Zero Trust Architecture
Benefits, core principles, success factors, metrics, risks and the implementation roadmap.
Get the full report →Industry context
Access governance maturity varies significantly by regulatory environment and data sensitivity, not by industry sector. Heavily regulated organizations—financial services, healthcare, public sector—face mandated access reviews and audit requirements that push them toward faster governance cycles and lower violation rates. Their benchmarks tend to cluster in the strong-to-world-class range because non-compliance carries legal and financial penalties. Lightly regulated sectors have weaker external pressure, so access governance maturity depends more on internal risk appetite and the organization's history with security incidents.
Organizations with distributed access—multiple cloud platforms, SaaS applications, on-premises legacy systems—face the hardest governance problems because no single identity system controls all resources. A user may authenticate to Azure Active Directory but need access to Salesforce, Okta, AWS, and three on-premises databases. If provisioning workflows are not automated across all platforms, access requests fall into manual exception handling, and the review process becomes so cumbersome that governance discipline erodes. Smaller organizations with fewer systems find governance easier to maintain; larger organizations with dozens of identity systems and resource platforms need more sophisticated automation to achieve the same completion rates.
Remote and hybrid workforces also shift the governance equation. In an all-office environment, an access request from someone at their desk is lower-risk than one from an unfamiliar IP address. Zero Trust eliminates that distinction, requiring verification regardless of location. Organizations with strictly office-based work can operate with less rigorous continuous verification and still maintain security; organizations with distributed workforces need it to avoid false-positive friction that causes users to circumvent the access system.
Where to start
- Document your current role definitions for your 3–5 highest-risk systems (those holding sensitive data or controlling critical infrastructure). Write down who should have access, why, and who approves. If you cannot document this in a day, you have found your first governance gap.
- Map your provisioning workflow for a new hire: how long does each step take (identity creation, application access, resource provisioning), who approves each step, and which steps could run in parallel. Identify the longest serial chain—that is where your speed problem lives.
- Identify which systems or applications fall outside your centralized identity governance. Legacy systems, departmental tools, and SaaS applications often manage their own user lists. Count how many separate access requests or approvals a typical user experiences across all systems—that is the manual overhead you cannot eliminate until access governance is integrated.
Ask Kepler how to design an access governance roadmap specific to your system landscape and regulatory environment.
Start free with Ask Kepler →Advanced and emerging approaches
Advanced & Emerging Practices
Emerging practices are included with Ask Kepler Pro and Max.
Unlock these practices →