Audit Your Access Control or Get Audited: The Case for Proactive Compliance

Imagine you are the CISO of a mid-sized fintech company. It's 2 AM, and you're jolted awake by a phone call: an auditor has found that a former employee's Active Directory account is still active, and they're asking for a full access review—by tomorrow. You scramble, but you know the truth: your team hasn't done a proper review in months. This scenario is all too common, and it's why I'm here to make a bold claim: If you're not continuously auditing your access control, you're not compliant—and you're one breach away from a regulatory nightmare.

Access control isn't just about setting permissions; it's about proving you've set them correctly. The core sequence of identification, authentication, and authorization (Tenable) is the foundation, but compliance demands evidence. And the only way to get evidence is to audit—constantly.

Compliance Is Not a Destination; It's a Continuous Audit

Many organizations treat compliance as a periodic event—a quarterly or annual scramble to check boxes. But regulators and frameworks like NIST SP 800-53 are clear: security controls must be continuously monitored. The principle of least privilege (Tenable) isn't a one-time configuration; it's a living state that requires ongoing verification. If you're not auditing, you're assuming your access control is correct—and assumptions are the enemy of compliance.

The Illusion of "Set and Forget" Access Control

I've seen it time and again: a company implements RBAC, assigns roles, and thinks the job is done. But the ANSI INCITS 359 RBAC standard (NIST RBAC) defines Core RBAC as the mandatory minimum—it's not a final state. Roles drift, users change roles, and permissions accumulate. Without regular audits, you're left with a tangled web of over-privileged accounts. The NIST RBAC standard even includes separation of duty requirements (NIST RBAC), which are impossible to enforce if you don't know who has what.

Why Your Next Audit Should Be Automated

Manual audits are error-prone and labor-intensive. I'm not saying you need to buy expensive tools, but you need to automate the collection of access data. For example, AWS IAM defaults to deny, and an explicit Deny overrides any Allow (AWS IAM). That's a great feature, but it's useless if you don't regularly pull IAM policies to see who has access to what. The same goes for your on-prem directories: LDAP directories are organized hierarchically (RFC 4511), and you can script queries to extract group memberships. Automate this, and you'll have a baseline for your audits.

The Cost of Ignoring Audits: A Real-World Scenario

Let's put numbers on this. NIST SP 800-63B sets Authenticator Assurance Level 2 (AAL2) as the recommended minimum for most systems handling personal, financial, or operational data (NIST SP 800-63B). That means you need MFA—two different factors (NIST SP 800-63B). Now, imagine a compliance audit of your cloud infrastructure. If you can't show that every privileged account has MFA enabled, you'll fail. Worse, if a breach occurs, you'll face regulatory fines and reputational damage. The cost of an audit failure far outweighs the cost of implementing continuous auditing.

Counterargument: "We Have SSO, So We're Fine"

Some might argue that single sign-on (SSO) solves access control compliance. After all, CISA recommends SSO because it reduces password fatigue and reuse (CISA SSO). But SSO is about authentication, not authorization. It gets you in the door, but it doesn't tell you what you can do once inside. OAuth 2.0, which powers many SSO flows, is an authorization framework—it doesn't authenticate the user (RFC 6749). OpenID Connect adds an ID token that proves authentication (OpenID Connect), but that's still not authorization. You need to audit what each user can do, not just that they can log in.

The Pragmatic Path: Audit as a Habit

Here's my recommendation: integrate auditing into your daily operations. Use the zero trust architecture as a guide—NIST SP 800-207 says that no implicit trust is granted to assets or accounts based on location (NIST SP 800-207). That means you should continuously verify every access request. Start by automating the collection of access data, then schedule regular reviews. Use RBAC as a baseline (Cisco Duo) and layer ABAC for context-aware decisions (Cisco Duo). And don't forget privileged accounts: NIST PAM guidance recommends credential vaulting, JIT access, and session monitoring (NIST PAM). These are not just best practices; they are audit requirements in many frameworks.

Quick tip: Set a recurring monthly calendar invite to review your access control reports. Treat it like a fire drill—do it even when nothing seems wrong.

The single most important thing to remember: Access control without audit is like a lock without a key—it gives the illusion of security but offers no protection. Start auditing today, or be prepared to face the consequences tomorrow.

Sources

• Tenable - https://www.tenable.com/cybersecurity-guide/learn/key-iam-components
• Cisco Duo - https://duo.com/learn/access-control-models
• NIST SP 800-207 - https://csrc.nist.gov/pubs/sp/800/207/final
• NIST SP 800-63B - https://pages.nist.gov/800-63-3/sp800-63b.html
• NIST PAM - https://www.nccoe.nist.gov/financial-services/privileged-account-management
• NIST RBAC (INCITS 359) - https://csrc.nist.gov/projects/role-based-access-control