BCN-T2-IAM-003Tier 2 · RegulatoryIdentity & Access Management

Ungoverned Service Accounts

Non-human identities without owners, documented purpose, or lifecycle management.

Remediation SLA: 30 days
Tier: 2 · Regulatory
Domain: Identity
Escalation: Security manager review at 14 days

What this finding is

Service accounts, workload identities, and machine credentials exist without a named owner, a documented purpose, or inclusion in any lifecycle process. They are typically excluded from access reviews because those processes are driven by HR events that non-human identities never generate.

Why it is Tier 2

Non-human identities outnumber human ones in most modern estates, frequently by an order of magnitude, and they hold correspondingly significant privilege. Their exclusion from governance is a control-design gap that assessors increasingly test explicitly. It is Tier 2 rather than Tier 1 because it describes the absence of governance rather than a specific exposure — a service account found to hold excessive privilege or a static privileged key is separately BCN-T1-IAM-002 or BCN-T1-IAM-003.

Most common misclassification

Individual over-privileged service accounts are often recorded here. Keep this finding scoped to governance absence and record specific excessive privilege separately, so remediation of one does not close the other.

How to detect it

1Enumerate all non-human identities across every identity provider and cloud account, then attempt to attribute each to a named owner — the unattributable remainder is the finding.
2Identify accounts with interactive sign-in capability, which service accounts should not have.
3Report last-used timestamps; dormant service accounts with live credentials are the highest-risk subset.
4Check whether service accounts are shared across applications, which makes rotation and revocation impossible without coordinated change.

How to remediate it

Steps are ordered. The first step is the one that reduces exposure fastest, which is not always the one that closes the finding.

1Build the inventory first with owner, purpose, and permission scope — governance cannot be applied to an unknown population.
2Assign an accountable owner to each, and decommission any identity for which no owner can be found after a defined notice period.
3Replace shared accounts with per-application identities so that rotation and revocation become possible.
4Migrate to platform-managed workload identity where supported, which removes the credential entirely.
5Include non-human identities in the access review cycle with an owner-attestation step.

How to verify the fix

Every active non-human identity maps to a named owner and documented purpose in the inventory, none retains interactive sign-in capability, and the population is covered by the current review campaign.