Most organizations do not lack security policies. They have access-control standards, configuration baselines, vulnerability-management processes, and requirements for protecting sensitive systems.

The more difficult challenge is ensuring those policies are applied consistently across cloud platforms, applications, user accounts, network devices, and infrastructure-management systems.

Three reports published in September 2026 illustrate the consequences when policy and implementation diverge. Although the reports cover different environments, they point to the same underlying risk: a control that exists on paper but is not uniformly enforced cannot provide reliable protection.

Cloud-security guidance does not guarantee adoption

A Department of Homeland Security inspector general report examined federal agencies’ implementation of the Cybersecurity and Infrastructure Security Agency’s cloud-security configuration baselines. According to Federal News Network, 86% of agencies had not implemented all mandatory Secure Cloud Business Applications policies by the June 2025 deadline. (federalnewsnetwork.com)

The finding is notable because the problem was not a lack of guidance. CISA had developed configuration baselines and assessment tools for widely used cloud products, conducted more than 80 engagements involving over 1,000 participants, and made its assessment tools broadly available. The central limitation was that CISA could issue directives and support implementation but lacked the authority to compel full and timely compliance.

This is an important point for any organization operating across multiple business units or technical environments. Publishing a baseline establishes expectations, but it does not confirm that the required settings have been implemented, that exceptions have been approved, or that configurations have remained compliant over time.

Without clear accountability and technical enforcement, even mandatory requirements can become optional in practice.

Access controls can fail at several points in the identity lifecycle

A separate DHS inspector general audit found that U.S. Customs and Border Protection did not consistently apply IT access controls. The audit identified several weaknesses that could have enabled unauthorized access to sensitive information or disruption of critical operations. (oversight.gov)

Among the findings, all 76,000 CBP network users incorrectly had access to a highly privileged service account. The audit also found that CBP could not identify all privileged accounts or confirm that those accounts were reviewed periodically.

The inconsistency extended beyond privileged access. In the samples reviewed, 20% of former employee accounts and 15% of former contractor accounts were not disabled within required timeframes. In addition, 17% of employees who transferred to new positions retained access they no longer needed.

These findings demonstrate that identity security is not limited to authentication. It depends on consistent controls throughout the user lifecycle, including account creation, privilege assignment, role changes, periodic access reviews, and timely removal.

An organization may have appropriate access policies while still carrying significant exposure if individual applications are not integrated with central identity systems, account inventories are incomplete, or access-removal processes depend on inconsistent manual actions.

Infrastructure management systems may exacerbate the problem

A third report shifts the focus from users and cloud configurations to the systems used to manage enterprise infrastructure.

BleepingComputer reported that the September edition of the InfraTrust Pulse tracked 158 security advisories covering 1,699 vulnerabilities across 17 vendors. Of those advisories, 42 were rated critical, 71 included vulnerabilities that could be exploited remotely without authentication, and five included vulnerabilities that were later added to CISA’s Known Exploited Vulnerabilities catalog. (bleepingcomputer.com)

A significant concern was the concentration of serious vulnerabilities in administrative platforms. These systems configure network devices, hold credentials, and provide centralized paths for making changes across infrastructure. Compromising one management platform can therefore provide an attacker with broader reach than compromising an individual device.

The report also highlighted the operational complexity of infrastructure security. One Linux kernel vulnerability appeared across 19 advisories from six vendors, creating multiple remediation activities with different product guidance and vendor schedules.

In this environment, a general requirement to “patch critical vulnerabilities” is insufficient. Organizations need consistent asset discovery, risk-based prioritization, defined remediation deadlines, compensating controls, and verification that fixes have actually been deployed across every affected system.

The common issue is a gap between policy and enforcement

Taken together, these reports show how inconsistent controls can emerge across several layers:

• Cloud platforms may not conform to approved configuration baselines.
• Privileged access may be broader than policy permits.
• Departed or transferred personnel may retain unnecessary access.
• Administrative platforms may not receive the additional protection their role requires.
• Vulnerabilities may be addressed differently across vendors, products, and operating teams.
• Central security functions may provide guidance without having sufficient authority to enforce it.

The connected risk-management challenge is therefore not simply creating better policies. It is building a system in which common requirements are translated into enforceable controls, monitored continuously, and supported by evidence.

Moving from documented policy to consistent control

Organizations seeking to reduce this gap can focus on several practical measures.

1. Establish a common control baseline

Security requirements should be defined at the enterprise level and mapped to cloud services, applications, identities, endpoints, network devices, and management platforms. Where implementation must differ, the variation should be documented rather than allowed to develop informally.

2. Automate enforcement where possible

Cloud-policy engines, identity-governance tools, infrastructure-as-code checks, configuration-management platforms, and endpoint controls can reduce reliance on manual interpretation. Automation does not eliminate the need for oversight, but it can make the approved configuration the default configuration.

3. Treat privileged systems as a separate risk tier

Administrative accounts and infrastructure-management platforms require stronger protections because they can provide access to many other systems. Controls should include restricted connectivity, multifactor authentication, credential isolation, activity monitoring, rapid patching, and tested recovery procedures.

4. Monitor the complete identity lifecycle

Access controls should account for new employees, contractors, role changes, transfers, temporary privileges, inactive accounts, and separations. Reconciliation between human-resources records, contractor systems, identity platforms, and application accounts can identify access that should have been changed or removed.

5. Measure implementation rather than publication

A policy’s existence is not a meaningful measure of security performance. More useful indicators include baseline-compliance rates, overdue remediation items, privileged-account coverage, access-removal times, exception age, and the percentage of systems reporting current control evidence.

6. Define accountability and escalation

Every control needs an owner, an implementation deadline, and a process for addressing noncompliance. Exceptions should identify the associated risk, required compensating controls, approving authority, and expiration date.

Consistency is a risk-management capability

Standardizing and enforcing controls across all environments does not mean every system must be managed identically. It means every system is governed by a common risk framework, with deviations made deliberately and transparently.

SCG helps organizations examine the gap between security requirements and operational implementation, then establish the governance, processes, and enforcement mechanisms needed to make controls more consistent.

The objective is to ensure that security expectations remain effective wherever the organization’s systems, identities, data, and infrastructure operate.