Account governance is the set of rules and controls that manage how user, admin, and service accounts are created, approved, used, reviewed, and removed. It covers identity proofing, role assignment, privilege limits, password and MFA policies, periodic access recertification, and deprovisioning when access is no longer needed. Good governance keeps account sprawl and unnecessary privileges under control.
In cyber security, account governance matters because accounts are a primary path into systems and data. Weak controls can lead to orphaned accounts, privilege creep, insider misuse, and account takeover. Defenders use governance to enforce least privilege, log account changes, review dormant or high-risk accounts, and block policy violations across applications and jurisdictions. Attackers often target the gaps: reused credentials, unreviewed admin access, stale accounts, or inconsistent approval workflows. Strong account governance makes it harder to abuse access and easier to prove that a platform is operating within its stated policy.