vaultKEY
Unlocking the essential IAM news that matters.
The regulatory changes that actually reach identity, read for what they mean for access. Written to be implemented, not skimmed — and stamped with review dates rather than publish dates, because this material ages by amendment rather than by calendar.
FinTech & Banking
The FFIEC Retired the CAT. What Community Banks Should Map Identity Controls To Now
The Cybersecurity Assessment Tool is gone and no replacement was issued. Here is what changed for access control, which framework to adopt as your spine, what examiners sample instead, and how a small bank rebuilds the mapping without a GRC team.
Last reviewed Sep '26
User Access Reviews: What Auditors Actually Test, and Why Most Reviews Fail Them
Why performed access reviews still fail audits, what SOX, PCI DSS, NYDFS, HIPAA and OSFI B-13 require, and how often each asks for a review.
Last reviewed Sep '26
Workforce Identity Management Breaks at the Help Desk, Not the Login
Workforce identity management now fails after authentication, not during it — at account recovery, at stolen session tokens, and at the leaver signal that never reaches your SaaS estate. What the 2025–26 campaigns exposed, and the controls that actually close each gap.
Last reviewed Sep '26
Automating User Access Reviews Fixes the Half Auditors Do Not Fail You On
What automating user access reviews actually removes, the findings it leaves untouched, and why most teams automate a quarterly cadence that only three of fifteen frameworks ask for — with what each instrument really says about interval.
Last reviewed Sep '26
Privileged Access Management Pricing: The Licence Is the Smallest Number
What privileged access management pricing looks like in 2026 — which vendors publish a price and which do not, why the per-user figure misleads, the four lines in a real PAM budget, and when a platform is not the answer yet.
Last reviewed Sep '26
Healthcare Compliance
HIPAA Access Control in 2026: What's Required Now, What's Proposed, and What It Takes
The HIPAA Security Rule update is still a proposal — final action is now targeted for July 2027. Here is what access control requires today, what would change if it is finalised, the four artifacts investigators sample, and the work involved for a small IT team.
Last reviewed Sep '26
User Access Reviews: What Auditors Actually Test, and Why Most Reviews Fail Them
Why performed access reviews still fail audits, what SOX, PCI DSS, NYDFS, HIPAA and OSFI B-13 require, and how often each asks for a review.
Last reviewed Sep '26
Workforce Identity Management Breaks at the Help Desk, Not the Login
Workforce identity management now fails after authentication, not during it — at account recovery, at stolen session tokens, and at the leaver signal that never reaches your SaaS estate. What the 2025–26 campaigns exposed, and the controls that actually close each gap.
Last reviewed Sep '26
Reading up on a change that lands on your systems?
vaultKEY explains what moved. A 30-minute Identity Risk Review tells you whether your access controls already satisfy it, and names what would have to change if they do not.
Book an Identity Risk Review