Verkada Access Control Management That Stays in Sync with Your HRIS

For a multi-site healthcare provider — six sites, 350 badges — replacing a three-day manual offboarding workflow with an HRIS-driven one cut deprovision time to under 60 seconds, freed one IT analyst from quarterly review chasing, and returned a positive number on the year-one ledger.

The offboarding problem is operational, audit, and security risk in one workflow

Manual offboarding fails on three dimensions at once.

Operationally, the IT offboarding checklist is long. Industry references put a complete checklist at 30 to 43 distinct tasks across HR, IT, payroll, legal, and facilities [1]. The average manual revocation runs 3+ days from the moment an employee departs [2], and many mid-market organizations sit at 2 to 4 weeks [3]. Each system, badge, and SaaS license is its own handoff, and each handoff is a chance for something to slip.

On the audit side, SOC 2 Common Criteria 6 (CC6) — logical and physical access — is the single most-failed control family in first-time audits. The 2024 CBIZ benchmark study of 193 reports found that 54.9% contained at least one control exception, with user access review failures overtaking business approval exceptions as the leading driver of qualified opinions for the first time [5]. Even on Vanta or Drata, which automate roughly 80% of SOC 2 evidence through infrastructure APIs, residual manual work runs 40 to 60 hours per audit cycle, or 192 to 260 hours per year [6].

And on the security side, Cyberhaven research found a 720% surge in data exfiltration in the 24 hours before a layoff versus baseline [7]. A 2025 Gartner peer poll cited by Cyberhaven found 53% of IT leaders name an unmanaged former-employee account as their top offboarding fear [7]. The 2025 Ponemon Cost of Insider Risks report puts the average annualized cost of insider incidents at $17.4M per organization, with 81 days average containment time [8]. CyberArk's 2025 research found 84% of organizations experienced an identity-related breach in the prior year, and 23% of mid-market organizations had at least one ex-employee retain an active access credential beyond 30 days post-termination [9].

The pattern across every source is consistent: the offboarding checklist is a manual process, and manual processes miss things.

What HRIS-native verkada access control management actually does

AccessOps treats the HRIS as the source of truth and the Verkada command tenant as the access plane. The system observes HRIS events and reconciles Verkada state through a six-stage state machine: Hire, Provision, Review, Change or Transfer, Terminate, and Archive.

Each stage has a written SLA. A termination event triggers a deactivation in under 60 seconds; a hire event creates a Verkada user and assigns access groups in under 5 minutes based on HRIS role, department, and site. Every state transition writes to an append-only audit table that powers the activity log, the evidence pack, and the SOC 2 CC7.2 trail.

What this replaces: a 43-item IT offboarding checklist [1] becomes one HRIS termination event. No tickets to the manager, IT, or facilities. The system observes, applies role-based rules, and writes the audit trail — access lifecycle automation in practice.

The workday verkada integration — and what every other HRIS connector actually does

AccessOps ships with first-party HRIS connectors for eight systems: Workday, BambooHR, Rippling, HiBob, ADP Workforce Now, UKG Pro, Paylocity, and Personio. Each implements the same protocol — list_employees, get_employee, stream_changes — but the implementation details differ enough to matter.

Workday is the case the brief turns on. It has no native webhooks, so the connector polls Workday Report-as-a-Service (RaaS) on a 15 to 60 minute cadence or runs a Workday Studio worker. Termination does not auto-disable the Workday user account — a separate Maintain_User_Account call is required [10]. REST endpoints cap at 60 requests per minute per resource. The effective-date versus entry-date split must be modeled correctly, or the connector writes to the wrong day.

BambooHR is the cleaner case: real-time webhooks, but the payload lists only changed fields, and the connector must follow up with a GET [11]. Rippling mandates both a 24-hour scheduled poll and a webhook listener [12]. ADP does not push traditional webhooks — the connector polls an event-notification message queue and DELETEs after processing [13]. HiBob termination events are not reversible via API, and lifecycle events fire at midnight in the site timezone [14]. Paylocity webhook payloads carry only companyId and employeeId, requiring a follow-up API call [15].

The point is that "sync your HRIS to Verkada" is shorthand for eight different engineering projects, each with its own auth model, latency floor, and failure mode. A managed HRIS Verkada integration collapses that into a five-week pilot.

SOC 2 access reviews still depend on evidence the audit tools cannot collect

SOC 2 evidence automation has matured, but the residual manual work is still substantial. Vanta and Drata automate roughly 80% of SOC 2 evidence through infrastructure APIs, but the remaining 20% — application screenshots, workflow documentation, human attestations — does not have an API [6]. Enterprise auditors sample 25 to 40 provisioning events and 25 to 40 termination events in a 12-month Type II [16]. The two most common CC6.1 findings: access review approvals without documented rationale, and late termination revocation [16].

AccessOps closes the loop with a quarterly review cycle and a signed evidence pack. Every 90 days, the system compiles a pending list of every user whose last attestation is older than 90 days plus any user in a privileged access group, and routes it to line managers for keep, modify, revoke, or defer decisions. At the end of the 14-day window, the system applies the decisions in a single batched job and produces a signed evidence pack — PDF, CSV, and JSON, with a PKCS#7 detached signature anchored to a per-organization key [17]. The pack maps events to SOC 2 CC6.1, CC6.2, CC6.3, and CC7.2, plus HIPAA, SOX, and ISO 27001 controls on request.

The healthcare provider math, worked end to end

The healthcare provider runs Verkada Access across 6 sites with approximately 350 active badges. Pre-AccessOps, offboarding was a four-step email chain — HR to IT, IT to Verkada Command, IT to operations lead, operations lead to clinic manager — averaging 3+ days end to end. Quarterly access reviews were a spreadsheet process owned by one IT analyst chasing 18 managers over a two-week window every quarter.

Post-AccessOps, BambooHR termination events drive Verkada deactivation in under 60 seconds. The clinic manager gets a single notification that the deprovision happened, with timestamp and operator. The IT analyst's quarterly review work goes from chasing 18 managers to reviewing four auto-generated exception reports. Evidence packs land in the Comply auditor portal automatically, with role-scoped access for the SOC 2 auditor.

The math, healthcare-provider-specific: 350 badges times the ~17% US mid-market annual turnover rate [18] equals 60 departures a year. At 5.5 hours of IT time per manual offboarding and a $75 blended loaded rate [2], that is $24,750 a year in IT labor. Forty hours per audit cycle times four annual cycles at $100 an hour is another $16,000 in evidence labor. Combined addressable labor: $40,750 a year. Year 1 AccessOps cost: 6 sites times $495 per site per month, a one-time $750 connector setup, and one $40 off-cycle pack, or $36,430 all-in [17]. Net year 1, before counting any avoided insider-risk dollar: +$4,320. Year 2 forward recurs at roughly $5,000 a year net.

A UK firm that automated the same workflow reported in October 2025 that deprovisioning time fell from 5.5 hours to 28 minutes — a 91% reduction — and orphaned accounts fell 97% [19].

Where AccessOps sits in the IGA landscape

Identity governance has a buyer-profile mismatch with the mid-market. SailPoint Identity Security Cloud lists at $30 to $55 per identity per year, and Vendr's median ACV is $113K with a 12 to 18 month implementation [20][21]. Saviynt lists at $24 to $40 per user per year for mid-market and still takes 3 to 6 months [22][23]. Both are designed for orgs well above the 250 to 5,000 employee range that AccessOps targets. A 500-user, six-site org can expect $130K to $800K in year 1 for SailPoint and $60K to $180K for Saviynt, versus $36K all-in for AccessOps [17].

The honest gap: AccessOps does not do fine-grained entitlement management across 175 SaaS apps — that is Opal, Iden, or ConductorOne's lane. Workday customers with no physical access and no Verkada deployment should keep using Workday-native access governance, which is bundled. What AccessOps does, plainly, is pair a Verkada Access deployment to an HRIS and produce an evidence pack the auditor can read in an afternoon. That is the gap neither legacy IGA nor staffing MSPs serve well.

If you run Verkada Access across more than one site, we'd be glad to walk through a five-week pilot.

Sources

[1] Delinea, IT Offboarding Checklist 2024. https://delinea.com/blog/it-offboarding-checklist [2] Checkflow, IT Offboarding Checklist (5.5 hours manual, 3+ day revocation lag). https://checkflow.io/blog/it-offboarding-security-checklist [3] Solvix, Automated Offboarding (2–4 week lag, 47% retain access weeks/months, 96% reduction). https://solvixai.com/automated-offboarding-ensuring-security-and-compliance-every-time/ [5] CBIZ, 2024 SOC Benchmark Study (193 reports, 54.9% exceptions, user access review #1 driver of qualified opinions). https://soc2auditors.org/insights/soc-2-access-control-policy-template/ [6] Screenata, What SOC 2 Evidence Vanta and Drata Do Not Automate (80% automated, 40–60 hours per cycle). https://screenata.com/resources/blog/vanta-drata-gaps [7] Cyberhaven, Insider Threat Statistics 2026 (720% exfiltration spike, 53% IT leader fear). https://www.swif.ai/blog/insider-threat-statistics [8] Ponemon Institute, 2025 Cost of Insider Risks ($17.4M average annualized). https://www.mebebot.com/post/ai-employee-offboarding-automation [9] CyberArk, 2025 Identity Security Risk Report (23% ex-employee credential stat, 84% identity-related breach). https://www.cyberark.com/resources/identity-management/chasing-digital-ghosts-across-modern-iga-environments [10] Workday connector documentation. https://www.apideck.com/products/workday [11] BambooHR webhooks documentation. https://documentation.bamboohr.com/ [12] Rippling developer docs. https://developer.rippling.com/ [13] ADP event APIs and notifications. https://developers.adp.com/ [14] HiBob API documentation. https://apidocs.hibob.com/ [15] Paylocity developer documentation. https://developer.paylocity.com/ [16] CertifyOps, SOC 2 CC6.1 Evidence Examples (25–40 sample size, top findings). https://www.certifyops.com/blog/soc-2-cc6-1-evidence-examples [17] HTS Managed, AccessOps Feature Guide (Rev 2026-08). https://htsmanaged.com [18] US Bureau of Labor Statistics, Job Openings and Labor Turnover Survey (JOLTS). https://www.bls.gov/jolts/ [19] LinkedIn case, UK firm, October 2025. https://www.linkedin.com/posts/jeanmarcreynaud_cybersecurity-smes-aiforbusiness-activity-7424089238310404096-RUY2 [20] Vendor Benchmark, SailPoint Pricing 2026. https://vendorbenchmark.com/vendors/sailpoint-pricing [21] Iden, Mid-Market IGA Buying Guide 2026 (Vendr median $113K ACV, 12–18 month implementation). https://www.idenhq.com/en/blog/mid-market-iga-buying-guide-2026 [22] Adcyma, SailPoint vs Saviynt 2026. https://adcyma.se/en/compare/sailpoint-vs-saviynt [23] Zluri, Saviynt Pricing Cost. https://www.zluri.com/eye-on-identity/saviynt-pricing-cost-iga-platform-evaluation

Harris Technology Services (HTS) · https://www.hts.pro · Support: support@hts.pro