Identity management
Purpose
Uniquely identify the people and systems accessing assets so access rights can be assigned correctly.
How to meet this control
In short: Manage the full lifecycle of identities.
- Step 01Operate one identity per person in a central identity provider and prohibit shared logins, with documented exceptions only where justified
- Step 02Automate identity creation, change and removal from HR events so identities track joiner-mover-leaver activity
- Step 03Govern non-human identities (service accounts, API keys) with named owners, approval and periodic review
- Step 04Disable or remove identities promptly when no longer needed and reconcile against HR and the asset register
- Step 05Keep an audit log of significant identity events such as creation, privilege change and disablement
Tip: One identity per person, no shared logins; tie creation/removal to HR events.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Manage identities across their full life cycle from creation to removal
- ›Link each personal identity to a single person so actions can be traced and held accountable
- ›Permit shared identities only where justified, with dedicated approval and documentation
- ›Subject non-human identities to segregated approval and ongoing oversight
- ›Disable or remove identities promptly when they are no longer needed
- ›Avoid duplicate identities mapped to the same entity within a context
- ›Keep records of significant events involving identities and authentication information
- ›Verify third-party identities provide the required trust level before relying on them
Audit evidence to keep
- - Identity register or directory showing one identity per person with shared-account exceptions documented
- - Evidence that identity provisioning and deprovisioning is tied to HR events
- - Inventory of non-human identities with assigned owners and review records
- - Audit logs of identity creation, modification and removal
Common mistakes
- - Approving access in chat with no retained record
- - Copying access from another user without checking least privilege
- - Reviewing access but not proving removals were completed
Owner, cadence, and proof
Assign one accountable owner for A.5.16. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.