Identity management

What the requirement asks

Identities are to be managed throughout their whole life cycle. Purpose: make it possible to identify each person and system that accesses the organization's information and assets uniquely, and to assign access rights properly. Guidance: identity processes should ensure that an identity issued to a person is tied to that one person so they can be held accountable; that identities used by several people (shared identities) are allowed only where the business or operations genuinely need them, each with its own approval, and documented; that identities for non-human entities go through appropriately segregated approval and are independently overseen on an ongoing basis; that identities are disabled or removed promptly once no longer needed, for example when the entity is retired or the person leaves or changes role; that within a given domain each entity has only one identity so duplicates are avoided; and that records are kept of all significant events in the use and management of identities and authentication information. A supporting process handles changes to identity information and may include re-checking trusted documents about a person. Where third-party identities are accepted (for example social media logins), the organization confirms they give the trust level required and that the associated risks are understood and treated, including through supplier controls (5.19) and authentication information controls (5.17). Other information: granting or withdrawing access typically involves confirming the business need for an identity, verifying the entity before assigning a logical identity, creating it, configuring and activating it together with its authentication services, and then granting or revoking specific rights based on authorization decisions (5.18). In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Identity management is the lifecycle behind access. The guidance asks for a unique identity, the joiner, mover and leaver events, the authoritative source and the reconciliation.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep identity management procedure covering creation, verification, activation, change, disablement and removal and one live sample together.

Evidence an assessor asks for

• Identity life cycleIdentity management procedure covering creation, verification, activation, change, disablement and removal
• Identity life cycleEvidence that identities are verified against trusted documents before issue
• Identity life cycleA register of shared identities with the business justification and approval for each
• Identity life cycleA register of non-human identities (service accounts, machine identities) with segregated approval and an independent oversight record
• Identity life cycleLeaver and mover reports showing timely disablement or removal of identities, and duplicate identity checks
• Identity life cycleLogs of significant identity and authentication information events, and the risk assessment for accepted third-party identities

The question an assessor will ask

An assessor will ask for identity management procedure covering creation, verification, activation, change, disablement and removal, then trace it to the system it protects. For A.5.16 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Generic shared accounts exist without documented justification or approval
• Service accounts have no owner and no periodic oversight
• Identities of leavers remain enabled for weeks because HR notifications are not integrated
• The same person holds several identities in one directory, undermining accountability

Before the next audit

Before the next audit, check one live sample for this gap: generic shared accounts exist without documented justification or approval.