Identity management

What the control asks

Identities are to be managed throughout their whole life cycle. Purpose: make it possible to identify each person and system that accesses the organization's information and assets uniquely, and to assign access rights properly. Guidance: identity processes should ensure that an identity issued to a person is tied to that one person so they can be held accountable; that identities used by several people (shared identities) are allowed only where the business or operations genuinely need them, each with its own approval, and documented; that identities for non-human entities go through appropriately segregated approval and are independently overseen on an ongoing basis; that identities are disabled or removed promptly once no longer needed, for example when the entity is retired or the person leaves or changes role; that within a given domain each entity has only one identity so duplicates are avoided; and that records are kept of all significant events in the use and management of identities and authentication information. A supporting process handles changes to identity information and may include re-checking trusted documents about a person. Where third-party identities are accepted (for example social media logins), the organization confirms they give the trust level required and that the associated risks are understood and treated, including through supplier controls (5.19) and authentication information controls (5.17). Other information: granting or withdrawing access typically involves confirming the business need for an identity, verifying the entity before assigning a logical identity, creating it, configuring and activating it together with its authentication services, and then granting or revoking specific rights based on authorization decisions (5.18).

Purpose in the standard’s terms, in our words: Enables unique identification of people and systems accessing organizational assets and appropriate assignment of access rights.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Identity and access management; Protection.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• Identity management procedure covering creation, verification, activation, change, disablement and removal
• Evidence that identities are verified against trusted documents before issue
• A register of shared identities with the business justification and approval for each
• A register of non-human identities (service accounts, machine identities) with segregated approval and an independent oversight record
• Leaver and mover reports showing timely disablement or removal of identities, and duplicate identity checks
• Logs of significant identity and authentication information events, and the risk assessment for accepted third-party identities

Where audits commonly find gaps

• Generic shared accounts exist without documented justification or approval
• Service accounts have no owner and no periodic oversight
• Identities of leavers remain enabled for weeks because HR notifications are not integrated
• The same person holds several identities in one directory, undermining accountability

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (09.2.1) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.15 Access control
• 5.17 Authentication information
• 5.18 Access rights

Read the five attributes All 93 controls