Control A.5.16Identity management
What it means in practice
The full life cycle of identities must be managed.
Identity is the anchor for everything the access controls do: creation, when a person or service arrives; change, when a role moves; and removal, when they leave. The control covers people and also the identities that are not people — service accounts, application identities, and the machine identities that now outnumber human ones in most estates.
Two requirements cause most of the difficulty. Identities should be unique and attributable to an individual, which is what makes logs in A.8.15 mean anything and what shared accounts destroy. And disabled or removed identities must not be reusable in a way that transfers history from one person to another.
The gap is almost always at the leaving end, and almost always for non-employees. Joiners are visible because someone is waiting to work; leavers are visible only if a process makes them so, and contractors frequently sit outside the process that does.
How to put this in place
If accounts cannot be tied to a known person or purpose, actions cannot be traced and old accounts linger. A clear identity process is what makes later access reviews meaningful.
- Decide the trigger that allows an identity to be created, such as an HR record or approved contractor engagement.
- Create one identity per person in a central directory.
- Keep shared and service accounts to a minimum, each with a named owner.
- Disable identities promptly when the trigger ends, using the leaver steps in A.5.18.
- Compare directory listings with HR records on a schedule and remove strays.
Evidence an auditor usually looks for: directory listings compared with HR records, the register of shared and service accounts with owners, and joiner and leaver records.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Excel
Access Review Scope & System Inventory
in User Access ReviewIts Framework References list this control. Supported by: Extract Readiness sheet: accounts matched to people, and generic, service and third-party accounts identified with an owner. - Word
Access Control Policy
in Joiner-Mover-Leaver & Access ProvisioningIts Framework References list this control. Supported by: The identity lifecycle; one person, one identity (JML-01, JML-02). - Word
Joiner-Mover-Leaver Operating Procedure
in Joiner-Mover-Leaver & Access ProvisioningIts Framework References list this control. Supported by: The lifecycle events; the monthly reconciliation. - Excel
Privileged & Service Account Inventory
in Privileged Access ManagementIts Framework References list this control. Supported by: Inventory and Discovery: the full life of each identity, from finding and claiming it to its removal.