Control A.5.16Identity management
The full life cycle of identities must be managed.
Identity is the anchor for everything the access controls do: creation, when a person or service arrives; change, when a role moves; and removal, when they leave. The control covers people and also the identities that are not people — service accounts, application identities, and the machine identities that now outnumber human ones in most estates.
Two requirements cause most of the difficulty. Identities should be unique and attributable to an individual, which is what makes logs in A.8.15 mean anything and what shared accounts destroy. And disabled or removed identities must not be reusable in a way that transfers history from one person to another.
The gap is almost always at the leaving end, and almost always for non-employees. Joiners are visible because someone is waiting to work; leavers are visible only if a process makes them so, and contractors frequently sit outside the process that does.
How to put this in place
If accounts cannot be tied to a known person or purpose, actions cannot be traced and old accounts linger. A clear identity process is what makes later access reviews meaningful.
- Decide the trigger that allows an identity to be created, such as an HR record or approved contractor engagement.
- Create one identity per person in a central directory.
- Keep shared and service accounts to a minimum, each with a named owner.
- Disable identities promptly when the trigger ends, using the leaver steps in A.5.18.
- Compare directory listings with HR records on a schedule and remove strays.
Evidence an auditor usually looks for: directory listings compared with HR records, the register of shared and service accounts with owners, and joiner and leaver records.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.