ISO 27001 A.5.16 - Identity Management

Requirement

“The full life cycle of identities shall be managed.”

Plain-language meaning

Every user identity should be created, changed, reviewed, disabled, and removed through a controlled process.

The identity lifecycle includes registration, authorization, provisioning, changes, review, de-registration, and handling of exceptional shared identities.

Why this matters

If identities are not managed, accounts remain live after people leave, privileges drift after role changes, and shared accounts destroy accountability.

Identity management applies to all users of information processing facilities, including:

• employees;
• contractors;
• managers;
• administrators;
• application users;
• technical support;
• developers;
• third-party users;
• service accounts where applicable.

Implementation guidance

1. Uniquely register identities

Each user should have a unique identity wherever possible.

Unique identities support:

• accountability;
• access review;
• incident investigation;
• non-repudiation where relevant;
• prompt deactivation;
• least privilege.

Shared accounts should be avoided because they make it difficult or impossible to know who did what.

2. Manage the full lifecycle

Identity lifecycle stages:

The process should be documented and logged.

3. Match identities to documented authorizations

System identities should match registered users and approved access.

Audit failure pattern:

• HR says user left.
• System account is still active.
• Access review did not catch it.
• Logs show activity but no one knows whether it was authorized.

4. Do not reissue redundant identities

Do not reuse old user IDs for new users.

Reissuing identities risks:

• inheriting old access;
• confusing logs;
• corrupting accountability;
• exposing old data or permissions.

5. Control unavoidable shared identities

Shared identities should be rare and justified.

If unavoidable:

• document the risk assessment;
• authorize the shared identity;
• restrict use;
• prevent simultaneous uncontrolled use where possible;
• log who used it and when;
• change credentials when custody changes;
• review continued need;
• replace with individual identities when technically feasible.

Manual tracking is a compensating control, not a preferred design.

Audit guidance

Auditors should test whether identity management works in practice, not just whether account creation forms exist.

Audit tests:

• sample starters, movers, and leavers;
• compare HR records to system accounts;
• compare documented authorizations to actual privileges;
• check account creation and deletion logs;
• review live identities for orphaned accounts;
• inspect administrator and service identities;
• review shared identities and their risk justification;
• verify that redundant identities are not reused.

The auditor should include all user types, not only ordinary employees.

Evidence examples

Strong evidence

• Identities are unique and tied to registered users.
• Joiner, mover, and leaver processes are documented and logged.
• Leavers are promptly disabled or removed.
• Live identities are periodically reviewed against HR or authoritative source records.
• System privileges match documented authorization.
• Shared identities are rare, risk-assessed, authorized, logged, and reviewed.
• Redundant identities are not reissued.

Weak evidence

• Shared accounts are common.
• Accounts remain active after termination.
• Identity creation is informal.
• No reconciliation between HR and systems.
• System accounts do not match documented authorizations.
• Privileges drift after role changes.
• Shared account passwords are not changed when custody changes.
• Old usernames are reused.

Common failures

Exam traps

• Identity management is about the full lifecycle, not only account creation.
• “User” includes administrators, support personnel, programmers, managers, application users, and third-party users.
• Unique identities support accountability.
• Shared identities are not automatically acceptable; they need justification and compensating controls.
• Redundant identities should not be reissued.
• Identity management and access control are related but different: identity says who the user is; access control says what they can use.

Related controls and concepts

• A.5.15 Access Control
• A.5.11 Return of Assets
• A.5.2 Information Security Roles and Responsibilities
• A.5.3 Segregation of Duties
• Internal Audit
• Risk Assessment
• Access Control Matrix

KB-ready summary

A.5.16 requires the full identity lifecycle to be managed. Each user should have a unique identity where possible. Identities should be created, changed, reviewed, disabled, and removed through documented processes. Shared identities should be rare, justified, authorized, tracked, and reviewed because they weaken accountability.

Templates and checklists

• Identity Lifecycle Register
• A.5.16 Audit Checklist
• Access Review Checklist
• Access Control Matrix