Identity management

Plain-language summary

Controlling identities — the accounts that represent people, systems and services — from creation to removal, so each one is unique, traceable to an accountable person, and disabled or deleted as soon as it is no longer needed.

What the clause is really asking

Access control decides what an identity may do; identity management makes sure each identity is real, unique and accounted for. This control asks you to control identities from the moment they are created, through any change, to their removal. In practice: one unique identity per person, so actions can be traced to an individual; shared identities only where there is a business need, approved, documented and with someone accountable; identities for systems and services (service accounts, API identities, bots) each with a named owner; identities disabled or removed promptly when people leave or systems retire; no duplicate identities for the same person; and records kept of significant events in each identity's life. Third-party identities — federated logins, supplier accounts on your systems — are in scope too. The common misunderstanding is to focus on staff accounts and forget service, shared admin, test and supplier accounts, which attackers favour. Linking identity creation and removal to HR events is the most useful single habit. Under POPIA section 19, unique identities are what make an access log worth anything after a breach.

What auditors look for

Auditors pull an export of all accounts from the directory and key cloud services and compare it with the HR list of current staff and contractors. They look for accounts belonging to leavers, duplicate accounts for one person, generic accounts such as 'admin', 'reception' or 'scanner', and service accounts without an owner. They ask how an identity is created — what triggers it, who approves it, what record is kept — and trace a recent starter and leaver. They check supplier and third-party accounts. The hard question: who owns this service account, and what happens to it if they leave?

Typical evidence

Identity management procedure covering creation, change and removal; HR-to-IT starter, mover and leaver triggers; directory and cloud account exports; reconciliations between HR records and account lists; register of shared and service accounts with owners and justification; records of disabled and deleted accounts; register of supplier and third-party accounts; identity event logs.

How to comply — recommendations

Make HR the trigger: no account is created without an HR or contract record, and every leaver notification disables accounts on the leaving date. Enforce one named account per person and use single sign-on where you can, so one disable removes access everywhere. Keep a register of shared, service and supplier accounts with an owner, purpose and review date, and remove what nobody claims. Reconcile directory and key cloud accounts against HR records monthly. Disable accounts left inactive beyond a set period. Keep records of creation, change and removal.

Common nonconformities

Leavers' accounts still active; shared generic accounts with no accountable owner; service accounts with no named owner or justification; duplicate identities for one person; supplier and contractor accounts left open after engagements end; no reconciliation between HR records and accounts; accounts created without approval or record; dormant accounts never disabled.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.