5.16 Identity management
Requires the full life cycle of identities to be managed, from creation through change to removal.
5
artefacts
1
held by a system
2
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Records showing each identity is traceable to a person or to an accountable owner where the identity is for a service or device · Endpoint management (MDM / EDR)
periodic reviewEvidence produced at each review
- Evidence of timely removal on departure, with dates showing the interval between leaving and disablement · Document repository
- Periodic reconciliation of active identities against the authoritative source, and the outcome of the last one · Document repository
governing documentDocuments that govern the control
- The identity lifecycle procedure covering creation, change and removal, for internal users, external users and non human identities · Policy repository / GRC workspace
- Approval records for identity creation, sourced from an authoritative system such as human resources or contract management · Vendor register / contract repository
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Endpoint management (MDM / EDR) on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Shared and generic accounts in use with no owner and no way to attribute an action to a person
- Service accounts, application identities and machine credentials created outside the process and never reviewed
- Identity removal driven by manual notification, so leavers stay active until someone remembers
- Reconciliation performed against the directory only, missing identities held locally in applications
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet