5.16 Identity management
Identities are to be managed throughout their whole life cycle. Purpose: make it possible to identify each person and system that accesses the organization's information and assets uniquely, and to assign access rights properly. Guidance: identity processes should ensure that an identity issued to a person is tied to that one person so they can be held accountable; that identities used by several people (shared identities) are allowed only where the business or operations genuinely need them, each with its own approval, and documented; that identities for non-human entities go through appropriately segregated approval and are independently overseen on an ongoing basis; that identities are disabled or removed promptly once no longer needed, for example when the entity is retired or the person leaves or changes role; that within a given domain each entity has only one identity so duplicates are avoided; and that records are kept of all significant events in the use and management of identities and authentication information. A supporting process handles changes to identity information and may include re-checking trusted documents about a person. Where third-party identities are accepted (for example social media logins), the organization confirms they give the trust level required and that the associated risks are understood and treated, including through supplier controls (5.19) and authentication information controls (5.17). Other information: granting or withdrawing access typically involves confirming the business need for an identity, verifying the entity before assigning a logical identity, creating it, configuring and activating it together with its authentication services, and then granting or revoking specific rights based on authorization decisions (5.18).
Source: ISO/IEC 27002:2022, 5.16. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- A register of non-human identities (service accounts, machine identities) with segregated approval and an independent oversight record · Identity provider / directory
- Leaver and mover reports showing timely disablement or removal of identities, and duplicate identity checks · Identity provider / directory
- Logs of significant identity and authentication information events, and the risk assessment for accepted third-party identities · Identity provider / directory
periodic reviewEvidence produced at each review
- Evidence that identities are verified against trusted documents before issue · Document repository
governing documentDocuments that govern the control
- Identity management procedure covering creation, verification, activation, change, disablement and removal · Policy repository / GRC workspace
- A register of shared identities with the business justification and approval for each · Policy repository / GRC workspace
First move
Common gaps auditors find
- Generic shared accounts exist without documented justification or approval
- Service accounts have no owner and no periodic oversight
- Identities of leavers remain enabled for weeks because HR notifications are not integrated
- The same person holds several identities in one directory, undermining accountability
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet