Identity and Access Management
The framework of policies, processes, and technologies that manages digital identities and controls user access to critical systems and data. IAM encompasses identity lifecycle management, authentication, authorization, single sign-on, directory services, and privileged access management.
Identity and Access Management (IAM) is the discipline of ensuring that the right individuals have the right access to the right resources at the right time for the right reasons. IAM systems serve as the central nervous system of an organization's security architecture, managing the entire identity lifecycle from onboarding (provisioning accounts and initial access), through role changes (access modifications), to offboarding (deprovisioning). Core IAM capabilities include directory services (centralized identity stores), authentication services (verifying identity through passwords, MFA, biometrics), authorization services (determining what authenticated users can access), single sign-on (SSO — enabling one authentication event to grant access across multiple applications), and privileged access management (PAM — controlling and monitoring elevated access).
IAM is foundational to every compliance framework. ISO 27001 Annex A dedicates multiple controls to identity and access management, including A.5.15 (access control), A.5.16 (identity management), A.5.17 (authentication information), A.5.18 (access rights), A.8.2 (privileged access rights), A.8.3 (information access restriction), and A.8.5 (secure authentication). SOC 2 Trust Services Criteria address IAM across Security (logical access controls) and Confidentiality (restricting access to confidential information). GDPR requires appropriate technical measures to protect personal data, and IAM is the primary mechanism for controlling who can access personal data. NIS2 mandates access control policies and human resources security as part of cybersecurity risk management. In technology due diligence, IAM maturity is a critical assessment area.
Modern IAM implementations are evolving toward cloud-native, identity-centric security models. Cloud IAM services from major providers offer centralized identity management across hybrid environments. Identity governance and administration (IGA) platforms automate access reviews, certification campaigns, and policy enforcement. Privileged access management (PAM) solutions provide just-in-time access, session recording, and credential vaulting for administrative accounts. Zero trust architectures elevate IAM from a supporting control to the primary security enforcement point. Organizations should implement automated provisioning and deprovisioning (ideally integrated with HR systems), conduct regular access reviews (quarterly for privileged access, at least annually for standard access), enforce MFA across all applications, monitor for anomalous authentication patterns, and maintain comprehensive audit logs of all access events.
Related frameworks
Related terms
Access Control
The set of policies, procedures, and technical mechanisms that govern who can access which information assets, systems, and resources. Access control ensures that only authorized individuals can view, modify, or interact with sensitive data and systems.
Multi-Factor Authentication
A security mechanism that requires users to provide two or more independent verification factors before granting access to a system or resource. Factors typically include something you know (password), something you have (token or device), and something you are (biometric).
Role-Based Access Control
An authorization model that assigns permissions to users based on their organizational roles rather than individual identities. RBAC simplifies access management by grouping permissions into roles such as administrator, editor, or viewer, and assigning users to the appropriate roles.
Segregation of Duties
A governance control that divides critical functions and responsibilities among different individuals to prevent any single person from having the ability to authorize, execute, and conceal errors or fraud. Also known as separation of duties (SoD).
Zero Trust Architecture
A security model that eliminates implicit trust based on network location and instead requires continuous verification of every user, device, and request before granting access to any resource, operating on the principle of 'never trust, always verify.'
Assess your compliance posture
Run a free self-assessment for ISO 27001, SOC 2, GDPR, NIS2, or Tech DD and see exactly where you stand.
Start free assessment