ISO 27001 Identity Management Explained – Control 5.16

ISO 27001 Identity Management Explained – Control 5.16

/ ISO 27001 Controls / By

Identity is the fundamental gateway to access. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations invest heavily in firewalls, endpoint detection, and data loss prevention while leaving their front door wide open through chaotic identity management. Unmanaged identity sprawl—orphaned contractor accounts, duplicate user IDs, untracked service accounts, and shared admin logins—silently undermines every security control you put in place. If you cannot prove uniquely who or what performed an action in your systems, your audit logs are useless, accountability vanishes, and incident response becomes pure guesswork. Annex A 5.16 provides the structural foundation for the entire access control lifecycle.

ISO 27001:2022 introduced Annex A 5.16 as a dedicated, consolidated control to ensure your organisation manages the full lifecycle of human and non-human identities. This control updates former 2013 requirements (9.2.1) and acts as the essential prerequisite for authentication (Annex A 5.17), access rights provisioning (Annex A 5.18), and privileged access management (Annex A 8.2).

Quick Summary: What ISO 27001 Annex A 5.16 Requires

At a practical level, Annex A 5.16 is about establishing complete visibility, unique assignment, and strict lifecycle governance over every identity interacting with your environment. It does not require deploying an expensive enterprise Identity Governance and Administration (IGA) tool on day one; it expects a consistent, documented, and auditable process for managing identities from birth to retirement. Here is what you need to do in plain English:

  • Enforce Unique Identity Allocation: Assign a unique identifier to every human user, application, service, and device to ensure strict personal and operational accountability.
  • Govern the Full Identity Lifecycle: Define explicit procedures for requesting, approving, creating, modifying, disabling, and archiving identities across Joiner, Mover, and Leaver (JML) workflows.
  • Distinguish Human vs. Non-Human Identities: Separate user identities from service accounts, API keys, bots, and system processes, applying distinct security baselines to each.
  • Eliminate Shared & Generic Identities: Prohibit shared accounts (e.g., `admin`, `team-shared`) except where operationally essential, backed by compensating logs and single-use checkout vaults.
  • Verify Entity Identity Before Creation: Validate human identities (via HR verification or official government ID) and non-human requirements before issuing credentials.
  • Deprovision Disused Identities Promptly: Disable or delete identities instantly upon employee departure, contract termination, or system retirement to prevent orphaned access (Annex A 6.5).

Why Chaotic Identity Governance Is a Critical Hazard

When identity management is informal or fragmented across disparate systems, your environment becomes a maze of unmonitored backdoors. Attackers actively exploit identity sprawl to gain footholds and move laterally without triggering security alerts.

Ignoring structured identity lifecycle controls exposes your business to severe hazards:

  • Orphaned Credential Exploitation: Attackers discovering active, unmonitored accounts belonging to former employees or contractors and using them to bypass MFA and access cloud tenants.
  • Over-Privileged Non-Human Accounts: Service accounts and API keys created with global administrative permissions that sit unchanged for years, providing instant root access if leaked (Annex A 8.28).
  • Loss of Audit Traceability & Forensics: Failing to attribute malicious actions or data breaches during incident investigations because multiple staff members shared a single administrative account.
  • Identity Duplication & Privilege Creep: Staff accumulating multiple user IDs across different departments, confusing access review workflows and leading to severe audit non-conformities.

My 8 Step Plan to Implement Annex A 5.16 Fast

You do not need a multi-million-pound identity engine to satisfy an ISO 27001 auditor. Here is my pragmatic, 8-step plan to establish an audit-ready identity management framework.

1. Establish an Overarching Identity Management Policy

Document clear organizational rules governing how human and non-human identities are created, maintained, and retired:

  • Mandate the principle of “One Entity, One Identity” across all production, corporate, and cloud environments.
  • Establish clear approval authorities required before any identity can be provisioned in directory services (e.g., HR sign-off for staff; IT Lead sign-off for service accounts).
  • Prohibit the creation of ad-hoc, unapproved user accounts outside central Identity Providers (IdP).

2. Centralize Directory Architecture (Single Source of Truth)

Eliminate local user accounts scattered across isolated servers and SaaS applications:

  • Deploy a central cloud Identity Provider (IdP) such as Microsoft Entra ID, Okta, or Google Workspace to serve as your authoritative identity store.
  • Federate Single Sign-On (SSO) across all enterprise SaaS tools, cloud tenants, and internal applications to enforce central identity control.
  • Maintain a central register documenting all authoritative identity sources and directory connections (Annex A 8.9).

3. Formalize the Human Identity Lifecycle (JML Workflows)

Synchronize identity creation and removal directly with HR operational triggers (Annex A 6.1 & Annex A 6.5):

  • Joiners: Require positive HR identity verification (e.g., passport check, formal contract) before triggering automated or ticketed identity creation.
  • Movers: Re-verify identity attributes when an employee changes departments or job roles to adjust group memberships cleanly.
  • Leavers: Automate account disabling in the central IdP on the final working day, revoking access globally across all federated applications instantly.

4. Separate and Govern Non-Human Identities (NHIs)

Service accounts, system processes, API tokens, and automated bots require dedicated governance (Annex A 8.24):

  • Maintain a dedicated non-human identity inventory recording: account name, purpose, assigned system owner, host application, and creation/expiration dates.
  • Enforce strict naming conventions for non-human identities (e.g., `svc-sql-backup` or `app-jira-sync`) to distinguish them instantly from human users.
  • Apply the Principle of Least Privilege: restrict service account permissions strictly to the specific API calls or database actions required for operational delivery.

5. Eliminate Shared Accounts and Enforce Vaulting

Shared accounts destroy individual accountability. Eliminate generic accounts across all operating systems and platforms:

  • Disable generic built-in accounts (e.g., `Guest`, `Administrator`, `root`) where possible, or rename and restrict them heavily.
  • Where shared operational accounts are technically unavoidable (e.g., emergency physical access or legacy appliances), store credentials in a Privileged Access Management (PAM) vault.
  • Enforce single-user checkout logging, mandatory session recording, and automated password rotation following every checked-out use.

6. Secure Identity Verification and Onboarding Communications

Ensure that initial identity creation cannot be hijacked or impersonated (Annex A 5.17):

  • Establish secure, out-of-band channels for communicating initial temporary credentials or self-service onboarding links to new employees.
  • Require users to verify their identity and register for Multi-Factor Authentication (MFA) during initial account activation (Annex A 8.5).
  • Enforce immediate forced password changes upon first login for all newly issued credentials.

7. Implement Automated Deprovisioning and Orphan Sweeps

Prevent disused or lingering accounts from accumulating in your directories over time:

  • Configure automated inactivity policies that disable human accounts after 30 days of continuous non-login.
  • Set hard expiration dates on temporary contractor accounts, service accounts, and guest access profiles upon creation.
  • Execute monthly automated “orphan account” scripts comparing active directory user lists against current HR payroll records to spot un-deprovisioned leavers instantly.

8. Conduct Bi-Annual Identity Audits and Inventory Reviews

Verify that identity stores match operational reality through structured, auditable reviews (Annex A 5.36):

  • Perform bi-annual identity reviews requiring IT leads and system owners to verify every active human and non-human identity in the central directory.
  • Purge or archive permanently disabled accounts, obsolete service credentials, and abandoned guest identities discovered during reviews.
  • Document review outcomes, identified anomalies, and remediation actions as direct audit evidence for ISO 27001 surveillance audits.

Common Implementation Pitfalls and How to Fix Them

When preparing clients for ISO 27001 audits, I frequently spot the same identity management mistakes. Here are the main traps and how to solve them:

  • Problem: Treating Service Accounts Like Human Users with Unmonitored, Permanent Admin Rights
    Ninja Solution: Maintain a dedicated Non-Human Identity inventory, restrict permissions strictly via least privilege, and rotate credentials using automated secret vaults.
  • Problem: IT Creating Accounts Based on Casual Chat Requests Without HR Verification
    Ninja Solution: Enforce a rule that no user account may be provisioned without a formal, logged ticket linked to verified HR onboarding data.
  • Problem: Leaving Departed Employees’ Accounts Enabled for Months “Just in Case We Need Their Emails”
    Ninja Solution: Disable the user account immediately on day one of exit, convert the mailbox to a shared/delegated resource, and assign explicit manager access.
  • Problem: Multiple Engineers Using a Shared `admin` Login to Manage Core Cloud Infrastructure
    Ninja Solution: Enforce named individual accounts federated via SSO/MFA and grant administrative roles using Role-Based Access Control (RBAC).

The ISO 27001 Ninja Bottom Line

ISO 27001 Annex A 5.16 is about maintaining complete, intentional control over who or what can act within your digital environment. Every access right, authentication event, and privileged operation depends on identity; if your identity foundation is weak, your entire security program is built on sand.

By publishing a clear Identity Management Policy, centralizing directory architecture via SSO, synchronizing JML workflows with HR, governing non-human service accounts, eliminating shared logins, securing onboarding verification, automating orphan sweeps, and conducting bi-annual identity audits, you establish complete operational traceability, block unauthorized entry, and satisfy your ISO 27001 auditor with complete confidence.