The ultimate audit guide to ISO 27001 Annex A 5.16 Identity management
Table of contents
- 1. Identity Management Policy and Procedure Formalisation Verified
- 2. Unique User Identifier Assignment Confirmed
- 3. Identity Verification Standards for Joiners Validated
- 4. Identity Modification Trail during Role Changes Verified
- 5. Identity Revocation Timeliness for Leavers Confirmed
- 6. Identification of External/Third-Party Identities Verified
- 7. Dormant and Inactive Identity Cleanup Execution Evidenced
- 8. Segregation of Duties in Identity Creation Validated
- 9. Privilege Attribute Assignment Integrity Confirmed
- 10. Identity Authentication Strength Alignment Verified
1. Identity Management Policy and Procedure Formalisation Verified
Verification Criteria: A documented policy exists that defines the rules for the full lifecycle of digital identities, including creation, modification, and deletion.
Required Evidence: Approved Identity Management Policy or integrated Access Control Policy with specific “Identity Lifecycle” sections.
Pass/Fail Test: If the organisation cannot produce a formal procedure defining how unique identities are assigned and verified, mark as Non-Compliant.
2. Unique User Identifier Assignment Confirmed
Verification Criteria: Every internal and external user is assigned a unique identifier (UID) that is never shared or reused by another individual.
Required Evidence: Export from the primary Identity Provider (e.g., Entra ID, Okta, LDAP) showing unique UIDs and lack of generic/shared naming conventions.
Pass/Fail Test: If active accounts are found with generic names (e.g., “sales_team”, “temp_staff”) used by multiple people, mark as Non-Compliant.
3. Identity Verification Standards for Joiners Validated
Verification Criteria: A formal process exists to verify the identity of an individual before an account is provisioned in the corporate environment.
Required Evidence: HR onboarding records or IT tickets showing that government-issued ID or equivalent background checks were confirmed prior to UID creation.
Pass/Fail Test: If accounts are provisioned based solely on a manager’s request without a validated HR link or ID verification step, mark as Non-Compliant.
4. Identity Modification Trail during Role Changes Verified
Verification Criteria: Changes to a user’s identity attributes (e.g., department, role, name) are recorded and triggered by a formal “Mover” process.
Required Evidence: Audit logs from the IAM system or ticketing system showing the transition of a user from one department/role to another.
Pass/Fail Test: If a user’s role has changed but their identity attributes in the IAM system still reflect an old department or job function, mark as Non-Compliant.
5. Identity Revocation Timeliness for Leavers Confirmed
Verification Criteria: Digital identities are disabled or deleted immediately upon termination of employment or contract.
Required Evidence: Cross-reference of the last 10 leavers’ HR termination dates against the account “Disabled” timestamp in the Identity Provider.
Pass/Fail Test: If any identity remains “Active” or “Enabled” more than 24 hours after the individual’s formal departure, mark as Non-Compliant.
6. Identification of External/Third-Party Identities Verified
Verification Criteria: Identities belonging to contractors, vendors, or partners are clearly distinguishable from internal employee identities.
Required Evidence: IAM system report showing specific tags, naming prefixes, or distinct Organisational Units (OUs) for external identities.
Pass/Fail Test: If external consultants are provisioned as “Standard Employees” with no metadata identifying them as third parties, mark as Non-Compliant.
7. Dormant and Inactive Identity Cleanup Execution Evidenced
Verification Criteria: Identities that have not been used for a predefined period (e.g., 90 days) are automatically or manually identified and disabled.
Required Evidence: List of disabled accounts with “Last Logon” timestamps exceeding the policy threshold or automated cleanup script logs.
Pass/Fail Test: If the IAM system contains enabled accounts that have not logged in for over 180 days without a documented business exception, mark as Non-Compliant.
8. Segregation of Duties in Identity Creation Validated
Verification Criteria: The process ensures that the person who requests an identity is not the same person who approves and creates it.
Required Evidence: Workflow audit logs showing a “Requestor” (e.g., Hiring Manager) and a “Creator” (e.g., IT Admin) as distinct individuals.
Pass/Fail Test: If a single administrator can create an identity and grant it permissions without a secondary approval or HR trigger, mark as Non-Compliant.
9. Privilege Attribute Assignment Integrity Confirmed
Verification Criteria: Identity attributes (e.g., Group Membership, Security Clearance) are assigned based on the principle of least privilege.
Required Evidence: Review of “Domain Admin” or “Global Admin” groups to ensure only authorised, unique identities are present.
Pass/Fail Test: If an identity possesses “Super User” attributes that are not required for their documented job function, mark as Non-Compliant.
10. Identity Authentication Strength Alignment Verified
Verification Criteria: The level of identity verification and authentication required is proportional to the risks associated with the identity’s access level.
Required Evidence: Conditional Access Policy screenshots showing higher authentication requirements (e.g., FIDO2 keys) for administrative identities.
Pass/Fail Test: If high-privileged identities (e.g., Cloud Admins) use the same single-factor authentication as standard users, mark as Non-Compliant.
About the author
