Identity Controls for ISO 27001

ISO/IEC 27001 is the international standard for information security management. It does not prescribe products, but its Annex A controls lean heavily on identity, and auditors will expect you to show how access is granted, reviewed, and removed. This maps the identity-relevant controls to what you actually build.

What ISO 27001 expects of identity

The 2022 revision groups controls into themes. The identity-relevant ones include access control, identity management, authentication information, and privileged access:

Access control (A.5.15): a documented policy and least-privilege enforcement.
Identity management (A.5.16): a managed lifecycle for every identity, human and non-human.
Authentication information (A.5.17): secure handling of credentials, pushing toward MFA and passwordless.
Access rights (A.5.18): provisioning, review, and prompt removal, the joiner-mover-leaver lifecycle.
Privileged access (A.8.2): restricted, monitored, and time-bound.

What good looks like

SSO and MFA across in-scope systems, with phishing-resistant factors for privileged users.
Automated provisioning and deprovisioning via SCIM, so leavers lose access promptly.
Periodic access reviews with evidence, typically through IGA.
PAM for privileged accounts with session logging.

Common pitfalls

Access reviews that happen but are not evidenced; auditors want the artifact.
Orphaned and service accounts outside the lifecycle.
Privileged access granted permanently rather than just in time.

IAM audit preparation, SOC 2 for identity. Vendors: IGA, PAM.

Mapping identity to Annex A

The identity-relevant controls in the 2022 Annex A cluster tightly, and mapping them explicitly saves argument during certification:

A.5.15 Access control and A.5.18 Access rights: policy, provisioning, review, and removal. This is where access certification evidence lands.
A.5.16 Identity management: unique identities, lifecycle, and the handling of non-human identities.
A.5.17 Authentication information: credential issuance, MFA, and secure recovery.
A.8.2 Privileged access rights: allocation, review, and restriction of elevated access.
A.8.5 Secure authentication and A.8.15 Logging: the technical implementation and its audit trail.

What certification actually tests

Auditors test operation, not intent. The recurring findings in identity are predictable: access reviews completed but with no revocations, leavers removed from single sign-on while local and vendor accounts stayed live, privileged rights granted for a project and never withdrawn, and an MFA exemption list that has grown without review.

The corresponding evidence to keep is equally predictable. Review campaigns with revocation counts, a leaver reconciliation across systems outside SSO, a standing-privilege count trending down, and a dated exemption register with justification per entry.

Where the ISMS scope bites

ISO 27001 lets you scope the ISMS, and identity systems have a way of straddling the boundary. If your identity provider authenticates access to both in-scope and out-of-scope systems, it is in scope, and so are its administrators. Decide that early rather than during the audit, and treat the identity provider itself as tier-zero infrastructure. See what is IGA and zero standing privileges.