Skip to content
Start with Identity
Join free
Compliance · Intermediate

Identity Controls for ISO 27001

By SWI Community Team · Updated 2026-11-05 · 13 min

ISO 27001 identity controls are the Annex A controls in ISO/IEC 27001:2022 that govern who can access information and how: A.5.15 Access control, A.5.16 Identity management, A.5.17 Authentication information, A.5.18 Access rights, A.8.2 Privileged access rights and A.8.5 Secure authentication, with A.8.15 Logging and A.8.16 Monitoring activities producing the audit trail. The standard names outcomes, not products, so certification depends on evidence that these controls operate. This guide is for IAM, GRC and security teams preparing for certification or surveillance audits.

Where the 2022 edition stands in 2026

ISO published ISO/IEC 27001:2022 on 25 October 2022, according to the IAF's transition document IAF MD 26. The transition ended on 31 October 2025, and all certifications based on the 2013 edition expired or were withdrawn at that point. A climate action amendment, ISO/IEC 27001:2022/Amd 1:2024, is part of the climate action changes the IAF and ISO announced in February 2024, which name climate change as an issue to consider under clauses 4.1 and 4.2. It does not change any identity control.

The 2022 Annex A has 93 controls in four themes: organizational (37), people (8), physical (14) and technological (34), down from 114, according to a BCS summary of the ISO/IEC 27002 revision. For identity the important changes are renames and merges: "user registration and de-registration" became Identity management, "secure log-on procedures" became Secure authentication, and user access provisioning, review and removal were merged into Access rights. Monitoring activities is one of the 11 new controls.

Mapping Annex A to identity

Annex A control What it expects What you build Evidence an auditor samples
A.5.15 Access control Documented rules for logical and physical access, least privilege Access policy, role model, least privilege defaults Approved policy, role catalogue with owners
A.5.16 Identity management Full lifecycle for every identity, human and non-human HR-driven provisioning, service account ownership Identity inventory reconciled to HR and system owners
A.5.17 Authentication information Secure issuance, handling and recovery of credentials MFA, passkeys, secure reset at the help desk Enrollment coverage, recovery procedure, exemption register
A.5.18 Access rights Provision, review, modify and remove access SCIM provisioning, deprovisioning, certification campaigns Review results with revocation counts, leaver samples
A.8.2 Privileged access rights Restrict and manage elevated access PAM, just-in-time elevation, separate admin accounts Privileged account list, elevation logs, a falling standing count
A.8.5 Secure authentication Technically sound authentication SSO, phishing-resistant MFA for admins, session controls Conditional access or policy exports
A.8.15 Logging, A.8.16 Monitoring Record and watch activity Identity provider logs to SIEM, ITDR Log retention settings, alert samples
A.5.3 Segregation of duties Conflicting duties separated Toxic-combination rules in IGA Conflict reports and resolutions
A.5.19 Supplier relationships, A.6.5 Responsibilities after termination Supplier access and leaver obligations Time-bound vendor accounts, leaver reconciliation outside SSO Vendor account expiry dates, terminated-user samples

What certification actually tests

Auditors test operation, not intent. The recurring identity findings are predictable: access reviews completed with no revocations, leavers removed from SSO while local and vendor accounts stayed live, privileged rights granted for a project and never withdrawn, and an MFA exemption list that grew without review.

The evidence to keep is equally predictable: review campaigns with revocation counts, a leaver reconciliation across systems outside SSO, a standing-privilege count trending down, and a dated exemption register with a justification per entry.

Failure modes these controls exist to stop

  • Leavers who keep access (A.5.18, A.6.5). A former Cash App Investing employee downloaded customer reports after employment ended. At CrowdSec, a former employee's GitHub account left open to finish work kept a valid OAuth token that was used to copy about 170 private repositories. Both are orphaned account abuse.
  • Weak recovery (A.5.17). At MGM Resorts, a help desk call impersonating an employee led to control of Okta super administrator accounts. Verified recovery is part of authentication information, not a help desk nicety. See help desk social engineering.
  • Unrotated non-human credentials (A.5.16, A.5.17). Cloudflare was reached with one access token and three service account credentials stolen in the October 2023 Okta support breach that it had not rotated.
  • Accumulated rights (A.5.18, A.8.2). Mover entitlement accumulation is what an access review with zero revocations usually hides.

Where the ISMS scope bites

ISO 27001 lets you scope the ISMS, and identity systems straddle the boundary. If your identity provider authenticates access to both in-scope and out-of-scope systems, it is in scope, and so are its administrators. Decide that early, record it, and treat the identity provider as tier-zero infrastructure.

Checking a vendor's ISO 27001 certificate

Buyers often ask whether an identity vendor "holds ISO 27001:2022". Four checks matter more than the logo: the certificate cites the 2022 edition (2013 certificates are no longer valid), the scope covers the service you are buying rather than a head office, it was issued by an accredited certification body, and the Statement of Applicability does not exclude the access control themes. Use the identity buyer guides and vendor profiles such as Okta, Microsoft Entra ID and Ping Identity as a starting point, then confirm on the vendor's trust center.

Tooling that maps cleanly

IGA platforms such as SailPoint, Saviynt and Omada (which acquired EmpowerID on 24 September 2026) produce A.5.18 review evidence. PAM tools such as Idira (formerly CyberArk), now part of Palo Alto Networks, and BeyondTrust cover A.8.2. Tools do not certify you; the evidence they export does.

Where to start

  1. Settle the ISMS scope for identity. Put the identity provider and its administrators in scope if it authenticates any in-scope system, and record the decision.
  2. Map controls to owners. Assign each control in the table to a named owner with the system that produces its evidence.
  3. Bring every identity into the lifecycle. Reconcile human, service and vendor accounts against HR and system owners, including local accounts outside SSO. See joiner-mover-leaver.
  4. Run one evidenced review campaign. Keep revocation counts, not just completion, as the access certification artifact.
  5. Start the registers auditors ask for. A dated MFA exemption register and a standing-privilege count you can show trending down.

ISO 27001 glossary entry, SOC 2 for identity, IAM audit preparation, what is IGA, zero standing privileges rollout.

Frequently asked questions

Which ISO 27001 Annex A controls cover identity and access management?
In ISO/IEC 27001:2022 the core identity controls are A.5.15 Access control, A.5.16 Identity management, A.5.17 Authentication information, A.5.18 Access rights, and A.8.2 Privileged access rights, supported by A.8.5 Secure authentication and A.8.15 Logging. Mapping your identity controls to these explicitly before certification saves argument with the auditor.
Does ISO 27001 require MFA?
ISO 27001 does not prescribe specific products or methods. A.5.17 covers the secure handling of authentication information and A.8.5 covers secure authentication, which in practice pushes toward MFA and passwordless. Auditors expect SSO and MFA across in-scope systems, with phishing-resistant factors for privileged users, and they look at whether your MFA exemption list is dated and reviewed.
What do ISO 27001 auditors test for access reviews?
Operation, not intent. Common findings are access reviews completed with no revocations, leavers removed from SSO while local and vendor accounts stay live, project privileges never withdrawn, and an unreviewed MFA exemption list. Keep review campaigns with revocation counts, a leaver reconciliation across systems outside SSO, a falling standing-privilege count, and a dated exemption register with a justification per entry.
Are ISO 27001:2013 certificates still valid?
No. The International Accreditation Forum's transition rules (IAF MD 26) gave certified organizations 36 months from the October 2022 publication, ending 31 October 2025, and all certifications based on ISO/IEC 27001:2013 expired or were withdrawn at the end of that period. When a vendor's security page still shows a 2013 certificate, ask for the current 2022 certificate and its scope statement.
Is our identity provider in scope for ISO 27001 certification?
If it authenticates access to any in-scope system, yes, and so are its administrators. ISO 27001 lets you scope the ISMS, but identity systems tend to straddle the boundary because one provider serves both in-scope and out-of-scope applications. Settle this early rather than during the audit, and treat the identity provider as tier-zero infrastructure.
Do service accounts fall under ISO 27001 identity management?
Yes. A.5.16 Identity management expects a managed lifecycle for every identity, human and non-human. Orphaned accounts and service accounts outside the joiner-mover-leaver process are a recurring pitfall, so give each non-human identity an owner, include it in provisioning and removal, and cover it in periodic access reviews with evidence.
Last reviewed By SWI Community TeamSuggest a correctionHow we research