ISO 27001:2022 Annex A Control 5.16: Identity Management

Annex A control 5.16 sets out a framework for registering, approving, and administering non-human identities on any network. As part of the wider ISO 27001 Annex A, computer networks make use of identities to identify an entity’s underlying abilities, whether that entity is a user, a group of users, a device, or an IT asset.

{{snapshot}}

Control 5.16 at a glance

• Purpose: a framework for registering, approving and administering identities across a network.
• Two identity types: human (users or groups of users) and non-human (applications, systems and devices).
• Six procedures govern compliant identity handling, plus four steps to create an identity and grant access rights.
• New for 2022: unlike the 2013 control, 5.16 adds guidance for managing non-human entities. Explore related controls in the ISO 27001 hub.

{{/snapshot}}

Understanding Annex A Control 5.16

Control 5.16 describes how an organisation can identify who or what is accessing data at any given time, and how those identities gained access rights. Accessing data can be separated into two groups: human (users or groups or users) or non-human (applications, systems, and devices).

By maintaining risk and establishing the perimeter of all related information security operations, the control takes a preventative approach, tackling the main mode of governance that determines a business’s Identity and Access Management process.

How to use Control 5.16

In order to comply with Annex 5.16 an organisation should clearly express identity-based procedures in policy documents, as well as monitor staff adherence on a daily basis.

To make sure businesses meet cybersecurity standards, control 5.16 outlines six procedures. These are:

{{snapshot}}

The six identity procedures

• No sharing: an assigned identity may only be used by that individual — users must not share logins.
• Shared identities are used only when necessary and registered through a distinct process.
• Non-human entities get their own approval and registration process.
• Leavers: redundant identities are disabled and removed, with regular audits and prompt HR-to-IT notice.
• One entity, one identity: prevent duplicate identities and document all significant identity events.

{{/snapshot}}

Creating identities and granting access

There are four steps that businesses need to follow in control 5.16, outlining the process of creating an identity and granting it resource access rights. These are:

1. Develop a business case before creating an identity. Each new identity increases the complexity of identity management, so organisations should only create new identities when absolutely necessary.
2. Verify entities independently before assigning identities, whether they are human or non-human. Identity and Access Management procedures must ensure that individuals or assets have the necessary authority before an identity is established.
3. IT staff should create identities according to the requirements outlined in the business case and any associated change request documentation.
4. Assign identities to each access-based permission and role, along with any required authentication services.

{{snapshot}}

What Hicomply recommends

Identity sprawl — orphaned accounts, shared logins and forgotten service identities — is where most access-control findings originate. We recommend treating the "one entity, one identity" principle as a continuously monitored rule, not a policy you check once a year, and automating leaver de-provisioning so HR changes flow straight to IT. Our free compliance tools are a good starting point for mapping who holds which identity.

{{/snapshot}}

What are the changes from ISO27001:2013?

For the most part, Annex 5.16 covers the same ground as its 2013 counterpart, but the 2022 version also contains a comprehensive set of guidelines to address Identity and Access Management in its entirety. Humans and non-humans are no longer treated separately when it comes to general network administration.

There is no guidance on how to manage non-human entities in the 2013 control. Modern Identity and Access Management protocols mean it has become commonplace to talk interchangeably about human and non-human identities.