.svg)
At its core, Annex A 5.16 exists to prevent unauthorised access, reduce insider threats, and ensure accountability by tying actions to unique identities. It establishes identity governance as a foundational element of information security rather than a purely technical task.
In modern environments—where cloud platforms, remote work, SaaS tools, and automation dominate—identity has become the new security perimeter. ISO 27001 recognises this by requiring structured, auditable identity and access management practices.
What Annex A 5.16 Requires
Annex A 5.16 requires organisations to establish, document, and operate formal processes for managing identities and access rights throughout their lifecycle.
This includes defining how identities are created, approved, used, reviewed, modified, and revoked. The requirement applies to both human users and non-human identities such as service accounts, APIs, applications, and devices.
The control is preventative by design. It aims to stop unauthorised access before it occurs by enforcing governance, approvals, and monitoring across identity management activities.
The Purpose of Access Rights Management in an ISMS
Access rights management ensures that information is only accessible to those with a legitimate business need. Without structured identity governance, organisations are exposed to excessive access, orphaned accounts, privilege creep, and accountability gaps.
Within an Information Security Management System (ISMS), access rights management supports:
- Confidentiality by preventing unauthorised access
- Integrity by limiting who can modify data
- Availability by ensuring appropriate operational access
This control directly supports risk treatment decisions made during the ISO 27001 risk assessment process and must align with defined risk acceptance criteria.
Identity Management vs Access Control
While often confused, identity management and access control are not the same.
Identity management focuses on who or what is accessing systems. It governs identity creation, uniqueness, lifecycle management, and accountability.
Access control focuses on what those identities can do once access is granted. This is addressed more directly in Annex A 5.15.
Annex A 5.16 ensures identities are trustworthy, controlled, and auditable before access control rules are even applied.
Types of Identities Covered by Annex A 5.16
ISO 27001 requires organisations to manage all identity types, not just employees.
Human Identities
These include employees, contractors, consultants, and temporary workers. Each person must have a unique identity that is never shared.
Shared logins undermine accountability and are strongly discouraged unless strictly justified and controlled.
Non-Human Identities
Non-human identities include:
- Service accounts
- API keys
- Application accounts
- Robotic process automation (RPA) users
- Devices and system accounts
These identities often have elevated privileges and long lifespans, making them high-risk if unmanaged.
Annex A 5.16 requires the same governance discipline for non-human identities as for human users.
The Identity Lifecycle Under ISO 27001
A compliant access rights management process must address the entire identity lifecycle.
Identity Creation
Identity creation must follow a defined approval process. Access should not be granted informally or automatically without validation.
Creation processes typically require:
- Business justification
- Manager or system owner approval
- Role assignment
- Least-privilege access by default
Identity Modification
Access rights must be reviewed and adjusted when roles change. Promotions, department transfers, and project assignments often require access updates.
Failure to manage changes leads to privilege creep, one of the most common audit findings.
Identity Review
ISO 27001 expects periodic access reviews to confirm that access remains appropriate.
Reviews should validate:
- Continued business need
- Alignment with job role
- Removal of unused or excessive permissions
Identity Revocation
When access is no longer required—due to termination, contract end, or system decommissioning—identities must be revoked promptly.
Delayed revocation is a critical risk and frequently cited nonconformity in certification audits.
Unique Identification and Accountability
Each identity must be uniquely identifiable. This ensures that actions can be traced back to a specific individual or system.
Unique identification supports:
- Audit trails
- Incident investigations
- Legal and regulatory accountability
- Non-repudiation
Shared accounts remove accountability and must be avoided unless absolutely necessary, documented, and compensated with additional controls.
Shared and Privileged Accounts
ISO 27001 does not prohibit shared accounts outright, but it treats them as exceptions requiring strong justification.
Where shared or privileged accounts are necessary, organisations should implement:
- Restricted usage scenarios
- Strong authentication
- Activity logging
- Regular access reviews
- Named accountability through compensating controls
Privileged access should always be limited, monitored, and time-bound where possible.
Non-Human Identity Governance
Non-human identities often represent the greatest unmanaged risk.
ISO 27001 expects organisations to:
- Define ownership for each non-human identity
- Approve creation formally
- Limit privileges strictly
- Rotate credentials where applicable
- Revoke identities when systems are retired
Unmonitored service accounts are a common cause of breaches and audit failures.
Access Rights Management and Risk Assessment
Access rights decisions must align with the organisation’s risk assessment outcomes.
High-risk systems require stronger identity controls, while low-risk environments may allow simplified access.
Risk-based identity management ensures security controls remain proportionate and defensible during audits.
Evidence Required for Annex A 5.16 Compliance
Auditors expect clear, objective evidence that access rights management is operating effectively.
Typical evidence includes:
- Identity management policies
- Access provisioning workflows
- Joiner-mover-leaver records
- Access review logs
- De-provisioning evidence
- System access reports
- Authentication and activity logs
Evidence must show consistency, not one-off activity.
Common Audit Findings Related to Annex A 5.16
Organisations frequently fail this control due to operational gaps rather than missing documentation.
Common findings include:
- Delayed access removal for leavers
- Incomplete access reviews
- Unowned service accounts
- Excessive privileges
- Shared credentials without justification
- Lack of audit trails
These issues undermine trust in the ISMS and often lead to major nonconformities.
How Annex A 5.16 Connects to Other ISO 27001 Controls
Access rights management does not operate in isolation.
It directly supports:
- Clause 6.1 – Risk assessment and treatment
- Clause 7.2 – Competence
- Clause 7.3 – Awareness
- Annex A 5.15 – Access control
- Annex A 8 series – Operational security
Together, these controls form a coherent identity and access governance model.
Best Practices for High-Maturity Access Rights Management
High-maturity organisations treat identity governance as a continuous process, not an onboarding checklist.
Effective practices include:
- Centralised IAM tooling
- Automated joiner-mover-leaver workflows
- Role-based access models
- Regular access recertification
- Strong logging and monitoring
- Clear ownership for every identity
Automation significantly reduces risk and audit effort while improving consistency.
Why Annex A 5.16 Is Critical in Modern Environments
As organisations adopt cloud services, remote work, and automation, identity becomes the primary security boundary.
Perimeter-based security alone is no longer sufficient. ISO 27001 Annex A 5.16 ensures organisations govern who has access, why they have it, and when it should be removed.
Without strong access rights management, even the best technical controls fail.
