Introduction

If access control is the lock on the door, identity management is the list of people who own the keys and the process for adding, updating, or removing them.

ISO 27001 Control 5.16 ensures your organization knows exactly who is in your systems, why they’re there, and when their access should end.

Summary of Control 5.16: Identity Management

🔒 Control Title: Identity Management
📘 Source: ISO/IEC 27002:2022, Section 5.16
🧩 Control Category: Organizational
🔍 Attributes:

• Control Type: #Preventive / #Detective
• Security Properties: #Confidentiality, #Integrity, #Availability
• Cybersecurity Concepts: #Identify, #Protect
• Operational Capabilities: #Identity_and_Access_Management
• Security Domain: #Protection_and_Defense

Control Objective

To ensure that identities of users, devices, and systems are uniquely established, managed, and monitored throughout their lifecycle to prevent unauthorized access and misuse.

Implementation Guidance

1) Unique Identifiers for All Users:

• No shared accounts every user, device, or service gets a unique ID

2) Controlled Identity Creation:

• New identities created only with formal authorization

3) Identity Lifecycle Management:

• Provisioning: Create identity when someone joins
• Modification: Update access when role changes
• De-provisioning: Disable/delete identity when they leave

4) Periodic Reviews:

• Validate that each identity still belongs to an active, authorized entity

5) Integrate with Access Control:

• Link identities to your role-based access control (RBAC) and least privilege policy

6) Strong Authentication Tied to Identity:

• MFA, biometrics, or certificates to confirm the identity

Why This Control Matters

Without strong identity management:

• Ex-employees or contractors could still access your systems
• Shared accounts make accountability impossible
• Orphaned accounts become hidden backdoors for attackers

With strong identity management:

• You have full visibility of all active users and systems
• Access is tied to verified, authorized entities
• The attack surface is reduced significantly

Common Pitfalls to Avoid

• Leaving accounts active after people leave
• Using shared credentials to “make things easier”
• Not documenting who approved the creation of new identities
• Relying only on username/password without strong authentication

Canadian Cyber’s Take

At Canadian Cyber, we help organizations implement end-to-end identity management processes that keep systems clean, accountable, and secure.
From onboarding to offboarding, we make sure every identity is verified, managed, and monitored.

Ready to Take Control of Your Digital Identities?

We can help you set up ISO 27001-compliant identity management that prevents unauthorized access and strengthens accountability.
👉 Click here to get started.

• Share the blog on: