Understanding Identity and Access Security

Introduction

Identity and Access Security is a fundamental component of cybersecurity concerned with establishing, verifying, controlling, and monitoring access to systems, applications, networks, data, devices, facilities, and other resources. It applies across organizations, critical infrastructure, government environments, industrial environments, and other technology-dependent ecosystems where access to resources must be appropriately controlled.

At its foundation, Identity and Access Security addresses a series of fundamental questions: Who or what is requesting access? How is the identity established and verified? What is the entity permitted to access? What actions is it allowed to perform? How is that access controlled? How can the activity be traced and attributed?

Identity and Access Security applies to both human and non-human identities. Human users may include employees, administrators, contractors, customers, and third parties. Non-human identities may include devices, applications, services, workloads, machines, and other system components. Each may require different mechanisms for identification, authentication, authorization, and access control.

Identity and Access Security extends beyond usernames and passwords. It encompasses identity management, authentication, authorization, access control, identity lifecycle management, provisioning, access revocation, identity governance, privileged access security, administrative controls, technical controls, physical controls, and accountability.

Several principles form the foundation of Identity and Access Security, including least privilege, need-to-know, separation of duties, strong authentication, appropriate authorization, controlled provisioning, timely access revocation, and accountability. These principles help ensure that access is granted according to legitimate requirements and that access rights are appropriately managed throughout their lifecycle.

Identity and Access Security also operates across diverse environments, including on-premises infrastructure, cloud environments, applications, databases, endpoints, networks, operational technology, industrial control systems, critical infrastructure, and physical facilities. As environments become increasingly interconnected, identities and access rights become an important part of the overall security architecture.

Understanding Identity and Access Security therefore requires more than understanding individual authentication technologies. It requires an understanding of how identity, identification, authentication, authorization, access, and accountability work together to control and govern access to resources.

Identity and Access Security and the CIA Triad

Identity and Access Security Role for Confidentiality

Confidentiality is the protection of information and resources from unauthorized access or disclosure. Identity and Access Security contributes to confidentiality by ensuring that access to sensitive information is granted only to authenticated and authorized entities.

Access rights can be defined according to a user’s role, responsibilities, business requirements, or other relevant attributes. Applying principles such as least privilege and need-to-know helps limit access to only the information and resources required for legitimate activities.

Authentication helps establish the identity of an entity requesting access, while authorization determines whether that entity is permitted to access the requested resource. Access controls can also restrict access based on factors such as location, device, time, network, or the sensitivity of the resource.

Identity and Access Security therefore supports confidentiality by controlling who can access information, what information they can access, and under what conditions access is permitted.

Identity and Access Security Role for Integrity

Integrity is the protection of information and resources against unauthorized or improper modification, deletion, or manipulation. Identity and Access Security supports integrity by ensuring that only appropriately authorized entities can modify systems, applications, configurations, and data.

Authorization mechanisms can distinguish between different levels of permissions, such as read, write, modify, execute, or administrative privileges. This allows access to be controlled according to the responsibilities of the identity.

Principles such as least privilege and separation of duties help reduce the possibility of unauthorized changes. Privileged access controls can further restrict administrative activities and provide additional monitoring of sensitive operations.

Accounting and accountability also support integrity by maintaining records of access and administrative activities. These records can help determine who performed an activity, what activity was performed, and when it occurred, supporting investigation and review of unauthorized or inappropriate changes.

Identity and Access Security Role for Availability

Availability is the ability of authorized users and systems to access required information and resources when needed. Identity and Access Security contributes to availability by ensuring that legitimate entities can obtain the access necessary to perform their required functions while preventing unauthorized access that could disrupt services.

Access controls can help protect critical systems and resources from unauthorized use, privilege abuse, and excessive access. Appropriate authentication and authorization mechanisms also help ensure that access controls do not unnecessarily prevent legitimate users, administrators, applications, or services from performing their required functions.

Identity lifecycle management is particularly relevant to availability. Timely provisioning ensures that authorized users receive the access they require, while appropriate modification and revocation ensure that access remains aligned with changing responsibilities.

For critical infrastructure and other highly available environments, identity and access controls must also account for operational continuity, emergency access, privileged administration, service accounts, and recovery activities. Access mechanisms should therefore be designed to support both security requirements and the continued operation of essential services.

Relationship Between Identity and Access Security and the CIA Triad

Identity and Access Security contributes to all three objectives of the CIA Triad through controlled access to resources.

• Confidentiality is supported by preventing unauthorized entities from accessing or disclosing information.
• Integrity is supported by restricting modification and administrative privileges to appropriately authorized entities and maintaining accountability for activities.
• Availability is supported by ensuring that authorized users and systems can obtain required access while protecting resources from unauthorized or disruptive access.

The three objectives are interconnected. Excessively broad access can create confidentiality and integrity risks, while overly restrictive access can interfere with availability and legitimate operations. Identity and Access Security therefore needs to establish access according to the identity, authorization, privilege, resource, context, and operational requirements of the environment.

AAA: Authentication, Authorization, and Accounting

AAA is a security framework that describes three closely related functions used to control and monitor access to resources: Authentication, Authorization, and Accounting. Together, these functions verify an entity’s identity, determine its permitted access, and record relevant access activities.

AAA can be applied across enterprise organizations, critical infrastructure, government environments, industrial systems, networks, applications, and other technology environments. The implementation and mechanisms may differ depending on the environment, but the underlying functions remain broadly applicable.

Authentication

Authentication is the process of verifying the claimed identity of an entity before access is granted. The entity may be a person, device, application, service, or other system component.

Authentication commonly uses one or more authentication factors, such as:

• Something the entity knows, such as a password or PIN
• Something the entity possesses, such as a security token or smart card
• Something inherent to the entity, such as a biometric characteristic

Multi-factor authentication combines multiple factors to provide stronger identity verification. Authentication can also involve certificates, cryptographic credentials, device identity, or other mechanisms appropriate to the environment.

Authentication answers the fundamental question:

“Can the claimed identity be verified?”

Authentication by itself does not determine what the authenticated entity is allowed to do. That function belongs to authorization.

Authorization

Authorization is the process of determining what an authenticated entity is permitted to access or perform.

Authorization decisions can be based on the identity, role, attributes, permissions, resource, requested action, and other contextual conditions. For example, an authenticated user may be permitted to view a particular application but may not be permitted to modify its configuration.

Authorization can control access to:

• Files and data
• Applications
• Networks and network services
• Databases
• Systems and infrastructure
• Administrative functions
• Physical facilities
• Critical infrastructure resources

Access control principles such as least privilege, need-to-know, separation of duties, and role-based access help determine and restrict the permissions assigned to an entity.

Authorization answers the question:

“What is this authenticated entity permitted to access or do?”

Accounting

Accounting is the process of recording information about access, system usage, and activities performed by authenticated entities. It provides a record of what occurred within a system or resource after access has been requested or granted.

Accounting information may include:

• Authentication and access events
• Successful and failed access attempts
• Resources accessed
• Actions performed
• Session start and end times
• Source or originating device or system
• Network connections and usage
• Administrative activities
• Privileged activities
• Changes to system or security configurations

Accounting records are commonly maintained through logs, audit trails, system records, and monitoring mechanisms. These records can be used to review access activity, investigate security incidents, identify unusual activity, support security monitoring, and provide evidence for audits and compliance requirements.

Accounting also requires appropriate protection of recorded information. Logs and audit records should be protected against unauthorized access, modification, deletion, or tampering so that they remain reliable for security and operational purposes.

In Identity and Access Security, accounting provides visibility into access and resource usage, complementing authentication and authorization by recording relevant activities associated with access.

Relationship Between Authentication, Authorization, and Accounting

The three AAA functions serve different but interconnected purposes in controlling access to resources.

Authentication verifies the identity of an entity requesting access.

Authorization determines what the authenticated entity is permitted to access or perform.

Accounting records relevant access and resource usage activities.

For example, when a user attempts to access a sensitive application, authentication verifies the user’s identity. Authorization then determines whether the user has the required permissions to access the application and perform specific actions. Accounting records relevant access and activity information associated with the session.

Together, AAA provides a foundation for controlled access, privilege management, access monitoring, and activity recording across enterprise, critical infrastructure, government, industrial, and other technology environments.

AAA in Identity and Access Security

AAA forms an important conceptual foundation for Identity and Access Security, but Identity and Access Security encompasses a broader set of capabilities. Identity lifecycle management, identity governance, provisioning, access reviews, access revocation, privileged access security, and physical access controls extend beyond the three core AAA functions.

Understanding AAA provides a foundation for understanding how identities are authenticated, authorized, and held accountable when accessing resources.

What Is Identity?

Identity is the set of characteristics and attributes that distinguish one entity from another within a particular environment. In cybersecurity, an identity represents who or what an entity is when it interacts with systems, applications, networks, data, devices, facilities, or other resources.

An identity can represent a person, device, application, service, workload, or another entity that requires access to a resource. It provides a basis for recognizing and managing that entity throughout its interaction with a technology environment.

An identity may be associated with information such as a unique identifier, name, role, group membership, organizational relationship, device information, or other attributes. The specific information associated with an identity depends on the type of entity and the requirements of the environment.

Identity itself does not establish that an entity is genuine or determine what it is permitted to access. Identification allows an entity to present or claim an identity, authentication verifies the claimed identity, and authorization determines what that identity is permitted to access or perform.

Identity Attributes

Identity attributes are characteristics or pieces of information associated with an identity. They can be used to describe an entity, manage its identity, or support access-related decisions.

Examples include:

• Unique identifier
• Name
• User or account identifier
• Organizational role
• Department or function
• Group membership
• Employment or relationship status
• Device information
• Application or service identifier
• Security-related attributes
• Digital certificates
• Credential-related information

Different environments may use different attributes depending on their identity and access requirements.

Identity Claims

An identity claim is a statement or assertion about an identity presented by an entity or provided by an identity service. Claims can contain information about an entity that may subsequently be used during authentication or authorization.

For example, an identity service may provide claims containing a user’s identifier, role, group membership, or other attributes. An application can use these claims when making access decisions according to its authorization requirements.

Identity claims should be appropriately validated and trusted before being used for security-sensitive decisions.

Types of Identity

Identity types can broadly be divided into human identities and non-human identities. The distinction is important because different identity types can have different lifecycle requirements, authentication mechanisms, privileges, and access management considerations.

Human Identities

Human identities represent people who interact with systems, applications, networks, data, facilities, or other resources.

Examples include employees, administrators, contractors, customers, partners, suppliers, temporary users, and external users.

A person may have multiple accounts or access relationships across different environments. Managing these identities throughout their lifecycle is therefore an important part of Identity and Access Security.

Non-Human Identities

Non-human identities represent entities that are not people but require an identity to interact with systems or resources. They are increasingly important as applications, automated processes, cloud workloads, connected devices, and machine-to-machine communications become integral to technology environments.

Device and Machine Identities

Device and machine identities are associated with servers, workstations, network devices, industrial devices, sensors, and other connected systems. They can be established using certificates, cryptographic credentials, device identifiers, or other identity mechanisms.

Service Accounts

Service accounts are identities used by services or automated processes to access systems and resources without direct human interaction. Their permissions should be limited to the requirements of the service or process.

Application Identities

Application identities are associated with applications that require access to other applications, databases, APIs, files, or infrastructure resources. They allow applications to authenticate and operate under defined permissions.

Workload Identities

Workload identities are identities assigned to software workloads such as containers, virtual machines, serverless functions, and other dynamically deployed computing workloads. They enable workloads to authenticate to and access required resources.

API Identities

API identities are identities used by applications, services, or other software components when communicating with APIs and other services. They help establish which application or service is making a request and allow access to be controlled according to defined permissions.

Identity Sources and Directories

Identity information can originate from different authoritative or trusted sources. These may include human resources systems, customer databases, directories, identity providers, device-management systems, and application-specific identity stores.

Directories provide mechanisms for storing and retrieving identity information and associated attributes. Identity services may use directories to support authentication, authorization, account management, and access administration.

Identity Registration and Proofing

Identity registration is the process of creating and establishing an identity within an environment. It may involve collecting required identity information, assigning a unique identifier, establishing identity attributes, and associating appropriate credentials or authentication mechanisms.

Identity proofing establishes confidence that an identity belongs to the claimed entity. The level of proofing required depends on the sensitivity of the environment, resources, and activities associated with the identity.

Identity Ownership

Each identity should have an appropriate owner or responsible authority for its creation, management, use, and lifecycle. Ownership helps establish responsibility for identity information, access requirements, and changes to the identity.

Identity ownership is particularly important for privileged accounts, service accounts, application identities, and other non-human identities where responsibility may otherwise be unclear.

Identification and Authentication

Identification and authentication are distinct but closely related functions within Identity and Access Security. They work together to establish the identity of an entity requesting access and verify that identity before access is granted.

When an entity makes an access request, identification occurs first. The entity presents an identifier or identity claim, allowing the system to determine which identity is requesting access. For example, a user may provide a username or user ID, while a device, application, or service may present its corresponding identity.

Once the identity being claimed has been identified, authentication verifies that identity. The system uses one or more authentication mechanisms, such as a password, authentication token, certificate, or biometric factor, to establish that the entity requesting access is legitimately associated with the identified identity.

After successful authentication, the system can proceed to authorization, which determines what the authenticated identity is permitted to access or perform.

This sequence establishes an important distinction between identifying an entity, verifying its identity, and determining its permitted access.

Identification

Identification is the function through which an entity presents or claims an identity to a system or resource.

An identifier distinguishes one entity from another within a particular environment. Examples include:

• Username or user ID
• Employee or customer identifier
• Device identifier
• Account identifier
• Application identifier
• Service identity
• Certificate identity
• Workload identity

Identification does not by itself establish that the entity is genuinely associated with the claimed identity. The presented identity must be verified through an appropriate authentication mechanism.

Identity Proofing

Identity proofing is the process of establishing confidence that an identity belongs to the claimed entity during identity registration or enrollment.

For a human identity, identity proofing may involve verifying information or evidence associated with the person before an account or credential is established.

For non-human identities, proofing may involve establishing the identity and ownership of a device, application, service, workload, or other entity before it is allowed to participate in an environment.

The level of identity proofing should be appropriate to the sensitivity and risk associated with the identity and the resources it may access.

Identity Verification

Identity verification involves checking identity information or evidence against trusted sources to establish confidence that an entity corresponds to its claimed identity.

During enrollment, identity verification may form part of identity proofing. Authentication subsequently verifies that an entity requesting access controls an authenticator associated with an established identity.

Identity verification and authentication are closely related, but their terminology and implementation may differ depending on the identity system and context.

Authentication

Authentication is the function of verifying the claimed identity of an entity.

Authentication mechanisms use evidence associated with the identity to determine whether the entity can legitimately authenticate as that identity. The evidence may be based on knowledge, possession, or an inherent characteristic.

Authentication can be applied to:

• Human users
• Devices
• Applications
• Services
• Workloads
• Network connections
• Other system entities

Successful authentication establishes a level of confidence in the identity. It does not by itself determine what the entity is permitted to access or perform. Those decisions belong to authorization.

Authentication Factors

Authentication factors are categories of evidence used to verify an identity.

Something You Know

Information known by the entity, such as:

• Password
• PIN
• Passphrase
• Security answer

Something You Have

A physical or digital object possessed by the entity, such as:

• Smart Card
• Hardware Security Token
• Mobile Device
• Authentication Token
• Cryptographic Authenticator

Something You Are

A characteristic inherent to the entity, commonly a biometric characteristic, such as:

• Fingerprint
• Facial characteristics
• Iris characteristics
• Voice characteristics

Types of Authentication

Authentication can be implemented using different mechanisms and approaches depending on the type of identity, the environment, the resources being accessed, and the level of security required.

Password Authentication

Password authentication uses a secret password or passphrase to verify a claimed identity. The entity requesting access provides the password associated with the identified account, and the authentication system verifies it against securely stored password verification information.

Passwords are widely used because they are simple to implement and operate, but they are also exposed to risks such as guessing, credential theft, reuse, phishing, and credential stuffing. Appropriate password policies and secure credential management are therefore important components of password-based authentication.

Smartcards and Tokens

Smartcards and authentication tokens use something the entity has as evidence of identity.

A smartcard can contain credentials or cryptographic keys that are used during authentication. Authentication tokens may be hardware-based or software-based and can provide a one-time password, cryptographic response, or other authentication information.

These mechanisms can provide stronger authentication than passwords alone and are commonly used where possession-based authentication is required.

Biometrics

Biometric authentication uses a physical or behavioral characteristic associated with an individual to support identity verification.

Common biometric characteristics include:

• Fingerprints
• Facial characteristics
• Iris characteristics
• Voice characteristics

Biometric authentication can provide convenient authentication without requiring the user to remember a password or carry a separate authentication device. However, biometric information requires appropriate protection because biometric characteristics are inherently associated with the individual and generally cannot be replaced in the same way as a password.

Multi-Factor Authentication

Multi-Factor Authentication (MFA) uses two or more different authentication factors to verify an identity.

The factors are generally based on:

• Something the entity knows
• Something the entity has
• Something the entity is

For example, authentication may require a password together with a hardware security key or a biometric factor.

MFA provides stronger identity verification than relying on a single authentication factor because compromise of one factor does not necessarily provide sufficient evidence to complete authentication.

Device Authentication

Device authentication verifies the identity of a device before allowing it to connect to or access a system or service.

Devices may authenticate using mechanisms such as:

• Device certificates
• Cryptographic keys
• Hardware-backed credentials
• Device-specific credentials
• Trusted platform capabilities

Device authentication is particularly relevant where access depends not only on the identity of a user but also on whether the device being used is known, registered, or trusted.

Certificate-Based Authentication

Certificate-based authentication uses a digital certificate and an associated cryptographic private key to authenticate an identity.

Certificates can be used to authenticate:

• Users
• Devices
• Applications
• Services
• Workloads

X.509 certificates are widely used for certificate-based authentication in technologies such as TLS, enterprise networks, VPNs, and other environments requiring cryptographic identity verification.

Passwordless Authentication

Passwordless authentication allows an entity to authenticate without using a traditional password as the primary authentication mechanism.

Examples include:

• Passkeys
• Hardware security keys
• Platform authenticators
• Cryptographic credentials
• Biometrics used with cryptographic authenticators

Passwordless authentication can reduce risks associated with password theft, reuse, guessing, and phishing. The security of passwordless authentication depends on the underlying authentication mechanism and how credentials are protected.

Adaptive and Risk-Based Authentication

Adaptive and risk-based authentication evaluates contextual information when determining whether and how an entity should be authenticated.

Factors considered may include:

• User identity
• Device
• Network
• Location
• Time
• Access behavior
• Resource sensitivity
• Previous authentication activity
• Detected security risk

For example, an authentication system may allow a familiar access pattern with the normal authentication requirements but request additional verification when the circumstances indicate a higher level of risk.

Authentication Assurance

Authentication assurance represents the level of confidence that an authentication process has correctly established an entity’s identity.

The level of assurance can depend on factors such as:

• Strength of the authentication mechanism
• Number and independence of authentication factors
• Reliability of identity proofing
• Protection of authentication credentials
• Security of the authentication process
• Resistance to credential compromise

Higher-assurance authentication is generally appropriate when access involves sensitive information, privileged functions, critical systems, or other resources where stronger identity verification is required.

Authentication assurance should therefore be considered in relation to the risk and sensitivity of the resource being accessed, rather than treating one authentication mechanism as universally appropriate for every environment.

Identity Management

Identity management is the set of principles, practices, and controls used to establish, maintain, and manage identities and their associated information. It applies to both human and non-human identities and supports their use across systems, applications, networks, data, devices, services, and other resources.

Identity management includes managing identity records, accounts, attributes, credentials, and relationships with identity services. It also helps maintain the accuracy, consistency, availability, and appropriate use of identity information.

Account Management

Account management involves creating, maintaining, modifying, disabling, and removing accounts associated with identities.

An account provides an identity with a means of interacting with a system or service. Account management includes activities such as assigning account identifiers, maintaining account status, managing account ownership, and controlling account activation and deactivation.

Account management should ensure that accounts remain associated with valid identities and that unnecessary, inactive, or unauthorized accounts are appropriately addressed.

Profile Management

Profile management involves maintaining information and attributes associated with an identity or account.

A profile may contain information such as name, role, department, contact information, organizational relationship, group membership, and other attributes required by systems and services.

Accurate profile information is important because identity attributes may be used by authentication, authorization, provisioning, and governance processes.

Password Management

Password management covers the controls and practices used to create, protect, change, reset, and retire passwords associated with identities.

It includes password creation requirements, secure password storage, password changes, password resets, recovery mechanisms, and handling of compromised credentials.

Password management should protect passwords from unauthorized disclosure and reduce risks associated with weak, reused, or compromised passwords.

Directory Management

Directory management involves maintaining identity information and associated attributes within directory services.

Directories provide centralized or distributed repositories for identity information that can be used by systems, applications, and services. They may contain information about users, groups, devices, applications, services, and other entities.

Directory management includes maintaining directory entries, attributes, group memberships, organizational structures, synchronization, and access to directory information.

Credential Management

Credential management covers the lifecycle and protection of credentials used by identities to authenticate.

Credentials may include passwords, cryptographic keys, certificates, authentication tokens, and other authentication information.

Credential management includes credential issuance, storage, protection, renewal, rotation, recovery, revocation, and retirement. Appropriate credential management helps prevent unauthorized use of identities when credentials are exposed or compromised.

Identity Federation

Identity federation enables an identity established by one trusted identity system to be recognized by another system or organization.

Federation allows identities to be used across different security domains without requiring each relying system to independently maintain the complete identity information and authentication process.

Federated identity environments commonly involve an identity provider and one or more relying parties or service providers. Trust relationships and defined federation protocols allow identity information and authentication results to be exchanged between participating systems.

Identity Synchronization

Identity synchronization keeps identity information consistent across multiple identity stores, directories, applications, and services.

An organization or environment may maintain identity information in several systems. Synchronization can ensure that changes to identity attributes, account status, group membership, or other relevant information are reflected in systems that depend on that information.

Synchronization should address issues such as conflicting information, failed updates, duplicate identities, and delays between systems.

Identity Ownership

Identity ownership establishes responsibility for an identity and its associated information, accounts, or access relationships.

An identity owner or designated responsible party may be responsible for ensuring that the identity is legitimate, its information remains appropriate, and its associated access continues to have a valid purpose.

Clear ownership is particularly important for privileged identities, service accounts, application identities, and other non-human identities, where responsibility may otherwise be unclear.

Identity ownership also supports identity governance by providing a basis for reviewing identity information, access requirements, and lifecycle decisions.

Identity Lifecycle Management

Identity Lifecycle Management is the set of processes and controls used to manage an identity throughout its existence. It begins when an identity is established and continues through changes to the identity and its associated access until the identity is no longer required.

Identity lifecycle management applies to human and non-human identities, although the specific lifecycle activities may differ depending on the type of identity. Effective lifecycle management helps ensure that identities are created for legitimate purposes, maintained accurately, and removed or disabled when they are no longer required.

Identity Creation

Identity creation is the establishment of a new identity within an environment. It involves defining the identity, assigning a unique identifier, establishing relevant attributes, and associating the identity with the appropriate identity records.

For human identities, creation may occur when a person joins an organization or becomes eligible to use a service. For non-human identities, creation may occur when a device, application, service, or workload requires an identity.

Identity creation should be based on an established business or operational requirement and should include appropriate ownership and verification.

Identity Provisioning

Identity provisioning is the process of making an identity available within the systems, applications, directories, and services that require it.

Provisioning may involve creating accounts, assigning identity attributes, establishing credentials, and providing the required access based on approved requirements.

Provisioning should ensure that an identity receives only the access necessary for its intended purpose.

Identity Modification

Identity modification involves changing information or attributes associated with an existing identity.

Changes may include updates to:

• Name or contact information
• Organizational relationship
• Role or responsibilities
• Group membership
• Employment or relationship status
• Authentication information
• Other identity attributes

Identity modifications should be properly authorized and reflected in the systems that depend on the affected identity information.

Identity Suspension

Identity suspension temporarily prevents an identity from being used while retaining the identity and its associated information.

Suspension may be appropriate when an identity is temporarily inactive, under investigation, subject to a security concern, or otherwise should not be permitted to authenticate for a period of time.

Suspension provides a reversible control when permanent deactivation or deletion is not yet required.

Identity Revocation

Identity revocation removes the validity of an identity, credential, or associated authorization when it should no longer be trusted or used.

Revocation may be required when credentials are compromised, an identity is no longer legitimate, or a trust relationship has been withdrawn.

Revocation can involve invalidating credentials, certificates, tokens, or other mechanisms associated with the identity.

Identity Deactivation

Identity deactivation disables an identity or its associated accounts from being used to access systems and resources.

Deactivation is commonly performed when an identity is no longer actively required but its information may need to be retained for operational, legal, regulatory, security, or audit purposes.

For example, a user’s accounts may be disabled when the user leaves an organization while relevant records are retained according to applicable requirements.

Identity Deletion

Identity deletion is the removal of an identity and associated identity information when retention is no longer required.

Deletion should be performed only after considering applicable business, legal, regulatory, security, and retention requirements. Some identity records may need to be retained even after an identity has been deactivated.

Identity deletion should also consider dependent accounts, credentials, access relationships, and records to prevent orphaned or inconsistent identity information.

User Lifecycle Management

User Lifecycle Management focuses specifically on managing a human user’s identity, accounts, credentials, and access throughout the period in which the user requires access to an environment.

It is a specific application of Identity Lifecycle Management. While Identity Lifecycle Management can apply to both human and non-human identities, User Lifecycle Management addresses the lifecycle of human users.

The lifecycle is commonly described through three stages: Joiner, Mover, and Leaver (JML). Each stage requires appropriate management of the user’s identity and access so that access reflects the user’s current role, responsibilities, and legitimate requirements.

Joiner

A Joiner is a new user who enters an environment and requires an identity, accounts, and access to perform assigned responsibilities.

The Joiner stage establishes the user’s identity and provides the initial access required for the user’s role.

User Onboarding

User onboarding is the process of establishing a new user’s identity and preparing the user to perform their assigned responsibilities.

It may involve:

• Establishing the user’s identity
• Creating required accounts
• Assigning identity attributes
• Establishing authentication credentials
• Assigning roles and group memberships
• Identifying required applications and resources
• Obtaining appropriate access approvals

Onboarding should be based on verified identity information and the user’s legitimate operational requirements.

User Provisioning

User provisioning is the process of creating and configuring the accounts and access required by a user.

Provisioning may include creating accounts, assigning roles and groups, establishing credentials, and providing access to applications, systems, networks, data, and other resources.

Provisioning should follow approved access requirements and the principle of least privilege. Access should be limited to what the user requires to perform their assigned responsibilities.

Mover

A Mover is an existing user whose role, responsibilities, location, assignment, or other relevant attributes change, resulting in a change to their access requirements.

The Mover stage is important because a user may no longer require some existing access while requiring new access associated with changed responsibilities.

User Role Changes

User role changes occur when a user’s responsibilities or assigned role changes.

The change should trigger a review of the user’s existing access to determine:

• Which access remains necessary
• Which access is no longer required
• Which new access is required
• Whether privileged access is involved
• Whether separation-of-duties requirements are affected

Simply adding new access without reviewing existing access can result in privilege accumulation, where users retain permissions from previous roles that are no longer required.

Access Modification

Access modification involves changing a user’s existing accounts, roles, group memberships, permissions, privileges, or application access to reflect their current requirements.

Modification may involve both granting new access and removing existing access. Appropriate authorization and approval should be obtained for changes, particularly where sensitive or privileged access is involved.

Leaver

A Leaver is a user whose relationship with an environment has ended or whose access is no longer required.

The Leaver stage ensures that access is appropriately removed while required records and information are retained according to applicable requirements.

User Offboarding

User offboarding is the process of managing a user’s departure from an environment.

It may involve:

• Disabling user accounts
• Removing application and system access
• Revoking authentication credentials
• Removing group memberships
• Revoking privileged access
• Terminating active sessions
• Recovering assigned devices
• Recovering authentication tokens or other access mechanisms
• Identifying and addressing accounts associated with the departing user

Access Revocation

Access revocation is the process of removing or invalidating access that is no longer authorized or required.

Revocation may involve disabling accounts, removing permissions, invalidating credentials, revoking certificates or tokens, terminating sessions, and removing access to applications, systems, networks, and data.

Access revocation is particularly important when a user leaves an environment, but it may also be required when credentials are compromised, access is no longer justified, or a security requirement requires access to be withdrawn.

Effective User Lifecycle Management helps ensure that a user’s access remains appropriate throughout the user’s period of access, while reducing the risk of excessive, outdated, orphaned, or unauthorized access.

Identity and Access Principles

Identity and access security is based on fundamental principles that guide how identities are authenticated, how access is granted, and how permissions are controlled. These principles apply across systems, applications, networks, data, devices, services, and other resources.

The principles provide a foundation for designing and operating access controls without depending on a particular technology or product.

Least Privilege

Least privilege means providing an identity with only the permissions and access necessary to perform its authorized responsibilities.

Access should be limited in scope, duration, and privilege level where appropriate. When requirements change, access that is no longer necessary should be removed.

Least privilege applies to human and non-human identities, including users, administrators, applications, services, and workloads.

Need to Know

Need to know means providing access to information or resources only when the identity has a legitimate requirement to access them.

An identity may have a valid role within an environment but still not require access to every resource associated with that role.

Need to know is particularly important when protecting sensitive, confidential, or mission-critical information.

Separation of Duties

Separation of Duties (SoD) prevents critical or conflicting responsibilities from being concentrated in a single identity.

For example, the same individual may be prevented from both initiating and approving a sensitive transaction.

Separation of duties reduces the risk that a single identity can perform an entire sensitive activity without appropriate independent oversight.

Default Deny

Default deny means that access is denied unless it has been explicitly permitted.

A system should not assume that an identity is authorized simply because the identity exists or has successfully authenticated.

This principle helps reduce unintended access resulting from incomplete, incorrectly configured, or overly broad permissions.

Explicit Authorization

Explicit authorization means that access should be granted based on a defined and authorized access decision.

Successful authentication establishes confidence in an identity, but authentication alone does not determine what that identity is allowed to access.

Authorization should consider applicable policies, roles, permissions, resource requirements, and other relevant conditions.

Strong Authentication

Strong authentication uses authentication mechanisms that provide an appropriate level of confidence in an identity.

The required strength should be based on the sensitivity of the resource, the potential impact of unauthorized access, and the threats affecting the environment.

Stronger authentication may include multiple factors, cryptographic credentials, certificates, hardware authenticators, or other appropriate mechanisms.

Multi-Factor Authentication

Multi-Factor Authentication (MFA) requires two or more different authentication factors to verify an identity.

The factors may be based on something the entity knows, has, or is.

MFA reduces reliance on a single authentication factor and can limit the impact of a compromised password or other individual credential.

Just-in-Time Access

Just-in-Time (JIT) access provides access only when it is required and for an appropriate period of time.

Instead of maintaining elevated access continuously, an identity may receive the required privilege when needed and have it automatically removed after the approved period.

JIT access is particularly useful for privileged and sensitive access.

Just-Enough Access

Just-enough access provides an identity with only the specific permissions required to perform an intended task.

It focuses on limiting the scope of access rather than simply providing broad access associated with a role.

For example, an administrator who needs to restart a service may not require unrestricted administrative permissions across the entire system.

Privileged Access Control

Privileged access control applies additional controls to identities that have elevated permissions or can perform sensitive administrative operations.

Such controls may include:

• Separate administrative accounts
• Strong authentication
• Privilege elevation
• Just-in-time access
• Credential protection
• Session monitoring
• Privileged activity logging

The objective is to reduce the risk associated with highly powerful identities.

Access Review

Access review is the periodic examination of an identity’s permissions and access to determine whether they remain appropriate and necessary.

Reviews may consider the identity’s current role, responsibilities, resource requirements, and changes since access was originally granted.

Access that is no longer justified should be modified or removed.

Continuous Verification

Continuous verification means that trust in an identity or access decision should not be treated as permanent simply because authentication was previously successful.

Relevant conditions can change during a session or over time, including the identity’s risk, device state, location, behavior, or resource being accessed.

Access decisions can therefore be reevaluated when circumstances or risk conditions change.

Accountability and Traceability

Accountability and traceability ensure that identity and access activities can be associated with the identity or entity responsible for them.

Access-related activities should generate appropriate records that allow relevant events to be examined and investigated.

This requires reliable identity association, appropriate logging, protection of audit information, and controls that prevent unauthorized alteration or deletion of relevant records.

Secure by Default

Secure by default means that systems and services should initially operate with security-protective settings and access restrictions rather than requiring users or administrators to discover and disable unnecessary exposure.

Examples include:

• Disabling unnecessary accounts
• Restricting unnecessary services
• Limiting default permissions
• Requiring authentication where appropriate
• Avoiding unnecessary administrative privileges

Security should be incorporated into the initial configuration rather than added only after deployment.

Defense in Depth

Defense in depth uses multiple complementary security controls so that the failure or compromise of one control does not automatically result in unrestricted access.

For identity and access security, layers may include:

• Identity proofing
• Strong authentication
• Authorization
• Least privilege
• Network access controls
• Privileged access controls
• Session controls
• Monitoring and logging
• Access reviews

Defense in depth recognizes that no individual identity or access control should be treated as sufficient protection for every situation.

Identity and Access Governance

Identity and Access Governance is the set of principles, policies, processes, responsibilities, and controls used to govern identities and their access to resources.

It establishes how identity and access decisions are made, who is responsible for those decisions, how access is requested and approved, and how access is reviewed throughout its lifecycle.

Identity and Access Governance applies to human and non-human identities and can govern access to applications, systems, networks, data, devices, services, facilities, and other resources.

While Identity and Access Management focuses on managing identities and enforcing access, governance focuses on whether access is appropriate, why it is required, who should approve it, who owns it, and whether it should continue.

Identity Governance

Identity governance establishes the rules and responsibilities for managing identities throughout their lifecycle.

It addresses areas such as identity ownership, identity information, identity lifecycle activities, identity-related policies, and responsibilities associated with maintaining identities.

Effective identity governance helps ensure that identities are legitimate, properly managed, and associated with appropriate ownership.

Access Governance

Access governance establishes how access to resources is requested, approved, assigned, reviewed, modified, and removed.

It provides a framework for determining whether access is justified and whether it continues to be appropriate as roles, responsibilities, and requirements change.

Access governance should consider the sensitivity of resources, the identity requesting access, the purpose of the access, and applicable security requirements.

Identity Ownership

Identity ownership establishes responsibility for an identity and its associated information.

An identity owner is responsible for ensuring that the identity is legitimate, appropriately maintained, and managed according to defined requirements.

Clear ownership is particularly important for identities that may otherwise have unclear responsibility, such as service accounts, application identities, and other non-human identities.

Access Ownership

Access ownership establishes responsibility for the resources and access rights associated with an identity.

Resource or application owners may be responsible for determining which identities require access and approving or reviewing that access.

Clear access ownership helps ensure that access decisions are made by parties with appropriate knowledge of the resource and its requirements.

Roles and Entitlements

A role represents a defined set of responsibilities or access requirements associated with an identity.

An entitlement represents a specific access right, permission, privilege, or resource access that can be assigned to an identity.

Roles can be used to organize related entitlements and simplify access management. For example, a role may contain multiple application permissions required by users performing a particular function.

Entitlement Management

Entitlement management involves defining, assigning, modifying, reviewing, and removing access entitlements associated with identities.

It helps maintain control over permissions and privileges throughout their lifecycle.

Entitlement management should address who can receive an entitlement, under what conditions it can be granted, who can approve it, and when it should be removed.

Access Aggregation

Access aggregation is the process of collecting and consolidating information about an identity’s access across multiple systems, applications, platforms, and resources.

An identity may receive access through roles, groups, permissions, privileges, and different accounts. Aggregating this information provides a broader view of the identity’s overall access.

Access aggregation supports activities such as access reviews, access certification, excessive-access analysis, and Separation of Duties analysis.

Access Requests and Approvals

Access requests and approvals provide a controlled mechanism for obtaining access to resources.

A request should identify the identity, requested resource or entitlement, purpose of access, and other information required to support an access decision.

Approvals should be provided by appropriate authorities, such as managers, resource owners, application owners, or other designated approvers, depending on the nature and sensitivity of the access.

Separation of Duties

Separation of Duties (SoD) is a governance control that prevents conflicting responsibilities or combinations of access from being assigned to a single identity when doing so could create unacceptable risk.

For example, an identity may be prevented from both initiating and approving the same sensitive transaction.

SoD requirements should be considered when roles and entitlements are designed, assigned, and reviewed.

Access Certification and Recertification

Access certification is the formal confirmation that an identity’s access remains appropriate and justified.

An authorized reviewer examines the identity’s access and determines whether it should be retained, modified, or removed.

Recertification refers to performing this confirmation periodically or when specific conditions require another review.

Periodic Access Reviews

Periodic access reviews examine existing access to determine whether it remains necessary and appropriate.

Reviews may consider:

• Current role and responsibilities
• Assigned roles and entitlements
• Privileged access
• Sensitive resource access
• Conflicting access
• Changes in identity status
• Access that has not been used or is no longer required

Access reviews help identify excessive, outdated, unnecessary, or inappropriate access.

Access Risk Analysis

Access risk analysis evaluates the potential risk associated with an identity’s access.

Factors may include:

• Sensitivity of the resource
• Level of privilege
• Identity type
• Conflicting entitlements
• Volume of access
• Unusual or high-risk access
• Changes in responsibilities
• Criticality of the affected resource

Risk analysis can help prioritize access reviews and identify access requiring additional controls or approval.

Policy Compliance

Identity and Access Governance requires identities and access to comply with defined security policies, standards, procedures, and applicable requirements.

Policy compliance may involve verifying whether:

• Access is properly authorized
• Required approvals have been obtained
• Access reviews are performed
• Privileged access is appropriately controlled
• SoD requirements are satisfied
• Access is revoked when no longer required
• Identity records are maintained appropriately

Evidence and Auditability

Evidence and auditability ensure that identity and access decisions and activities can be demonstrated and reviewed.

Relevant evidence may include:

• Access requests
• Approval records
• Provisioning records
• Access review results
• Certification records
• Revocation records
• SoD analysis
• Policy exceptions
• Identity and access logs

Maintaining appropriate evidence supports security investigations, governance activities, audits, and compliance requirements.

Authorization and Access Control

Authorization and access control determine what an authenticated identity is permitted to access and what actions it is permitted to perform.

Authentication establishes confidence in the identity requesting access, while authorization determines the permissions available to that identity. Access control provides the mechanisms and controls used to enforce those authorization decisions.

Authorization can apply to human and non-human identities, including users, administrators, devices, applications, services, workloads, and APIs. It can govern access to systems, applications, networks, databases, data, devices, services, and other resources.

Purpose of Authorization

The purpose of authorization is to ensure that access to resources is permitted only when it is explicitly allowed by defined access rules, policies, permissions, or other authorization conditions.

Authorization determines whether an authenticated identity can:

• Access a specific resource
• Read, create, modify, or delete information
• Execute an application or service
• Perform administrative operations
• Access a particular function or feature
• Use a network or infrastructure resource
• Perform a specific transaction or operation

Authorization decisions can consider the identity, requested resource, requested action, applicable permissions, security policies, and contextual conditions.

Authentication and authorization therefore serve different purposes. Authentication verifies who or what is requesting access, while authorization determines what that identity is allowed to do.

Subjects and Objects

Access control commonly describes an access relationship using the concepts of subjects and objects.

A subject is an entity that requests access to a resource or performs an action. A subject may be a user, administrator, device, application, service, workload, or other identity.

An object is a resource that the subject attempts to access or operate on. Objects may include files, databases, applications, systems, network resources, devices, services, records, or other information resources.

An authorization decision evaluates whether a subject should be permitted to perform a particular action on an object.

For example, a user may request to read a database record. The user represents the subject, the database record represents the object, and the authorization mechanism determines whether the requested read operation is permitted.

Permissions, Rights, and Privileges

Permissions, rights, and privileges describe the access capabilities granted to an identity or subject.

A permission generally specifies an allowed operation on a resource, such as reading a file or accessing an application.

A right represents an authorized capability associated with a system, resource, or operation. Depending on the environment, rights may include the ability to log on, access a resource, or perform a particular system function.

A privilege generally refers to an elevated or specific capability that allows an identity to perform actions beyond ordinary access. Administrative operations are common examples of privileged activities.

These concepts can exist at different levels of an environment. An identity may have permission to read a particular document, a right to access a system, or a privilege to perform an administrative operation.

Access should be granted according to defined requirements and should be limited to the permissions, rights, and privileges necessary for the intended activity.

Authorization Decisions

An authorization decision determines whether a requested action should be allowed or denied.

The decision can consider multiple factors, including:

• Identity of the subject
• Requested resource
• Requested action
• Assigned permissions or entitlements
• Applicable access-control policies
• Role or attributes of the subject
• Resource sensitivity
• Device or connection characteristics
• Location or network context
• Time or access conditions
• Security risk
• Other environmental or policy conditions

A decision may result in allow, deny, or, in some environments, a requirement for additional conditions before access is permitted.

Authorization decisions can be evaluated when access is requested and may also be evaluated again during an active session or when the context of access changes.

Authorization Mechanisms

Authorization mechanisms provide the means through which access decisions are defined and enforced.

Common mechanisms include:

• Role-based authorization, where access is associated with defined roles.
• Attribute-based authorization, where decisions are based on attributes of the subject, resource, action, or environment.
• Rule-based authorization, where predefined rules determine whether access is permitted.
• Policy-based authorization, where centralized policies define access conditions and decisions.
• Access control lists, where permissions are associated directly with resources or objects.
• Relationship-based authorization, where access depends on the relationship between a subject and a resource.

Different mechanisms can be used independently or together. The appropriate mechanism depends on the complexity of the environment, resource sensitivity, access requirements, and security architecture.

Access Control Policies

Access control policies define the rules and conditions under which access to resources is permitted or denied.

A policy may specify:

• Who or what can access a resource
• Which resources can be accessed
• Which actions are permitted
• Conditions that must be satisfied
• Required authentication strength
• Restrictions on privileged access
• Conditions for remote or external access
• Requirements for access review and revocation
• Exceptions and approval requirements

Policies provide the basis for authorization decisions and access-control enforcement.

Access control policies should be aligned with security requirements, business or operational requirements, regulatory obligations, and the sensitivity and criticality of the resources being protected.

Authorization and access control therefore provide the operational foundation for controlling who or what can access a resource, what they can do with it, and under which conditions that access is permitted.

Access Control Models

Access control models define the principles and rules used to determine how access permissions are assigned and enforced. Different models provide different approaches for controlling access based on ownership, security classification, roles, attributes, relationships, or defined policies.

Discretionary Access Control

Discretionary Access Control (DAC) allows the owner or designated authority of a resource to determine who can access it and what operations they can perform.

Access permissions are generally associated with specific users or groups and can be delegated according to the capabilities of the system.

DAC provides flexibility where resource owners need control over their resources. However, decentralized permission management can make it more difficult to maintain consistent access control across large or complex environments.

Mandatory Access Control

Mandatory Access Control (MAC) determines access according to centrally defined security policies and classifications rather than the discretion of individual resource owners.

Subjects and objects can be assigned security labels or classifications, and access decisions are made according to defined security rules.

MAC is commonly associated with environments where information classification and centrally enforced security requirements are important.

Role-Based Access Control

Role-Based Access Control (RBAC) assigns permissions to roles rather than directly assigning every permission to individual identities.

An identity is assigned one or more roles, and the permissions associated with those roles determine the access available to the identity.

RBAC can simplify access administration by aligning permissions with defined responsibilities. It can also support Separation of Duties by preventing conflicting roles from being assigned to the same identity.

Rule-Based Access Control

Rule-Based Access Control uses predefined rules to determine whether access should be permitted.

Rules may consider conditions such as identity, resource, requested operation, network location, time, or other defined conditions.

For example, a rule may restrict access to a particular administrative service to approved identities connecting through an authorized network.

Attribute-Based Access Control

Attribute-Based Access Control (ABAC) makes authorization decisions using attributes associated with the subject, resource, action, and environment.

Subject attributes may include role, department, or identity type. Resource attributes may describe classification, sensitivity, or ownership. Environmental attributes may include location, device state, time, or network context.

ABAC can support more granular and context-dependent authorization than approaches based solely on predefined roles.

Relationship-Based Access Control

Relationship-Based Access Control (ReBAC) makes access decisions based on the relationship between the requesting identity and the resource.

For example, access may depend on whether a user is the owner of a resource, a member of a particular project, or associated with a particular account or service.

ReBAC is useful where access relationships are dynamic and cannot be adequately represented through roles alone.

Policy-Based Access Control

Policy-Based Access Control (PBAC) uses centrally defined policies to determine whether access requests should be permitted.

Policies can combine identities, attributes, roles, resources, actions, environmental conditions, and security requirements when making authorization decisions.

PBAC provides a policy-oriented approach that can support consistent authorization across multiple applications, services, and environments.

Administrative Access Controls

Administrative access controls are the governance and procedural controls used to manage how access is requested, approved, assigned, reviewed, modified, and revoked.

They establish the responsibilities and processes that support access control throughout the identity and access lifecycle.

Access Control Policies and Procedures

Access control policies define requirements for granting and managing access, while procedures describe how those requirements are implemented.

Policies and procedures may address authentication requirements, authorization, privileged access, access reviews, provisioning, revocation, exceptions, and responsibilities.

Access Requests and Approvals

Access requests provide a formal mechanism for obtaining access to resources.

A request may identify the requesting identity, required resource, requested permissions, business or operational justification, duration, and applicable approvals.

Approval should be provided by an appropriate authority based on the sensitivity and nature of the requested access.

Account Administration

Account administration involves creating, modifying, disabling, and removing accounts according to established requirements.

Administrative activities should maintain appropriate ownership, account status, identity information, and access relationships.

Access Provisioning and Modification

Access provisioning assigns approved access to an identity.

Access modification changes existing permissions, roles, groups, privileges, or resource access when requirements change.

Both activities should follow authorization requirements and maintain appropriate records of the changes.

Access Reviews and Recertification

Access reviews examine whether existing access remains necessary and appropriate.

Recertification provides formal confirmation that access should continue.

Reviews may consider normal user access, privileged access, sensitive resources, conflicting permissions, and changes in responsibilities.

Access Revocation

Access revocation removes access that is no longer authorized or required.

It may be triggered by user lifecycle changes, role changes, termination of a relationship, security incidents, policy violations, or changes in resource requirements.

Revocation may involve disabling accounts, removing permissions, invalidating credentials, terminating sessions, or removing group and role assignments.

Separation of Duties

Separation of Duties prevents conflicting responsibilities from being concentrated within a single identity.

Administrative processes should identify incompatible roles or access combinations and establish appropriate approval and review controls.

Administrative Responsibilities

Administrative responsibilities define who is responsible for identity and access activities.

Responsibilities may be distributed among identity administrators, resource owners, application owners, managers, security teams, system administrators, and other designated authorities.

Clear responsibility helps prevent unauthorized access changes and ensures that access decisions are made by appropriate parties.

Technical Access Controls

Technical access controls are technology-based mechanisms used to enforce authentication, authorization, access restrictions, and monitoring.

They operate within systems, applications, networks, databases, devices, cloud environments, and other technology resources.

Logical Access Control

Logical access control restricts access to digital resources through technical mechanisms.

It can control access to operating systems, applications, databases, networks, files, services, and other logical resources.

Authentication Controls

Authentication controls verify the identity of users and other entities before access is granted.

They may include passwords, multi-factor authentication, certificates, tokens, biometrics, passkeys, and other authentication mechanisms.

The strength of authentication should be appropriate to the sensitivity and risk associated with the requested access.

Authorization Controls

Authorization controls enforce decisions about what an authenticated identity can access and what actions it can perform.

They may use roles, attributes, policies, permissions, access control lists, or other authorization mechanisms.

Network Access Control

Network access control restricts connectivity to networks and network resources.

Controls may include network authentication, network segmentation, firewall policies, network access control mechanisms, VPN access controls, and device-based access requirements.

Network access controls can restrict both who or what can connect and which network resources can subsequently be reached.

Application Access Control

Application access control governs access to applications and their functions.

It can control application login, roles, permissions, transactions, administrative functions, APIs, and access to application data.

Application-level controls are particularly important where different users require different levels of functionality within the same application.

Database Access Control

Database access control restricts access to databases, tables, records, views, and database operations.

Controls can determine which identities can connect to a database and which operations they can perform, such as reading, inserting, modifying, or deleting data.

Additional controls may restrict access to particularly sensitive data within the database.

Privileged Access Controls

Privileged access controls protect identities and accounts capable of performing elevated or administrative operations.

Controls may include separate administrative accounts, strong authentication, privilege elevation, just-in-time access, credential protection, session monitoring, and detailed logging.

Session Controls

Session controls manage access after authentication has occurred.

They may include session timeouts, reauthentication, session termination, concurrent-session restrictions, session monitoring, and protection against unauthorized session use.

Session controls help reduce the risk associated with compromised or abandoned authenticated sessions.

Access Monitoring and Logging

Access monitoring and logging record relevant authentication, authorization, and access activities.

Records may include successful and failed authentication attempts, access decisions, privilege changes, administrative activities, resource access, and session activity.

Monitoring and logging support security detection, investigation, auditability, and incident response.

Automated Provisioning and Revocation

Automated provisioning and revocation use technical mechanisms to assign or remove access based on approved identity and access information.

Automation can help maintain consistency across multiple systems and reduce delays or errors in access changes.

Provisioning and revocation should remain governed by defined authorization, lifecycle, and policy requirements.

Physical Access Controls

Physical access controls restrict physical access to facilities, equipment, systems, and areas based on identity, authorization, and defined access requirements.

They complement logical and technical controls by protecting the physical locations and assets that support information processing and technology operations.

Physical Access Control Principles

Physical access should be limited according to the identity, authorization, purpose, and sensitivity of the area or asset.

Controls should address normal access, privileged physical access, visitors, temporary access, emergency access, and revocation of access.

Physical Identification

Physical identification establishes which person or entity is requesting physical access.

Identification may use identity cards, badges, employee identifiers, visitor credentials, or other identification mechanisms.

Identification alone does not establish that the person is authorized to enter the requested area.

Physical Authentication

Physical authentication verifies the identity presented for physical access.

Examples include badge authentication, personal identification numbers, biometrics, smartcards, or combinations of authentication factors.

Stronger authentication may be required for restricted or sensitive areas.

Physical Authorization

Physical authorization determines whether an authenticated individual is permitted to enter a particular facility, area, room, or restricted zone.

Authorization may depend on role, responsibility, access level, time, location, or specific approval.

Access to Facilities and Restricted Areas

Access restrictions can be applied to offices, data centers, network rooms, control rooms, laboratories, equipment areas, and other restricted locations.

Access should be limited to authorized individuals and may be further separated into zones based on sensitivity and operational requirements.

Physical Access Monitoring

Physical access monitoring records and observes entry, exit, and activity within controlled areas.

Mechanisms may include access-control logs, surveillance systems, alarms, security personnel, and environmental monitoring.

Monitoring supports detection, investigation, and auditability of physical access events.

Visitor Management

Visitor management controls access by individuals who do not have normal authorization for a facility or restricted area.

Controls may include visitor identification, registration, authorization, badges, escort requirements, access restrictions, and visitor records.

Physical Access Revocation

Physical access revocation removes physical access when authorization is no longer required.

This may include disabling access cards, recovering badges, removing biometric authorization, and updating physical access permissions.

Revocation should occur when a user’s role or relationship changes, access is no longer required, or a security requirement requires removal.

Functional Access Controls

Functional access controls describe the purpose or function performed by an access control. While administrative, technical, and physical access controls describe where and how controls are implemented, functional access controls describe what a control is intended to accomplish.

Access controls can prevent unauthorized access, identify unauthorized activity, correct access-control failures, establish required behavior, discourage misuse, provide alternative protection, or support recovery after a disruption.

Preventive Access Controls

Preventive access controls are designed to prevent unauthorized access or unauthorized activity before it occurs.

They establish restrictions or conditions that must be satisfied before access is permitted. These controls can restrict who or what can access a resource, what actions can be performed, and under which conditions access is allowed.

Examples include authentication, multi-factor authentication, authorization policies, access permissions, least privilege, network restrictions, physical barriers, and privileged access controls.

Preventive controls form the primary barrier against unauthorized access.

Detective Access Controls

Detective access controls are designed to identify unauthorized, suspicious, or inappropriate access activity.

These controls provide visibility into access events and help identify conditions that may indicate misuse, compromise, policy violations, or attempts to bypass access restrictions.

Examples include access logs, authentication logs, privileged activity monitoring, security monitoring, alerts, audit trails, and access reviews.

Detective controls are particularly important because preventive controls may be bypassed, misconfigured, or unable to address every access-related threat.

Corrective Access Controls

Corrective access controls are designed to address an identified access-control problem and restore appropriate access conditions.

They are applied after an unauthorized access event, control failure, misconfiguration, or other access-related issue has been identified.

Examples include disabling compromised accounts, removing unauthorized permissions, resetting credentials, terminating sessions, correcting access configurations, and revoking inappropriate access.

Corrective controls help return the environment to an appropriate access-control state.

Directive Access Controls

Directive access controls establish requirements, instructions, and expected behavior for managing and using access.

They guide users, administrators, and other responsible personnel on how access should be requested, approved, used, managed, and protected.

Examples include access control policies, procedures, standards, administrative requirements, acceptable-use requirements, and security awareness instructions.

Directive controls influence access by establishing the rules and expectations that govern access-related activities.

Deterrent Access Controls

Deterrent access controls are intended to discourage unauthorized access or misuse of authorized access.

They communicate that access is controlled, monitored, or subject to consequences, which can discourage attempts to bypass access restrictions or misuse privileges.

Examples include visible security monitoring, warning notices, security personnel, access monitoring notifications, and communicated disciplinary or legal consequences for unauthorized access.

Deterrent controls do not necessarily technically prevent access. Their purpose is to reduce the likelihood of unauthorized behavior.

Compensating Access Controls

Compensating access controls provide alternative or additional protection when a primary access control cannot be implemented or does not provide sufficient protection.

A compensating control should address the relevant access risk through another appropriate mechanism.

For example, if a system cannot support a required access restriction, additional monitoring, stronger authentication, network isolation, restricted administrative access, or more frequent access reviews may provide compensating protection.

Compensating controls should be documented, justified, and reviewed to ensure that the alternative protection remains appropriate.

Recovery Access Controls

Recovery access controls support the restoration of appropriate access capabilities following an access-control failure, system disruption, compromise, or other security event.

They help restore identity services, authentication mechanisms, authorization information, access-control configurations, and other capabilities required to resume authorized access.

Examples include restoration of identity directories, recovery of access-control configurations, credential recovery, re-establishment of authorization data, emergency access procedures, and restoration of identity services following an outage or security incident.

Recovery controls are particularly important where identity and access services are essential to the continued operation of systems, applications, networks, and critical infrastructure.

Privileged Access Governance

Privileged Access Governance establishes the policies, controls, and practices used to govern identities that have elevated permissions or administrative capabilities. Privileged access can provide extensive control over systems, applications, networks, databases, infrastructure, and security functions, making appropriate governance essential.

Privileged Accounts

Privileged accounts are accounts that have elevated permissions beyond those required for ordinary activities.

They may be used for system administration, network administration, database administration, security administration, application administration, infrastructure management, or other activities requiring elevated privileges.

Privileged accounts should have clearly defined ownership, purpose, permissions, and lifecycle requirements. Their access should be limited to the capabilities necessary for the intended administrative activities.

Administrative Account Separation

Administrative account separation keeps privileged administrative activities separate from ordinary user activities.

A person who performs administrative functions may use a dedicated administrative account rather than using the same account for routine activities such as email, web browsing, or general productivity.

Separating administrative identities helps reduce the exposure of privileged credentials and makes privileged activity easier to identify and monitor.

Least Privilege for Administrators

Least privilege for administrators means granting only the administrative permissions required to perform assigned responsibilities.

Administrative access should be limited by scope, resource, function, and duration where practical. Administrators should not automatically receive unrestricted access simply because they perform administrative functions.

Limiting administrative privileges reduces the potential impact of compromised credentials, misuse, or administrative errors.

Privilege Elevation

Privilege elevation allows an identity to obtain higher permissions when those permissions are required for a specific administrative task.

Elevation can be controlled through approval, authentication, authorization policies, defined privileges, and time restrictions.

Controlled elevation reduces the need for permanently assigning elevated permissions to an identity.

Just-in-Time Privileged Access

Just-in-Time privileged access provides elevated permissions only when they are required and for an appropriate period.

Instead of maintaining permanent administrative access, an identity can request or receive temporary privileges for a specific task.

After the defined period or task is completed, the elevated access is removed or expires.

Just-Enough Administration

Just-Enough Administration provides administrators with only the specific privileges required to perform a particular administrative task.

Rather than providing broad administrative authority, access can be limited to particular commands, functions, systems, resources, or operations.

This approach reduces unnecessary privilege while allowing administrative activities to be performed.

Privileged Credential Protection

Privileged credentials require stronger protection because compromise of such credentials can provide extensive access to critical resources.

Credential protection can include strong authentication, secure credential storage, restricted access, credential rotation, monitoring, and protection against unauthorized disclosure.

Privileged credentials should also be separated from ordinary credentials where appropriate.

Credential Vaulting and Rotation

Credential vaulting stores privileged credentials in a controlled and protected repository rather than leaving them exposed in scripts, configuration files, documents, or administrator workstations.

Credential rotation changes privileged credentials periodically or after specific events such as suspected compromise, personnel changes, or emergency access.

Vaulting and rotation help reduce the risk associated with credential theft, reuse, and long-term exposure.

Privileged Session Monitoring

Privileged session monitoring provides visibility into activities performed during privileged sessions.

Monitoring may record session activity, commands, administrative operations, connections, and other relevant events.

For sensitive environments, session recording may provide additional evidence for security investigations, compliance activities, and accountability.

Break-Glass Access

Break-glass access provides emergency access when normal administrative access mechanisms are unavailable or cannot be used.

It may be required during system failures, security incidents, recovery operations, or other critical situations.

Because break-glass access can bypass normal processes, it should be tightly controlled, protected, monitored, logged, and reviewed after use.

Privileged Activity Monitoring

Privileged activity monitoring focuses on identifying and analyzing activities performed using elevated privileges.

Monitoring can identify unusual administrative behavior, unexpected privilege changes, unauthorized configuration changes, suspicious access patterns, and other potentially risky activities.

Privileged activity records can support security monitoring, incident response, investigations, auditability, and access reviews.

Identity and Access Security Across Environments

Identity and Access Security requirements vary according to the environment in which identities access resources. Different environments introduce different identity sources, authentication mechanisms, access paths, trust relationships, and security requirements.

Enterprise and Corporate Environments

Enterprise and corporate environments typically contain a combination of users, applications, endpoints, networks, servers, data, and business services.

Identity and Access Security controls can govern employee, contractor, partner, administrative, and service access across these resources.

Centralized identity management, authentication, authorization, access reviews, privileged access controls, and lifecycle management help maintain consistent access requirements across the environment.

On-Premises Environments

On-premises environments host infrastructure and services within facilities controlled by the enterprise or infrastructure operator.

Identity and access controls may include directory services, operating-system accounts, network authentication, application authentication, privileged accounts, physical access controls, and administrative access restrictions.

Access management must consider both logical access to systems and physical access to the infrastructure supporting them.

Cloud Environments

Cloud environments provide computing, storage, applications, platforms, and other services through cloud infrastructure.

Identity and Access Security becomes a primary mechanism for controlling access to cloud resources because access may involve users, administrators, applications, workloads, APIs, and cloud services.

Controls can include cloud identity management, role-based access, federation, strong authentication, privileged access controls, service identities, and policy-based authorization.

Hybrid Environments

Hybrid environments combine on-premises infrastructure with cloud resources.

Identity and access controls must operate across multiple environments while maintaining appropriate trust relationships and consistent access requirements.

Identity federation, synchronization, centralized identity management, strong authentication, and consistent authorization policies can help manage access across hybrid resources.

Remote Access

Remote access allows identities to access systems or resources from locations outside the directly controlled environment.

Remote access controls may include strong authentication, multi-factor authentication, encrypted connections, device security requirements, network restrictions, session controls, and context-aware authorization.

Access should be limited according to the sensitivity of the resources being accessed and the risk associated with the remote connection.

Mobile and Endpoint Access

Mobile and endpoint access involves identities accessing resources through laptops, desktops, smartphones, tablets, and other endpoint devices.

Identity and Access Security can incorporate device identity, device authentication, endpoint security status, application access controls, authentication requirements, and conditional access policies.

Access decisions may consider both the identity and the security state of the device.

Application and Database Access

Applications and databases contain business functions and information that may require different levels of access.

Application access controls can regulate functions, transactions, roles, and permissions, while database access controls can restrict access to databases, tables, records, views, and operations.

Access should be aligned with the identity’s requirements and limited according to the sensitivity of the application or data.

Third-Party and Partner Access

Third-party and partner access involves identities that are external to the environment but require authorized access to specific resources.

Access should be limited to defined resources and purposes and should have appropriate ownership, approval, authentication, monitoring, review, and revocation requirements.

External access should not automatically provide the same level of access available to internal identities.

Service and Machine Access

Service and machine access involves non-human identities such as devices, services, applications, workloads, and automated processes.

These identities require controlled authentication, authorization, credential management, ownership, and lifecycle management.

Access should be limited to the resources and operations required for the intended function, with appropriate monitoring and credential protection.

Critical Infrastructure Environments

Critical infrastructure environments may include energy, transportation, telecommunications, water, healthcare, manufacturing, financial services, and other systems whose disruption can have significant operational or societal consequences.

Identity and Access Security must account for the availability and safety requirements of these environments while maintaining appropriate access restrictions.

Controls may include strong authentication, privileged access governance, administrative account separation, least privilege, controlled remote access, network segmentation, monitoring, emergency access, and carefully managed access revocation.

Identity and Access Security Protocols and Standards

Identity and Access Security protocols and standards provide common mechanisms for authentication, authorization, identity exchange, federation, directory access, and identity provisioning.

LDAP

Lightweight Directory Access Protocol (LDAP) is a protocol used to access and manage directory information.

LDAP directories can store identities, groups, attributes, and other information used by systems and applications for identity and access management.

LDAP can support authentication and directory-based authorization processes but does not itself define every aspect of an organization’s complete identity and access architecture.

Kerberos

Kerberos is a network authentication protocol that uses cryptographic mechanisms and trusted services to authenticate identities over an insecure network.

It uses tickets to support authentication between clients and services without repeatedly transmitting passwords across the network.

Kerberos is widely associated with enterprise directory environments and supports authenticated access to network services.

RADIUS

Remote Authentication Dial-In User Service (RADIUS) is a protocol used to provide centralized authentication, authorization, and accounting for network access.

It is commonly associated with network access technologies such as VPNs, wireless networks, and network access services.

RADIUS allows network access devices to communicate with a centralized authentication service.

TACACS+

Terminal Access Controller Access-Control System Plus (TACACS+) is a protocol commonly used for centralized authentication, authorization, and accounting for administrative access to network devices.

It can separate authentication and authorization functions and provides detailed control over administrative commands.

TACACS+ is particularly relevant to network infrastructure administration.

SAML

Security Assertion Markup Language (SAML) is an XML-based standard used to exchange authentication and authorization-related information between identity providers and service providers.

SAML enables identity federation, allowing an identity authenticated by one trusted identity provider to access services operated by another party without requiring a separate local authentication process for every service.

OAuth 2.0

OAuth 2.0 is an authorization framework that enables an application to obtain limited access to resources on behalf of a resource owner.

It separates the authorization of access to resources from the direct handling of the resource owner’s credentials by the requesting application.

OAuth 2.0 is widely used for delegated authorization and API access.

OpenID Connect

OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0.

It enables applications to obtain information about the authenticated identity and supports authentication and identity federation.

OIDC is commonly used for web applications, mobile applications, and services requiring federated identity.

SCIM

System for Cross-domain Identity Management (SCIM) provides a standardized approach for exchanging identity information between identity systems and applications or services.

It can support automated creation, modification, and deactivation of identities and associated attributes.

SCIM is particularly useful for identity provisioning and lifecycle synchronization across different systems.

X.509 Certificates

X.509 is a standard format for digital certificates used to bind an identity to a public key.

Certificates can support authentication for users, devices, applications, services, and workloads.

Certificate-based authentication can provide cryptographic assurance of identity and is commonly used with technologies such as TLS and enterprise authentication systems.

Identity Federation Standards

Identity federation standards enable identities established by one trusted identity system to be recognized by another system or service.

Federation can reduce the need to maintain separate credentials across multiple services while allowing authentication and identity information to be exchanged through established trust relationships.

Standards such as SAML and OpenID Connect support different federation scenarios and application architectures.

Identity and Access Security Threats

Identity and Access Security threats target identities, credentials, authentication mechanisms, authorization processes, privileged access, and identity infrastructure.

Credential Theft

Credential theft occurs when attackers obtain authentication information that can be used to impersonate an identity.

Credentials may be obtained through phishing, malware, credential exposure, compromised systems, social engineering, or other methods.

Stolen credentials can enable unauthorized access to systems and resources.

Password Attacks

Password attacks attempt to obtain, guess, crack, or otherwise compromise passwords.

Common approaches include password guessing, brute-force attacks, password spraying, credential reuse, and exploitation of weak or exposed passwords.

Strong authentication, secure password management, rate limiting, and multi-factor authentication can reduce exposure to password-based attacks.

Phishing and Social Engineering

Phishing and social engineering attempt to manipulate individuals into revealing credentials, approving access, executing malicious actions, or disclosing sensitive information.

Identity-related phishing can target passwords, authentication codes, session credentials, or access approval requests.

Security awareness, phishing-resistant authentication, strong verification procedures, and monitoring can help reduce the associated risks.

Account Takeover

Account takeover occurs when an unauthorized party gains control of a legitimate identity or account.

An attacker may use stolen credentials, compromised sessions, phishing, malware, or other techniques to obtain control.

Once an account is compromised, the attacker may use its legitimate access to reach additional resources or perform unauthorized actions.

Credential Stuffing

Credential stuffing uses previously compromised username and password combinations against other services.

It relies on the reuse of credentials across different systems.

Multi-factor authentication, passwordless authentication, breached-credential detection, and controls against automated login attempts can reduce the risk.

Brute-Force Attacks

Brute-force attacks repeatedly attempt authentication combinations in an effort to discover valid credentials.

Attackers may target passwords, PINs, keys, or other authentication secrets.

Rate limiting, account protection mechanisms, strong authentication, and monitoring can reduce the effectiveness of repeated authentication attempts.

Privilege Escalation

Privilege escalation occurs when an identity obtains permissions beyond those originally authorized.

It can involve exploiting vulnerabilities, misconfigured permissions, compromised accounts, excessive privileges, or weaknesses in authorization mechanisms.

Privilege escalation can allow an attacker or unauthorized user to reach sensitive systems or perform administrative activities.

Privilege Abuse

Privilege abuse occurs when authorized privileges are misused to perform actions that are inappropriate, unauthorized, or outside the intended purpose of the access.

It can involve malicious activity or misuse resulting from inappropriate administrative practices.

Least privilege, Separation of Duties, privileged access controls, monitoring, and access reviews can help reduce the risk.

Excessive Permissions

Excessive permissions occur when an identity has more access than required for its legitimate responsibilities.

Excessive access can increase the impact of compromised credentials, accidental actions, or misuse.

Access reviews, least privilege, entitlement management, and appropriate provisioning and revocation processes help reduce unnecessary permissions.

Orphaned Accounts

Orphaned accounts are accounts that remain active without an appropriate current owner, responsible identity, or legitimate requirement.

They can result from incomplete offboarding, outdated accounts, system migrations, or inadequate identity lifecycle management.

Orphaned accounts can provide unauthorized access if they remain usable and are not properly monitored or controlled.

Inadequate Access Revocation

Inadequate access revocation occurs when access remains available after it should have been removed.

This can occur following termination, role changes, credential compromise, loss of authorization, or changes in operational requirements.

Effective lifecycle management, automated revocation, access reviews, and monitoring help reduce this risk.

Session Hijacking

Session hijacking occurs when an attacker obtains or takes control of an authenticated session.

The attacker may use a valid session token or other session information to access resources without performing authentication again.

Session protection, secure session management, reauthentication, session termination, and monitoring can help reduce the risk.

Identity Provider Compromise

An identity provider compromise can affect multiple applications and services that depend on the provider for authentication or identity information.

Compromise of an identity provider may allow attackers to obtain credentials, manipulate identities, issue unauthorized authentication assertions, or gain access to connected services.

Protecting identity providers therefore requires strong authentication, privileged access controls, secure configuration, monitoring, resilience, and appropriate administrative separation.

Insider Threats

Insider threats involve misuse of legitimate access by individuals or other trusted entities with authorized access to resources.

The activity may involve intentional misuse, unauthorized disclosure, privilege abuse, or actions resulting from negligence or compromised identities.

Least privilege, Separation of Duties, access reviews, monitoring, and appropriate identity lifecycle controls help reduce the exposure associated with insider access.

Identity and Access Security Role in Zero Trust

Zero Trust treats access as something that must be explicitly evaluated rather than automatically trusted based solely on network location or previous access.

Identity and Access Security provides a central role in this approach by establishing identity, evaluating authentication, enforcing authorization, applying least privilege, and continuously evaluating access conditions.

Identity as the Security Perimeter

In Zero Trust architectures, identity becomes an important security control point because users, devices, applications, services, and workloads may access resources from different networks and locations.

Identity and Access Security helps establish which entity is requesting access and what that entity is permitted to access.

Verify Explicitly

Zero Trust requires access decisions to be based on explicit verification rather than implicit trust.

Identity, authentication strength, device state, resource sensitivity, and other relevant context can be evaluated before access is permitted.

Identity and Access Security provides the authentication and authorization mechanisms required to support this verification.

Least-Privilege Access

Zero Trust limits access to only the resources and permissions required for an intended activity.

Identity and Access Security supports this through role-based and attribute-based authorization, entitlement management, privileged access controls, just-in-time access, and just-enough access.

Assume Breach

The assume-breach principle recognizes that compromise may occur even when security controls are in place.

Identity and Access Security helps limit the consequences by restricting privileges, separating administrative access, protecting credentials, monitoring activity, and controlling access between resources.

Continuous Verification

Zero Trust does not treat successful authentication as permanent proof that access should continue indefinitely.

Identity and Access Security can support continuous verification by reevaluating identity, authentication state, device conditions, access context, and risk as circumstances change.

Device and User Trust

Access decisions can consider both the identity requesting access and the security state of the device being used.

Device identity, authentication, endpoint security status, and other device attributes can contribute to determining whether access should be permitted.

Context-Aware Access

Context-aware access considers relevant conditions surrounding an access request.

These conditions may include identity, device, location, network, time, resource sensitivity, behavior, and other security attributes.

Authorization policies can use this context to apply appropriate access requirements.

Continuous Authorization

Continuous authorization extends access decisions beyond the initial authentication event.

Authorization conditions can be reevaluated when identity attributes, device state, risk, resource sensitivity, or other relevant conditions change.

This allows access to be restricted, modified, or terminated when the conditions supporting the original authorization are no longer satisfied.

Microsegmentation and Identity

Microsegmentation divides environments into smaller security boundaries and restricts communication between them.

Identity and Access Security can complement microsegmentation by using identity, device, application, workload, and service information as part of access decisions.

This allows access between segmented resources to be controlled according to defined identities, permissions, policies, and contextual requirements.

Identity and Access Security Technologies

Identity and Access Security technologies provide the platforms and capabilities used to manage identities, authenticate users and other entities, control access to resources, protect privileged access, and govern identity and access throughout their lifecycle. Three major platform categories are Identity and Access Management (IAM), Privileged Access Management (PAM), and Identity Governance and Administration (IGA).

Identity and Access Management (IAM)

Identity and Access Management (IAM) provides the foundational capabilities for managing identities and controlling access to applications, systems, networks, data, and other resources. IAM brings together identity management, authentication, authorization, and access management capabilities to ensure that identities receive appropriate access to the resources they need.

Identity Management

Identity management covers the creation and maintenance of digital identities and their associated information. It includes managing identity attributes, accounts, credentials, and relationships with applications, systems, and services.

Access Management

Access management controls how authenticated identities access protected resources. It applies defined access policies and authorization decisions based on factors such as identity, role, permissions, device, location, and context.

Authentication

Authentication verifies the claimed identity of a user or other entity before access is granted. IAM platforms can support multiple authentication mechanisms based on the required level of assurance and the sensitivity of the resource.

Multi-Factor Authentication (MFA)

Multi-Factor Authentication requires an identity to provide two or more authentication factors from different categories. MFA provides an additional layer of protection when one authentication factor, such as a password, is compromised.

Single Sign-On (SSO)

Single Sign-On allows an authenticated identity to access multiple applications or services without independently authenticating to each application. SSO can centralize authentication and simplify access to multiple resources.

Passwordless Authentication

Passwordless authentication enables an identity to authenticate without relying on a traditional password. Depending on the implementation, it may use cryptographic credentials, security keys, biometrics, or other authentication mechanisms.

Adaptive and Risk-Based Authentication

Adaptive and risk-based authentication evaluates contextual information when determining the appropriate authentication requirements. Factors such as device characteristics, location, behavior, authentication history, and detected risk can influence the authentication decision.

Identity Federation

Identity federation enables an identity established in one identity domain to be recognized by another domain or service. Federation can allow access to separately administered resources without requiring an independent identity for every service.

Directory Services

Directory services maintain identity and resource information and make that information available to systems and applications. Directory services can contain information about users, groups, devices, applications, and other entities.

Identity Lifecycle Management

Identity lifecycle management manages an identity throughout its existence. It includes activities such as identity creation, provisioning, modification, suspension, revocation, deactivation, and deletion.

User Provisioning and Deprovisioning

User provisioning establishes the accounts, permissions, and resources required by an identity. Deprovisioning removes or disables accounts and access rights when they are no longer required.

Credential Management

Credential management covers the creation, distribution, protection, renewal, replacement, and revocation of credentials used for authentication.

Account Management

Account management handles the creation, modification, suspension, disabling, and deletion of accounts associated with identities.

Authorization

Authorization determines what an authenticated identity is permitted to access or perform. IAM platforms can apply authorization decisions based on roles, permissions, attributes, policies, and contextual conditions.

Access Policy Management

Access policy management defines and maintains the rules used to control access. Policies can specify which identities may access particular resources and the conditions under which access is permitted.

Application Access Management

Application access management controls identity access to applications and application resources. It can provide centralized authentication, authorization, SSO, and policy enforcement across application environments.

Remote Access

IAM platforms can support controlled access from remote locations by applying authentication, authorization, and contextual access policies to remote connections.

Identity Synchronization

Identity synchronization keeps identity information consistent across directories, applications, systems, and other identity repositories. It supports consistent identity information and lifecycle management across interconnected environments.

Privileged Access Management (PAM)

Privileged Access Management (PAM) focuses on protecting and controlling accounts, credentials, sessions, and activities that have elevated privileges. PAM limits unnecessary privileged access, protects privileged credentials, controls privilege elevation, and provides visibility into privileged activities.

Privileged Account Management

Privileged account management identifies and manages accounts with elevated permissions. These accounts may administer operating systems, databases, network infrastructure, security platforms, applications, cloud environments, or critical infrastructure systems.

Privileged Credential Management

Privileged credential management protects credentials associated with privileged accounts. It controls how privileged credentials are stored, accessed, distributed, used, and changed.

Credential Vaulting

Credential vaulting stores privileged credentials in a protected repository. This reduces the exposure of sensitive credentials in scripts, configuration files, endpoints, and administrator workstations.

Credential Rotation

Credential rotation changes privileged passwords, keys, or other credentials according to defined policies. Automated rotation can reduce the period during which a compromised credential remains usable.

Privilege Elevation

Privilege elevation provides additional permissions when an authorized task requires them. Elevation can be controlled according to defined policies and limited to the required activity.

Just-in-Time Privileged Access

Just-in-Time privileged access provides elevated privileges only when they are required and for a defined period. This reduces unnecessary standing privileged access.

Just-Enough Administration

Just-Enough Administration provides only the privileges necessary to perform a specific administrative task. It limits the scope of administrative permissions rather than providing unrestricted administrative access.

Privileged Session Management

Privileged session management controls and monitors sessions involving privileged accounts. Depending on the implementation, privileged sessions may be monitored, recorded, restricted, or terminated according to defined policies.

Privileged Activity Monitoring

Privileged activity monitoring provides visibility into actions performed using privileged accounts. It can help identify unauthorized, unusual, or potentially harmful administrative activity.

Break-Glass Access

Break-glass access provides emergency privileged access when normal access mechanisms are unavailable or immediate intervention is required. Such access should be tightly controlled, monitored, and reviewed after use.

Identity Governance and Administration (IGA)

Identity Governance and Administration (IGA) provides governance and administrative capabilities for identities and access. IGA helps ensure that access is appropriately requested, approved, assigned, reviewed, and removed according to defined policies and business or operational requirements.

Identity Governance

Identity governance establishes oversight of identity-related processes, responsibilities, policies, and controls. It helps ensure that identity management activities remain aligned with security, compliance, risk, and operational requirements.

Access Governance

Access governance provides oversight of access rights and entitlements. It helps determine whether access remains appropriate based on defined policies, responsibilities, risk, and business or operational requirements.

Entitlement Management

Entitlement management manages the permissions and access rights assigned to identities. It provides visibility into what an identity can access and supports controlled assignment and removal of those entitlements.

Access Requests and Approvals

Access request and approval processes provide a controlled mechanism for requesting access to resources. Appropriate authorization is obtained before access is granted based on defined responsibilities and access requirements.

Access Certification

Access certification provides a formal process for designated individuals to confirm that assigned access remains appropriate. Certification activities provide evidence that access has been reviewed and validated.

Access Reviews

Access reviews periodically examine assigned access to identify unnecessary, excessive, inappropriate, or outdated permissions. Reviews can result in access being retained, modified, or revoked.

Separation of Duties

Separation of duties prevents conflicting responsibilities from being concentrated in a single identity. IGA can identify potential conflicts and enforce separation-of-duties policies during access assignment and review.

Access Risk Analysis

Access risk analysis evaluates the potential risk associated with identities, roles, entitlements, and access combinations. It can help identify excessive privileges, conflicting access, unusual assignments, and other access-related risks.

Policy Compliance

IGA platforms can evaluate identity and access activities against defined policies and requirements. This helps identify policy violations and supports remediation and compliance activities.

Identity and Access Reporting

Identity and access reporting provides information about identities, accounts, roles, entitlements, access requests, approvals, certifications, and policy compliance. These reports can support governance, auditing, risk management, and operational oversight.

References

Online Sources

National Institute of Standards and Technology (NIST) – Digital Identity Guidelines (NIST SP 800-63-4)
Provides guidance on digital identity, identity proofing, authentication, federation, and related identity management processes.

National Institute of Standards and Technology (NIST) – Zero Trust Architecture (NIST SP 800-207)
Provides guidance on identity-based access, authentication, authorization, and least-privilege access within Zero Trust Architecture.

National Institute of Standards and Technology (NIST) – Cybersecurity Framework (CSF) 2.0
Provides a cybersecurity framework that includes concepts relevant to identity management, authentication, access control, and governance.

Internet Engineering Task Force (IETF) – OAuth 2.0 Authorization Framework (RFC 6749)
Defines the OAuth 2.0 framework for delegated authorization and access to protected resources.

Internet Engineering Task Force (IETF) – OpenID Connect Core 1.0
Defines an identity layer built on OAuth 2.0 for authentication and exchange of identity information.

OASIS – Security Assertion Markup Language (SAML) V2.0
Defines standards for exchanging authentication, authorization, and identity information between security domains.

Cloud Security Alliance (CSA) – Cloud Controls Matrix
Provides security control guidance covering identity, access management, privileged access, and governance in cloud environments.