A.5.16 Organizational
Identity management
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
Mapped NIST 800-53 r5 controls (10)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- AC-2mostlyaligns with — Both controls require formal account lifecycle management, including approval, timely disabling or removal, and oversight of shared or non-human accounts.
- IA-4mostlyaligns with — Both controls establish rules for creating, assigning, and retiring unique identifiers so that each identity remains attributable to a single entity and is removed when no longer needed.
- AU-2partialaligns with — The ISO mandate to retain records of significant identity-management events aligns with NIST’s requirement to log events that are necessary for accountability and incident review.
- IA-2partialaligns with — The ISO requirement that each identity be linked to one person supports the NIST objective of binding organizational-user identities to authenticated subjects before access is granted.
- IA-8partialaligns with — Both controls address the acceptance and risk treatment of identities issued by external parties when those identities are used for organizational access.
Aligned NIST CSF 2.0 outcomes (9)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PR.AA-01mostlycovers — The ISO control's emphasis on unique, accountable identities, timely removal, and oversight of non-human identities directly implements the CSF outcome of managing identities and credentials for authorized users, services, and hardware.
- PR.AA-02mostlyaligns with — Re-verification of trusted documents and ensuring third-party identities meet required trust levels align with the CSF outcome of proofing identities and binding them to credentials based on interaction context.
- GV.SC-02partialaligns with — The requirement to assess and treat risks when accepting third-party identities aligns with the CSF outcome of establishing and coordinating cybersecurity roles and responsibilities for suppliers and partners.
- ID.AM-08partialaligns with — Timely disabling or removal of identities when entities or roles change supports the CSF outcome of managing systems, hardware, software, services, and data throughout their life cycles.
- PR.AA-05partialaligns with — Dedicated approval, documentation, and segregation of duties for shared or non-human identities support the CSF outcome of defining, managing, and reviewing access permissions and authorizations.
Related OWASP ASVS 5.0 requirements (12)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V6.3.2fullcovers — The ISO requirement to disable or remove identities that are no longer required directly implements the ASVS mandate to ensure default or unused accounts are disabled.
- V6.8.1mostlyaligns with — Requiring that third-party identities meet an appropriate trust level and that risks are treated aligns with the ASVS requirement to prevent identity spoofing across multiple identity providers.
- V6.1.3partialaligns with — Documenting and approving shared or non-human identities and their controls supports the ASVS expectation that all authentication pathways and their security controls are documented.
- V6.3.4partialaligns with — Mandating approval, documentation, and oversight for shared or non-human identities helps ensure there are no undocumented authentication pathways.
- V7.4.2partialaligns with — Timely removal of identities when a person leaves or changes role supports the ASVS requirement to terminate all active sessions upon account disablement or deletion.
Related weaknesses / CWE (35)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CWE-284mostlyprevents — Requiring one-to-one mapping of identities to entities and timely removal of unused identities directly stops attackers from leveraging stale or shared accounts to bypass access restrictions.
- CWE-286mostlyprevents — Identity management directly governs the full lifecycle of user accounts, preventing incorrect user management.
- CWE-287partialprevents — Mandating segregated approval and oversight for non-human identities reduces the chance that weak or orphaned credentials can be exploited for unauthorized authentication.
- CWE-289partialprevents — Identity-management processes can require unique, canonical identifiers, reducing alternate-name bypass risk.
- CWE-290partialprevents — Identity management supports unique identities but does not guarantee resistance to spoofing.
- CWE-291partialprevents — Identity-management processes should replace IP-based identification with verified identities.
- CWE-322partialprevents — Identity management provides the verified identities required before key exchange occurs.
- CWE-441partialprevents — Proper identity management ensures the original requester identity is preserved and validated before the product forwards requests.
- CWE-694partialprevents — Identity management processes that enforce unique identifiers directly prevent duplicate resource IDs.
- CWE-269noneprevents — Enforcing documented approval and independent oversight for non-person identities limits the assignment of excessive privileges that could be abused.
- CWE-282nonenone — Identity management processes help ensure objects are assigned to the correct, verified owners.
- CWE-283nonenone — Identity management processes can include verification of resource ownership during provisioning and access decisions.
- CWE-302nonenone — Identity-management processes can require verification of mutable attributes, mitigating the root cause.
- CWE-309nonenone — Identity management defines how identities are proven, directly influencing reliance on passwords.
- CWE-384nonenone — Identity-management procedures can require new session tokens after login, yet the control is broader than session handling.
- CWE-408nonenone — Identity management ensures entities are identified and authenticated prior to performing expensive actions.
- CWE-620nonenone — Identity management processes can incorporate verification steps, but the control itself does not explicitly require password-change verification.
- CWE-708nonenone — Identity-management processes define who may own resources, yet do not guarantee correct assignment at creation time.
- CWE-798nonenone — Requiring independent oversight and timely disabling of non-human identities makes it harder for hard-coded or long-lived credentials to remain exploitable.
- CWE-842nonenone — Identity management process governs group provisioning and de-provisioning, directly addressing incorrect placement.
- CWE-862nonenone — By ensuring identities are removed or disabled when roles change or entities are deleted, the control reduces the window during which missing authorization checks can be bypassed via obsolete accounts.
Mitigated MITRE ATT&CK techniques (4)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1078mostlyprevents — Enforcing one-to-one identity-to-person mapping, timely disabling of unused accounts, and prohibiting duplicate identities directly reduces the pool of valid credentials an adversary can discover or abuse for unauthorized access.
- T1098nonemitigates — Mandating re-verification of identity-linked information and independent oversight of non-human identities hinders an adversary’s attempts to add new credentials or modify existing ones without detection.
- T1136nonemitigates — Requiring segregated approval and documentation for non-human and shared identities limits an attacker’s ability to create or maintain stealthy accounts that would otherwise persist undetected.
- T1556nonemitigates — Requiring documented approval and ongoing oversight for identity changes makes it harder for an attacker to alter authentication processes or implant backdoors through manipulated identity records.
Prevented OWASP Web Top 10 (2025) risks (4)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A07mostlyprevents — Requiring single-person linkage, segregated approvals for non-human identities, and prompt de-provisioning eliminates weak or orphaned credentials that attackers could exploit to authenticate as legitimate users.
- A01partialprevents — Enforcing unique, accountable identities and timely removal of unused accounts directly stops unauthorized users from inheriting or retaining access rights that would let them bypass authorization checks.
- A02partialprevents — Documented approval workflows and removal of duplicate or shared identities reduce the chance that default, leftover, or misconfigured accounts remain active and create exploitable configuration drift.
- A09nonemitigates — Mandating retention of significant identity-management events supplies the audit trail needed for effective logging and alerting of suspicious account activity.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.