Identity and Access Management

Identity and Access Management (IAM) is the discipline and set of controls governing who can access what resources, how they prove their identity, and what actions they may take. IAM comprises four interconnected functions: Identification (establishing a unique identity for each user, device, or service), Authentication (verifying that a claimed identity is genuine), Authorization (determining which resources and actions an authenticated identity may access), and Accountability (logging and auditing identity activity for detection and compliance). In the ISACA-CISA framework, IAM sits within Domain 5 — Protection of Information Assets — and serves as the primary preventive and detective control layer against unauthorized access, privilege abuse, and insider threats. Three governing principles underpin all IAM design: Least Privilege (grant only the minimum access necessary), Segregation of Duties (prevent any single identity from controlling a complete sensitive process end-to-end), and Defense in Depth (layer multiple identity controls so no single failure grants full compromise). IAM operates across a defined identity lifecycle: provisioning (creating and assigning access) → authorization management (maintaining correct access over time) → usage monitoring (detecting anomalies) → deprovisioning (revoking access when no longer needed).