ISO 27001:2022 · Organizational controls
ISO 27001:2022 5.16: Identity management
ISO 27001:2022 5.16 covers Identity management. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.5.16, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Generic shared accounts exist without documented justification or approval.
Identities are to be managed throughout their whole life cycle. Purpose (stated in ISO/IEC 27002:2022): enables unique identification of people and systems accessing organizational assets and appropriate assignment of access rights. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 5.16.
What evidence supports 5.16?
- Annex A organizational controlStatement of Applicability entry for control A.5.16, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A organizational controlIdentity management procedure covering creation, verification, activation, change, disablement and removal
- Annex A organizational controlEvidence that identities are verified against trusted documents before issue
- Annex A organizational controlA register of shared identities with the business justification and approval for each
- Annex A organizational controlA register of non-human identities (service accounts, machine identities) with segregated approval and an independent oversight record
Where this requirement comes from
This is our own statement of ISO 27001:2022 5.16, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Generic shared accounts exist without documented justification or approval
- Service accounts have no owner and no periodic oversight
- Identities of leavers remain enabled for weeks because HR notifications are not integrated
- The same person holds several identities in one directory, undermining accountability
How it maps to SOC 2
- CC6.1 high Identity management is the identification infrastructure supporting access security.
- CC6.2 high Identity management registers users before access is granted.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.