Skip to main content
Governance Authority
Category: Privacy and Cybersecurity

Identity Management

Also known as: IdM, Identity and Access Management, IAM, IdAM
Simply put

Identity management is the set of policies, processes, and technologies an organization uses to keep track of who its users are and what they are allowed to access. When someone tries to log in, the system checks their credentials against a record of individuals who are authorized to have access. It is closely related to, and often described together with, access management under the broader label of identity and access management (IAM).

Formal definition

Identity management (IdM) refers to the administration of individual digital identities within a defined domain such as a company, network, or system, and is typically treated as part of a broader identity and access management (IAM or IdAM) framework of policies and technologies intended to ensure that the appropriate users have appropriate access to resources. Operationally, it generally involves maintaining an authoritative identity repository (an ongoing record of individuals who should have access) against which authentication attempts are validated, alongside the processes organizations use to manage and secure digital identities and control user access. In a governance, risk, and compliance context, identity and access governance is a recognized area of professional certification and program discipline; the specific controls, framework elements, and technologies applied vary by organization, sector, and jurisdiction, and this entry does not prescribe any single mandatory standard.

Why it matters

Identity management sits at the foundation of information security and access governance because it determines who can enter an organization's systems and what they can do once inside. Without a reliable, authoritative record of authorized individuals, an organization cannot consistently enforce access decisions, and the risk of unauthorized access to sensitive data and systems generally rises. In a governance, risk, and compliance context, weaknesses in identity management can undermine the control environment that boards and assurance functions rely upon.

Identity and access governance is a recognized area of professional discipline and certification, reflecting its importance to how organizations manage access-related risk and demonstrate control over their systems. The specific controls, framework elements, and technologies an organization adopts will vary by organization, sector, and jurisdiction, and no single mandatory standard applies universally. Accountability for identity management typically involves collaboration among the functions that own the underlying systems, the security or IT teams that operate the controls, and the assurance functions that provide independent evaluation of control design and operating effectiveness.

Because this entry is educational and not legal, audit, or compliance advice, organizations should evaluate their own identity management arrangements against the requirements applicable to their circumstances and the judgment of qualified professionals. Whether a given control is a legal requirement or a voluntary practice depends on the applicable law, listing rules, sector regulation, and frameworks in force.

Who it's relevant to

Chief Information Security Officers and IT Security Teams
These functions generally own the operational design and running of identity management systems, including maintaining the authoritative identity repository and configuring how authentication attempts are validated. They are typically accountable for the day-to-day operating effectiveness of access controls, distinct from the independent evaluation that assurance functions provide.
Internal Auditors and Assurance Functions
Internal audit and other assurance functions typically evaluate whether identity and access controls are appropriately designed and operating effectively, providing independent challenge rather than owning the controls themselves. Identity and access governance is a recognized area of professional certification and program discipline relevant to this work.
Chief Compliance and Risk Officers
These officers are generally concerned with how identity management contributes to the organization's control environment and its ability to manage access-related risk. The specific framework elements and controls that apply will vary by organization, sector, and jurisdiction, and whether a given measure is a legal requirement or a voluntary practice depends on the applicable rules.
Boards and Audit or Risk Committees
The board and its relevant committees typically exercise oversight of the organization's approach to information security and access governance, rather than performing operational identity management activities. Their focus generally sits at the level of whether management has established adequate arrangements and whether assurance over those arrangements is credible.

Inside IdM

Identity Lifecycle Management
The processes governing how digital identities are created, maintained, and retired, typically spanning provisioning when a person joins, modification as roles change, and deprovisioning upon departure. Ownership is generally shared: management operates these processes, while assurance functions may test their effectiveness.
Authentication
The mechanism by which a claimed identity is verified, for example through passwords, tokens, or biometric or multi-factor methods. Authentication confirms who a user is and is distinct from what they are permitted to do.
Authorization and Access Rights
The assignment of permissions that determine what an authenticated identity may access or perform, often structured around role-based or attribute-based models. Authorization is conceptually separate from authentication and is typically aligned to least-privilege principles.
Access Governance and Certification
Periodic review and attestation of who holds which entitlements, generally performed by accountable managers or system owners to confirm access remains appropriate. This is a governance control layered over the operational access mechanisms.
Privileged Access Management
Heightened controls applied to accounts with elevated or administrative rights, which carry greater inherent risk. Controls may include stronger authentication, restricted use, and enhanced monitoring.
Segregation of Duties Considerations
The use of access design to prevent an individual from holding combinations of entitlements that create conflict or fraud risk. This links identity management to broader internal control objectives owned by management.

Common questions

Answers to the questions practitioners most commonly ask about IdM.

Is identity management the same thing as cybersecurity?
No. Identity management is one component within a broader security and access control environment, not a synonym for cybersecurity as a whole. It focuses specifically on how identities are established, maintained, and retired, and how access rights are granted and governed. Cybersecurity encompasses many additional domains, and identity management typically operates alongside them rather than replacing them. Where accountability sits and how these functions are structured varies by organization, sector, and jurisdiction.
Does identity management belong solely to the IT department?
Not entirely. While IT commonly performs the operational aspects of provisioning and technical administration, the governance of who should have access and under what conditions typically involves business owners, management, and, in some organizations, oversight from risk and compliance functions. The design of access policy is generally a management responsibility, and assurance over its operation may fall to internal audit or another independent function. Treating it as purely an IT matter can obscure where accountability for access decisions actually rests.
How should an organization approach access provisioning and de-provisioning?
Provisioning and de-provisioning are generally governed by defined policies that specify who authorizes access, on what basis, and how promptly access is removed when it is no longer needed. Many organizations align grants to job role or function so that access reflects current responsibilities. The specific controls, approval workflows, and timeframes an organization adopts depend on its risk appetite, regulatory context, and operating model, and should be documented so their design and operating effectiveness can be evaluated separately. This is a general description, not a prescription for any particular entity.
What is the role of periodic access reviews, and who should perform them?
Periodic access reviews are a recurring control in which existing access rights are examined to confirm they remain appropriate. In many organizations the business owner or manager accountable for a resource confirms whether continued access is warranted, while a separate function may facilitate or monitor the process. The frequency and rigor of reviews typically reflect the sensitivity of the systems and data involved and any applicable requirements. Whether a review provides assurance depends on both how the control is designed and how effectively it operates in practice.
How does identity management relate to segregation of duties?
Access rights can create or mitigate segregation-of-duties concerns, so identity management is often one of the mechanisms through which such controls are enforced. When access is provisioned, organizations generally consider whether a combination of rights would allow a single individual to complete an incompatible set of activities. The identification of which duties should be separated is usually a management and control-design decision, informed by risk assessment, rather than a purely technical output of an identity system. Approaches vary by process, entity, and applicable requirements.
How can an organization demonstrate that its identity management controls are working?
Demonstrating effectiveness generally requires distinguishing whether a control is well designed from whether it operates as intended over time. Evidence commonly includes documented policies, records of provisioning and de-provisioning decisions, completed access reviews, and logs supporting authorization. Independent assurance functions may test these controls, and management typically retains responsibility for their design and operation. The nature and extent of evidence considered sufficient depends on the organization's risk profile, any applicable framework or regulatory expectation, and professional judgment. This is educational information and not audit, legal, or compliance advice.

Common misconceptions

Identity management is purely an IT function with no governance dimension.
While operational identity and access processes are typically administered by IT or security teams, access decisions, periodic certifications, and accountability for appropriate entitlements generally rest with business management, and boards or committees may have oversight responsibilities depending on the entity and its risk profile.
Strong authentication alone means access risk is controlled.
Authentication verifies identity but does not determine whether the permissions granted are appropriate. Authorization, least-privilege design, and access certification are separate controls, and a well-authenticated user may still hold excessive or conflicting entitlements.
Once access controls are designed, they can be assumed to work.
Control design and operating effectiveness are distinct. A well-designed provisioning or deprovisioning process may fail in practice; assurance over identity management typically requires testing that controls operate effectively over time, not merely that they exist on paper.

Best practices

Apply least-privilege and role-based access principles so that identities receive only the entitlements needed for their function, and review the underlying role definitions periodically.
Establish clear accountability by assigning access approval and periodic certification to business managers or system owners rather than treating it solely as an IT responsibility.
Ensure timely deprovisioning by integrating identity lifecycle triggers with joiner, mover, and leaver events, and monitor for orphaned or dormant accounts.
Apply enhanced controls to privileged and administrative accounts, given their elevated inherent risk, including stronger authentication and closer monitoring where appropriate.
Consider segregation-of-duties conflicts when designing access, coordinating identity management with broader internal control and risk objectives.
Support assurance by testing both the design and the operating effectiveness of identity and access controls, and align the depth of review to the entity's risk profile and applicable requirements.