- See ISO 27002:2022 Control 5.16 for more information.
- See ISO 27001:2013 Annex A 9.2.1 for more information.
Understanding ISO 27001:2022 Annex A Control 5.16 – Strengthening Identity Management
The revised ISO 27001:2022 Annex A 5.16 Identity Management establishes a framework for approving, registering, and administering human and non-human identities on any network – defined as the “full lifecycle.
Computer networks use identities to identify the underlying ability of an entity (a user, group of users, device, or IT asset) to access a set of hardware and software resources.
What Does ISO 27001:2022 Annex A 5.16 Do?
The purpose of Annex A 5.16 is to describe how an organisation can identify who (users, groups of users) or what (applications, systems, and devices) is accessing data or IT assets at any given moment, and how those identities are granted access rights.
As a preventative measure, Annex A 5.16 aims to maintain risk by establishing the main perimeter for all related information security and cyber security operations, as well as the primary mode of governance that determines an organisation’s Identity and Access Management process.
ISO 27001 made easy
An 81% Headstart from day one
We’ve done the hard work for you, giving you an 81% Headstart from the moment you log on. All you have to do is fill in the blanks.
Ownership of Annex A 5.16
Considering ISO 27001:2022 Annex A 5.16 serves as a primarily maintenance function, ownership should be given to IT staff with Global Administrator rights (or equivalent for non-Windows infrastructure).
In addition to other built-in roles that allow users to manage identities (such as Domain Administrator), Annex A 5.16 should be owned by the individual responsible for the entire network of the organisation, including all subdomains and Active Directory tenants.
General Guidance on ISO 27001:2022 Annex A 5.16
Annex A 5.16 compliance is achieved by expressing identity-based procedures clearly in policy documents and monitoring staff adherence on a daily basis.
Six procedures are listed in Annex A 5.16, to ensure that an organisation meets the requisite standards of infosec and cybersecurity governance:
- Whenever an identity is assigned to a person, that person is the only one who can authenticate with that identity and/or use it when accessing network resources.
- In some cases, it may be necessary to assign a single identity to several people, also known as a ‘shared identity’. Only use this approach when an explicit set of operational requirements is needed.
- ‘Non-human’ entities (any identity that isn’t tied to a real person) should be treated differently from user-based identities at registration.
- In the event of a departure, redundant assets, or other non-required identities, a network administrator should disable them or remove them completely.
- It is imperative to avoid duplicate identities at all costs. A ‘one entity, one identity’ rule should be followed by all organisations.
- Identities management and authentication information should be documented adequately for all ‘significant events.
Achieving compliance means IT policies must stipulate clearly that users are not to share login information, or allow other users to roam the network using any identity other than the one they have been given.
To achieve compliance, registration of shared identities should be handled separately from single user registration, with a dedicated approval process.
A non-human identity should also have its own approval and registration process, acknowledging the fundamental difference between assigning an identity to a person and granting one to an asset, application or device.
The IT department should conduct regular audits to determine which identities are being used, and which entities can be suspended or deleted. It is important for HR staff to include identity management in offboarding procedures, and to inform IT staff immediately when a leaver leaves.
To comply, IT staff should ensure that entities do not receive access rights based on more than one identity when assigning roles across a network.
It is possible to interpret the term ‘significant event’ differently, but on a basic level, organisations need to make sure that their governance procedures include a comprehensive list of assigned identities at any given time, robust change request protocols with appropriate approval procedures, and an approved change request protocol.
Additional Supplementary Guidance for Annex A 5.16
When creating an identity and granting it access to network resources, Annex A 5.16 also lists four steps that businesses need to follow (amending or removing access rights is shown in ISO 27001:2022 Annex A 5.18):
- Before creating an identity, establish a business case.
- Make sure that the entity (human or non-human) assigned an identity has been independently verified.
- Creating an identity
- The final configurations steps for an identity
Every time an identity is created, identity management becomes exponentially more challenging. It is advisable for organisations to create new identities only when it is clearly necessary.
Identities and Access Management procedures should ensure that, once the business case has been approved, an individual or asset receiving new identities has the required authority before an identity is created.
Your IT staff should build an identity in line with the business case requirements, and it should be limited to what is outlined in any change request documentation.
As the final step in the process, an identity is assigned to each of its access-based permissions and roles (RBAC) as well as any authentication services required.
Free yourself from a mountain of spreadsheets
Embed, expand and scale your compliance, without the mess. IO gives you the resilience and confidence to grow securely.
What Are the Changes From ISO 27001:2013?
ISO 27001:2022 Annex A 5.16 replaces ISO 27001:2013 A.9.2.1 (formerly known as ‘User Registration and Deregistration’).
While the two controls share some striking similarities – primarily in maintenance protocols and deactivating redundant IDs – Annex A 5.16 contains a comprehensive set of guidelines that deal with Identity and Access Management as a whole.
Annex A 5.16 Human vs. Non-human Identities Explained
There are some differences between the 2022 Annex and its predecessor in that despite differences in registration processes, humans and non-humans are no longer treated separately when it comes to general network administration.
It has become more common in IT governance and best practice guidelines to talk about human and non-human identities interchangeably since the advent of modern Identity and Access Management and Windows-based RBAC protocols.
In Annex A 9.2.1 of ISO 27001:2013, there is no guidance on how to manage non-human identities, and the text is concerned only with managing what it calls ‘User IDs’ (i.e. login information along with a password that’s used to access a network).
ISO 27001:2022 Annex A 5.16 Documentation
Annex A 5.16 provides explicit guidance on both the general security implications of identity governance, and how organisations should record and process information prior to the assigning of identities, as well as throughout the lifecycle of the identity.
Comparatively, ISO 27001:2013 A.9.2.1 only briefly mentions the IT governance role that surrounds the administration of identities, and limits itself to the physical practice of identity administration.
Table of All ISO 27001:2022 Annex A Controls
In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.
| Annex A Control Type | ISO/IEC 27001:2022 Annex A Identifier | ISO/IEC 27001:2013 Annex A Identifier | Annex A Name |
|---|---|---|---|
| Organisational Controls | Annex A 5.1 |
Annex A 5.1.1 Annex A 5.1.2 |
Policies for Information Security |
| Organisational Controls | Annex A 5.2 | Annex A 6.1.1 | Information Security Roles and Responsibilities |
| Organisational Controls | Annex A 5.3 | Annex A 6.1.2 | Segregation of Duties |
| Organisational Controls | Annex A 5.4 | Annex A 7.2.1 | Management Responsibilities |
| Organisational Controls | Annex A 5.5 | Annex A 6.1.3 | Contact With Authorities |
| Organisational Controls | Annex A 5.6 | Annex A 6.1.4 | Contact With Special Interest Groups |
| Organisational Controls | Annex A 5.7 | NEW | Threat Intelligence |
| Organisational Controls | Annex A 5.8 |
Annex A 6.1.5 Annex A 14.1.1 |
Information Security in Project Management |
| Organisational Controls | Annex A 5.9 |
Annex A 8.1.1 Annex A 8.1.2 |
Inventory of Information and Other Associated Assets |
| Organisational Controls | Annex A 5.10 |
Annex A 8.1.3 Annex A 8.2.3 |
Acceptable Use of Information and Other Associated Assets |
| Organisational Controls | Annex A 5.11 | Annex A 8.1.4 | Return of Assets |
| Organisational Controls | Annex A 5.12 | Annex A 8.2.1 | Classification of Information |
| Organisational Controls | Annex A 5.13 | Annex A 8.2.2 | Labelling of Information |
| Organisational Controls | Annex A 5.14 |
Annex A 13.2.1 Annex A 13.2.2 Annex A 13.2.3 |
Information Transfer |
| Organisational Controls | Annex A 5.15 |
Annex A 9.1.1 Annex A 9.1.2 |
Access Control |
| Organisational Controls | Annex A 5.16 | Annex A 9.2.1 | Identity Management |
| Organisational Controls | Annex A 5.17 |
Annex A 9.2.4 Annex A 9.3.1 Annex A 9.4.3 |
Authentication Information |
| Organisational Controls | Annex A 5.18 |
Annex A 9.2.2 Annex A 9.2.5 Annex A 9.2.6 |
Access Rights |
| Organisational Controls | Annex A 5.19 | Annex A 15.1.1 | Information Security in Supplier Relationships |
| Organisational Controls | Annex A 5.20 | Annex A 15.1.2 | Addressing Information Security Within Supplier Agreements |
| Organisational Controls | Annex A 5.21 | Annex A 15.1.3 | Managing Information Security in the ICT Supply Chain |
| Organisational Controls | Annex A 5.22 |
Annex A 15.2.1 Annex A 15.2.2 |
Monitoring, Review and Change Management of Supplier Services |
| Organisational Controls | Annex A 5.23 | NEW | Information Security for Use of Cloud Services |
| Organisational Controls | Annex A 5.24 | Annex A 16.1.1 | Information Security Incident Management Planning and Preparation |
| Organisational Controls | Annex A 5.25 | Annex A 16.1.4 | Assessment and Decision on Information Security Events |
| Organisational Controls | Annex A 5.26 | Annex A 16.1.5 | Response to Information Security Incidents |
| Organisational Controls | Annex A 5.27 | Annex A 16.1.6 | Learning From Information Security Incidents |
| Organisational Controls | Annex A 5.28 | Annex A 16.1.7 | Collection of Evidence |
| Organisational Controls | Annex A 5.29 |
Annex A 17.1.1 Annex A 17.1.2 Annex A 17.1.3 |
Information Security During Disruption |
| Organisational Controls | Annex A 5.30 | NEW | ICT Readiness for Business Continuity |
| Organisational Controls | Annex A 5.31 |
Annex A 18.1.1 Annex A 18.1.5 |
Legal, Statutory, Regulatory and Contractual Requirements |
| Organisational Controls | Annex A 5.32 | Annex A 18.1.2 | Intellectual Property Rights |
| Organisational Controls | Annex A 5.33 | Annex A 18.1.3 | Protection of Records |
| Organisational Controls | Annex A 5.34 | Annex A 18.1.4 | Privacy and Protection of PII |
| Organisational Controls | Annex A 5.35 | Annex A 18.2.1 | Independent Review of Information Security |
| Organisational Controls | Annex A 5.36 |
Annex A 18.2.2 Annex A 18.2.3 |
Compliance With Policies, Rules and Standards for Information Security |
| Organisational Controls | Annex A 5.37 | Annex A 12.1.1 | Documented Operating Procedures |
| Annex A Control Type | ISO/IEC 27001:2022 Annex A Identifier | ISO/IEC 27001:2013 Annex A Identifier | Annex A Name |
|---|---|---|---|
| People Controls | Annex A 6.1 | Annex A 7.1.1 | Screening |
| People Controls | Annex A 6.2 | Annex A 7.1.2 | Terms and Conditions of Employment |
| People Controls | Annex A 6.3 | Annex A 7.2.2 | Information Security Awareness, Education and Training |
| People Controls | Annex A 6.4 | Annex A 7.2.3 | Disciplinary Process |
| People Controls | Annex A 6.5 | Annex A 7.3.1 | Responsibilities After Termination or Change of Employment |
| People Controls | Annex A 6.6 | Annex A 13.2.4 | Confidentiality or Non-Disclosure Agreements |
| People Controls | Annex A 6.7 | Annex A 6.2.2 | Remote Working |
| People Controls | Annex A 6.8 |
Annex A 16.1.2 Annex A 16.1.3 |
Information Security Event Reporting |
| Annex A Control Type | ISO/IEC 27001:2022 Annex A Identifier | ISO/IEC 27001:2013 Annex A Identifier | Annex A Name |
|---|---|---|---|
| Physical Controls | Annex A 7.1 | Annex A 11.1.1 | Physical Security Perimeters |
| Physical Controls | Annex A 7.2 |
Annex A 11.1.2 Annex A 11.1.6 |
Physical Entry |
| Physical Controls | Annex A 7.3 | Annex A 11.1.3 | Securing Offices, Rooms and Facilities |
| Physical Controls | Annex A 7.4 | NEW | Physical Security Monitoring |
| Physical Controls | Annex A 7.5 | Annex A 11.1.4 | Protecting Against Physical and Environmental Threats |
| Physical Controls | Annex A 7.6 | Annex A 11.1.5 | Working In Secure Areas |
| Physical Controls | Annex A 7.7 | Annex A 11.2.9 | Clear Desk and Clear Screen |
| Physical Controls | Annex A 7.8 | Annex A 11.2.1 | Equipment Siting and Protection |
| Physical Controls | Annex A 7.9 | Annex A 11.2.6 | Security of Assets Off-Premises |
| Physical Controls | Annex A 7.10 |
Annex A 8.3.1 Annex A 8.3.2 Annex A 8.3.3 Annex A 11.2.5 |
Storage Media |
| Physical Controls | Annex A 7.11 | Annex A 11.2.2 | Supporting Utilities |
| Physical Controls | Annex A 7.12 | Annex A 11.2.3 | Cabling Security |
| Physical Controls | Annex A 7.13 | Annex A 11.2.4 | Equipment Maintenance |
| Physical Controls | Annex A 7.14 | Annex A 11.2.7 | Secure Disposal or Re-Use of Equipment |
| Annex A Control Type | ISO/IEC 27001:2022 Annex A Identifier | ISO/IEC 27001:2013 Annex A Identifier | Annex A Name |
|---|---|---|---|
| Technological Controls | Annex A 8.1 |
Annex A 6.2.1 Annex A 11.2.8 |
User Endpoint Devices |
| Technological Controls | Annex A 8.2 | Annex A 9.2.3 | Privileged Access Rights |
| Technological Controls | Annex A 8.3 | Annex A 9.4.1 | Information Access Restriction |
| Technological Controls | Annex A 8.4 | Annex A 9.4.5 | Access to Source Code |
| Technological Controls | Annex A 8.5 | Annex A 9.4.2 | Secure Authentication |
| Technological Controls | Annex A 8.6 | Annex A 12.1.3 | Capacity Management |
| Technological Controls | Annex A 8.7 | Annex A 12.2.1 | Protection Against Malware |
| Technological Controls | Annex A 8.8 |
Annex A 12.6.1 Annex A 18.2.3 |
Management of Technical Vulnerabilities |
| Technological Controls | Annex A 8.9 | NEW | Configuration Management |
| Technological Controls | Annex A 8.10 | NEW | Information Deletion |
| Technological Controls | Annex A 8.11 | NEW | Data Masking |
| Technological Controls | Annex A 8.12 | NEW | Data Leakage Prevention |
| Technological Controls | Annex A 8.13 | Annex A 12.3.1 | Information Backup |
| Technological Controls | Annex A 8.14 | Annex A 17.2.1 | Redundancy of Information Processing Facilities |
| Technological Controls | Annex A 8.15 |
Annex A 12.4.1 Annex A 12.4.2 Annex A 12.4.3 |
Logging |
| Technological Controls | Annex A 8.16 | NEW | Monitoring Activities |
| Technological Controls | Annex A 8.17 | Annex A 12.4.4 | Clock Synchronization |
| Technological Controls | Annex A 8.18 | Annex A 9.4.4 | Use of Privileged Utility ProgramsAccess Rights |
| Technological Controls | Annex A 8.19 |
Annex A 12.5.1 Annex A 12.6.2 |
Installation of Software on Operational Systems |
| Technological Controls | Annex A 8.20 | Annex A 13.1.1 | Networks Security |
| Technological Controls | Annex A 8.21 | Annex A 13.1.2 | Security of Network Services |
| Technological Controls | Annex A 8.22 | Annex A 13.1.3 | Segregation of Networks |
| Technological Controls | Annex A 8.23 | NEW | Web filtering |
| Technological Controls | Annex A 8.24 |
Annex A 10.1.1 Annex A 10.1.2 |
Use of Cryptography |
| Technological Controls | Annex A 8.25 | Annex A 14.2.1 | Secure Development Life Cycle |
| Technological Controls | Annex A 8.26 |
Annex A 14.1.2 Annex A 14.1.3 |
Application Security Requirements |
| Technological Controls | Annex A 8.27 | Annex A 14.2.5 | Secure System Architecture and Engineering PrinciplesLearning From Information Security Incidents |
| Technological Controls | Annex A 8.28 | NEW | Secure Coding |
| Technological Controls | Annex A 8.29 |
Annex A 14.2.8 Annex A 14.2.9 |
Security Testing in Development and Acceptance |
| Technological Controls | Annex A 8.30 | Annex A 14.2.7 | Outsourced Development |
| Technological Controls | Annex A 8.31 |
Annex A 12.1.4 Annex A 14.2.6 |
Separation of Development, Test and Production Environments |
| Technological Controls | Annex A 8.32 |
Annex A 12.1.2 Annex A 14.2.2 Annex A 14.2.3 Annex A 14.2.4 |
Change Management |
| Technological Controls | Annex A 8.33 | Annex A 14.3.1 | Test Information |
| Technological Controls | Annex A 8.34 | Annex A 12.7.1 | Protection of Information Systems During Audit Testing |
[case_study_slider ids=”88859,101932,92016″ autoplay=”true” autoplay_speed=”5000″]
How ISMS.online Helps You Achieve Annex A 5.16 Compliance
As long as you update your security management system’s processes to reflect the improved controls, you will be in compliance with ISO 27001:2022. This can be handled by ISMS.online if you do not have the necessary resources in house.
We simplify ISO 27001:2022 implementation through our intuitive workflow and tools, including frameworks, policies, controls, actionable documentation, and guidance. With our cloud-based software, you can manage all your ISMS solutions in one place.
Our platform allows you to define the scope of your ISMS, identify risks, and implement controls easily.
To learn more about how ISMS.online can assist you in achieving your ISO 27001 objectives, please get in touch today to book a demo.
