Identity and access management (IAM) manages individuals’ identification, authentication, authorization, and access to organizational data, systems, and resources. It acts as a digital gatekeeper by granting appropriate access at the right times, locations, and business reasons. section 7.1
IAM applies a controlled identity life cycle:
- Create identities during onboarding and document roles and attributes. section 7.1
- Assign and provision access through an access matrix and defined access methods. section 7.1
- Manage identities as roles, access requirements, and organizational conditions change. section 7.1
- Offboard identities promptly by scheduling suspensions and revoking access. section 7.1
Centralized IAM systems provide a single reference point across directories, databases, and applications. They support consistent policies, lower administrative effort, scalable changes, and auditable access decisions. section 7.1
ACME Corporation’s IAM dashboard
ACME set measurable IAM targets: halve weekly access problems, provision and de-provision users within one day, exceed a 95% authentication success rate, and eliminate audit problems. Improvements reduced access problems to 10 per week and provisioning to one day, but de-provisioning remained at two days, leaving an access-risk priority for automation or workflow improvement. section 7.1.11
Table 7.1 Stages of identity life cycle management
| Create user |
Assign access |
Provision identity |
Manage identity |
Offboard identity |
| Document roles and attributes. Align onboarding exceptions. |
Create an access matrix. Define attributes. Create a cadence of review. |
Understand the best route for each resource. Use SAML, SCIM, LDAP, agents, and APIs. Map attributes downstream. |
Define the standard method of access. Collaborate with department leaders. Log and document changes. |
Use a centralized directory. Schedule suspensions to revoke access. |
Use the identity life cycle table to navigate creation, access assignment, provisioning, ongoing management, and offboarding tasks. section 7.1
