# Identity Controls for ISO 27001

Source: https://startwithidentity.com/guides/compliance/identity-controls-for-iso-27001/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

ISO/IEC 27001 is the international standard for information security management. It does not prescribe products, but its Annex A controls lean heavily on identity, and auditors will expect you to show how access is granted, reviewed, and removed. This maps the identity-relevant controls to what you actually build.

## What ISO 27001 expects of identity

The 2022 revision groups controls into themes. The identity-relevant ones include access control, identity management, authentication information, and privileged access:

- **Access control (A.5.15):** a documented policy and least-privilege enforcement.
- **Identity management (A.5.16):** a managed lifecycle for every identity, human and [non-human](https://startwithidentity.com/guides/fundamentals/what-is-non-human-identity/).
- **Authentication information (A.5.17):** secure handling of credentials, pushing toward MFA and [passwordless](https://startwithidentity.com/guides/fundamentals/what-is-passwordless/).
- **Access rights (A.5.18):** provisioning, review, and prompt removal, the [joiner-mover-leaver](https://startwithidentity.com/glossary/joiner-mover-leaver/) lifecycle.
- **Privileged access (A.8.2):** restricted, monitored, and time-bound.

## What good looks like

- SSO and [MFA](https://startwithidentity.com/vendors/mfa/) across in-scope systems, with phishing-resistant factors for privileged users.
- Automated provisioning and [deprovisioning](https://startwithidentity.com/glossary/deprovisioning/) via [SCIM](https://startwithidentity.com/standards/scim-2-0/), so leavers lose access promptly.
- Periodic [access reviews](https://startwithidentity.com/glossary/access-certification/) with evidence, typically through [IGA](https://startwithidentity.com/vendors/iga/).
- [PAM](https://startwithidentity.com/vendors/pam/) for privileged accounts with session logging.

## Common pitfalls

- Access reviews that happen but are not evidenced; auditors want the artifact.
- Orphaned and service accounts outside the lifecycle.
- Privileged access granted permanently rather than [just in time](https://startwithidentity.com/guides/implementation/zero-standing-privileges-rollout/).

## Related

[IAM audit preparation](https://startwithidentity.com/guides/compliance/iam-audit-preparation-guide/), [SOC 2 for identity](https://startwithidentity.com/guides/compliance/soc2-for-identity/). Vendors: [IGA](https://startwithidentity.com/vendors/iga/), [PAM](https://startwithidentity.com/vendors/pam/).

## Mapping identity to Annex A

The identity-relevant controls in the 2022 Annex A cluster tightly, and mapping them explicitly saves argument during certification:

- **A.5.15 Access control** and **A.5.18 Access rights**: policy, provisioning, review, and removal. This is where [access certification](https://startwithidentity.com/glossary/access-certification/) evidence lands.
- **A.5.16 Identity management**: unique identities, lifecycle, and the handling of non-human identities.
- **A.5.17 Authentication information**: credential issuance, [MFA](https://startwithidentity.com/glossary/mfa/), and secure recovery.
- **A.8.2 Privileged access rights**: allocation, review, and restriction of elevated access.
- **A.8.5 Secure authentication** and **A.8.15 Logging**: the technical implementation and its audit trail.

## What certification actually tests

Auditors test operation, not intent. The recurring findings in identity are predictable: access reviews completed but with no revocations, leavers removed from single sign-on while local and vendor accounts stayed live, privileged rights granted for a project and never withdrawn, and an MFA exemption list that has grown without review.

The corresponding evidence to keep is equally predictable. Review campaigns with revocation counts, a leaver reconciliation across systems outside SSO, a standing-privilege count trending down, and a dated exemption register with justification per entry.

## Where the ISMS scope bites

ISO 27001 lets you scope the ISMS, and identity systems have a way of straddling the boundary. If your identity provider authenticates access to both in-scope and out-of-scope systems, it is in scope, and so are its administrators. Decide that early rather than during the audit, and treat the identity provider itself as tier-zero infrastructure. See [what is IGA](https://startwithidentity.com/guides/fundamentals/what-is-iga/) and [zero standing privileges](https://startwithidentity.com/glossary/zero-standing-privileges/).

## Where to start