Compliance hub
ISO 27001 Identity and Access Management: Implementing Annex A Controls
ISO/IEC 27001:2022's Annex A dedicates a cluster of controls to identity: access control policy (5.15), identity management (5.16), authentication information (5.17), access rights (5.18) and privileged/utility restrictions (8.2–8.5). IamLogic implements these controls operationally — and we hold the certificate ourselves, so we know what auditors ask.
Context
What the framework expects
IamLogic is built by an ISO/IEC 27001 certified organisation, with the certification scope covering the full product lifecycle.
For certification and surveillance audits, the recurring identity questions are: how are access rights granted, reviewed and removed; how is authentication protected; and where is the evidence.
Identity obligations
The requirements that touch IAM
- A.5.15 Access control — rules governing physical and logical access
- A.5.16 Identity management — full lifecycle of identities
- A.5.17 Authentication information — secure handling of credentials
- A.5.18 Access rights — provisioning, review and revocation
- A.8.2 Privileged access rights — restricted and managed allocation
- A.8.5 Secure authentication — strong authentication techniques
Control mapping
Requirement → IamLogic control
The table your compliance team and your auditor both want: each identity-relevant requirement, the product control that implements it, and which product it lives in.
| Requirement | IamLogic control | Product |
|---|---|---|
| A.5.15 / A.5.18: rights provisioned, reviewed, revoked per policy | Role-based provisioning, certification campaigns and automated revocation with full trails | IamLogic IGA |
| A.5.16: identity lifecycle management | Joiner–mover–leaver automation from authoritative sources | IamLogic IGA |
| A.5.17: authentication information protection | Credential vaulting with optional automatic rotation for legacy apps; SSPR with policy controls | Access Manager |
| A.8.2: privileged access restraint | Just-in-time, time-bound elevated access and SoD policies | IamLogic IGA |
| A.8.5: secure authentication | MFA and passwordless WebAuthn with adaptive step-up | Access Manager |
This page is provided for general information and maps regulatory expectations to IamLogic product capabilities. It is not legal advice. Regulatory obligations and timelines evolve — confirm your organisation's specific requirements with your compliance counsel.
Privileged access
Privileged access under ISO 27001 (A.8.2)
Annex A control 8.2 asks that the allocation and use of privileged access rights is restricted and managed. In practice, auditors look for privileged access that is granted deliberately, limited to what the role needs, reviewed regularly and backed by stronger authentication.
Restricted allocation
Elevated access requested and approved through defined workflows, with time-bound grants and segregation-of-duties policies in IamLogic IGA.
Regular review
Privileged entitlements included in access certification campaigns, with reviewer decisions and revocations recorded as audit evidence.
Stronger authentication
MFA and passwordless WebAuthn for privileged sessions, with adaptive step-up in Access Manager (A.8.5).
Protected credentials
Credential vaulting with optional automatic rotation for legacy application accounts, so passwords aren't known to users or reused (A.5.17). See how this works in our privileged access case study.
FAQ
Common questions
Will IamLogic help with our certification audit itself?
Beyond the product, our services team offers ISO 27001-aligned consulting — assessing your identity controls and aligning them with both the standard and the platform's capabilities. We've been through the audit ourselves.
What does ISO 27001 require for identity and access management?
ISO/IEC 27001:2022 Annex A groups its identity requirements into access control policy (5.15), identity management (5.16), authentication information (5.17), access rights (5.18), privileged access rights (8.2) and secure authentication (8.5). Auditors typically ask how access rights are granted, reviewed and removed, how authentication is protected, and where the evidence is.
What does ISO 27001 control A.8.2 privileged access require?
A.8.2 requires that the allocation and use of privileged access rights is restricted and managed. That usually means granting elevated access through approval, limiting it in time and scope, reviewing it regularly and protecting it with stronger authentication.
How do you map identity controls to ISO 27001?
Start from the Annex A identity controls, then identify the product control that implements each one and the evidence it produces. The control mapping on this page shows each requirement, the IamLogic capability that supports it and the product it lives in.
Map ISO 27001 to your environment
A working session with our engineers: your systems, this framework's requirements, and a concrete gap list you keep either way.