ISO 27001:2022 Annex A Control 5.16

General Guidance on ISO 27001:2022 Annex A 5.16

Annex A 5.16 compliance is achieved by expressing identity-based procedures clearly in policy documents and monitoring staff adherence on a daily basis.

Six procedures are listed in Annex A 5.16, to ensure that an organisation meets the requisite standards of infosec and cybersecurity governance:

1. Whenever an identity is assigned to a person, that person is the only one who can authenticate with that identity and/or use it when accessing network resources.

Achieving compliance means IT policies must stipulate clearly that users are not to share login information, or allow other users to roam the network using any identity other than the one they have been given.

2. In some cases, it may be necessary to assign a single identity to several people, also known as a ‘shared identity’. Only use this approach when an explicit set of operational requirements is needed.

To achieve compliance, registration of shared identities should be handled separately from single user registration, with a dedicated approval process.

3. ‘Non-human’ entities (any identity that isn’t tied to a real person) should be treated differently from user-based identities at registration.

A non-human identity should also have its own approval and registration process, acknowledging the fundamental difference between assigning an identity to a person and granting one to an asset, application or device.

4. In the event of a departure, redundant assets, or other non-required identities, a network administrator should disable them or remove them completely.

The IT department should conduct regular audits to determine which identities are being used, and which entities can be suspended or deleted. It is important for HR staff to include identity management in offboarding procedures, and to inform IT staff immediately when a leaver leaves.

5. It is imperative to avoid duplicate identities at all costs. A ‘one entity, one identity’ rule should be followed by all organisations.

To comply, IT staff should ensure that entities do not receive access rights based on more than one identity when assigning roles across a network.

6. Identities management and authentication information should be documented adequately for all ‘significant events.

It is possible to interpret the term ‘significant event’ differently, but on a basic level, organisations need to make sure that their governance procedures include a comprehensive list of assigned identities at any given time, robust change request protocols with appropriate approval procedures, and an approved change request protocol.

Additional Supplementary Guidance for Annex A 5.16

When creating an identity and granting it access to network resources, Annex A 5.16 also lists four steps that businesses need to follow (amending or removing access rights is shown in ISO 27001:2022 Annex A 5.18):

1. Before creating an identity, establish a business case.

Every time an identity is created, identity management becomes exponentially more challenging. It is advisable for organisations to create new identities only when it is clearly necessary.

2. Make sure that the entity (human or non-human) assigned an identity has been independently verified.

Identities and Access Management procedures should ensure that, once the business case has been approved, an individual or asset receiving new identities has the required authority before an identity is created.

3. Creating an identity

Your IT staff should build an identity in line with the business case requirements, and it should be limited to what is outlined in any change request documentation.

4. The final configurations steps for an identity

As the final step in the process, an identity is assigned to each of its access-based permissions and roles (RBAC) as well as any authentication services required.

What Are the Changes From ISO 27001:2013?

ISO 27001:2022 Annex A 5.16 replaces ISO 27001:2013 A.9.2.1 (formerly known as ‘User Registration and Deregistration’).

While the two controls share some striking similarities – primarily in maintenance protocols and deactivating redundant IDs – Annex A 5.16 contains a comprehensive set of guidelines that deal with Identity and Access Management as a whole.

Annex A 5.16 Human vs. Non-human Identities Explained

There are some differences between the 2022 Annex and its predecessor in that despite differences in registration processes, humans and non-humans are no longer treated separately when it comes to general network administration.

It has become more common in IT governance and best practice guidelines to talk about human and non-human identities interchangeably since the advent of modern Identity and Access Management and Windows-based RBAC protocols.

In Annex A 9.2.1 of ISO 27001:2013, there is no guidance on how to manage non-human identities, and the text is concerned only with managing what it calls ‘User IDs’ (i.e. login information along with a password that’s used to access a network).

ISO 27001:2022 Annex A 5.16 Documentation

Annex A 5.16 provides explicit guidance on both the general security implications of identity governance, and how organisations should record and process information prior to the assigning of identities, as well as throughout the lifecycle of the identity.

Comparatively, ISO 27001:2013 A.9.2.1 only briefly mentions the IT governance role that surrounds the administration of identities, and limits itself to the physical practice of identity administration.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

How ISMS.online Helps You Achieve Annex A 5.16 Compliance

As long as you update your security management system’s processes to reflect the improved controls, you will be in compliance with ISO 27001:2022. This can be handled by ISMS.online if you do not have the necessary resources in house.

We simplify ISO 27001:2022 implementation through our intuitive workflow and tools, including frameworks, policies, controls, actionable documentation, and guidance. With our cloud-based software, you can manage all your ISMS solutions in one place.

Our platform allows you to define the scope of your ISMS, identify risks, and implement controls easily.

To learn more about how ISMS.online can assist you in achieving your ISO 27001 objectives, please get in touch today to book a demo.