ISO 27001 Annex A 5.16 Identity life cycle management
What it says
The full life cycle of identities shall be managed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure all user and system identities are managed from creation to deactivation.
This control is about managing who can access your organisation's information by properly handling identities from the moment they are created until they are no longer needed. If you don't keep track of identities like usernames and passwords, former employees or unauthorised users could access sensitive information, leading to data breaches or other security problems.
Free. Save your status, tasks and notes.
Why it matters
Poor identity life cycle management leaves stale and orphaned accounts active, increasing the chance of unauthorised access and data breaches.
How to implement
The IT manager should ensure unique identities are assigned to each employee.
This can be done by keeping a central database where each staff member is given a unique login ID, and ensuring no duplicate accounts exist for the same individual.
HR should coordinate with IT to make sure that all identity creation or removal is logged and reviewed regularly.
When someone joins or leaves the company, HR must notify IT promptly to create or disable the necessary accounts.
The operations manager should approve any shared identities, ensuring they are strictly necessary and logged.
They must also assign responsibility for monitoring these shared accounts to prevent misuse.
IT managers must disable or remove identities promptly when they are no longer in use.
Regular checks should verify that only current employees have active identities, aligning with processes outlined in the ISO 27002:2022 guidance.
Ensure all changes to user identities are documented and reviewed regularly.
This includes auditing third-party identity use, like social media logins, ensuring they meet your organisation's security standards and any risks are managed as suggested by ISO 27002:2022 and Australian regulations.
Keep it running
Regularly review joiner/mover/leaver events, reconcile identity records, and disable or remove accounts promptly to prevent orphaned access paths.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of all registered user identities.
Look at
Whether each identity is unique.
Good evidence
Each person having only one assigned identity, with no duplicates across the system.
- Check 2 of 5What an auditor asks for
Ask for
Documentation of user identity approvals.
Look at
How shared identities are justified and approved.
Good evidence
A clear record showing shared identities are necessary and authorised by management.
- Check 3 of 5What an auditor asks for
Ask for
Records showing the lifecycle management of identities.
Look at
The timings between the creation, updating, and deactivation of identities.
Good evidence
Identities being deactivated promptly when no longer needed.
- Check 4 of 5What an auditor asks for
Ask for
Logs of access control changes.
Look at
How the organisation handles role changes or departures.
Good evidence
A systematic process where access rights are reviewed and adjusted as soon as a role change occurs.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of periodic reviews of identity management processes.
Look at
How regularly and thoroughly these reviews are done.
Good evidence
Documented reviews aligning with ISO 27002:2022 recommendations and findings reported to upper management.
Mappings
Closest match in ASD Information Security Manual: ISM-0407, Maintaining a secure lifetime access record for each human user, which this control covers in full and more.
ASD Information Security Manual: 23 mappings
This control is broader than ISM-0407.
Annex A 5.16 requires the identity lifecycle to be managed, which relies on maintaining evidence of identity creation, authorisation, changes, reviews and withdrawal. ISM-0407 supports this by mandating a secure record for each user over the life of the system, capturing authorisation, access grants, reviews, changes and withdrawal dates. ISM-0407 is primarily a recordkeeping/audit trail requirement, while Annex A 5.16 is the overarching lifecycle management expectation that those records enable and evidence.
This control is broader than ISM-0414.
ISM-0414 requires every user granted access is uniquely identifiable. Annex A 5.16 covers identity lifecycle management to create, maintain, and retire these unique identities. ISM-0414 is the accountability outcome, while Annex A 5.16 governs the lifecycle necessary to support this requirement.
This control is broader than ISM-0415.
ISM-0415 requires shared user accounts to be strictly controlled and used in a way that makes each individual user uniquely identifiable. ISO/IEC 27001:2022 Annex A 5.16 covers managing identities across their full life cycle (creation, changes, and removal), which includes governing the use and constraints of non-personal identities such as shared or generic accounts. ISM-0415 is a specific, higher-assurance requirement focused on shared-account control and attribution, while Annex A 5.16 is broader and less prescriptive about how attribution is achieved.
This control is broader than ISM-0420.
ISM-0420 requires that where systems process, store or communicate AUSTEO, AGAO or REL data, personnel who are foreign nationals are explicitly identified, including their specific nationality. Annex A 5.16 (Identity life cycle management) relates because capturing and maintaining authoritative identity attributes (including user characteristics needed for access decisions) is part of managing identities across joiner/mover/leaver processes. ISM-0420 is a specific identity-attribute requirement focused on foreign nationality in sensitive contexts, whereas Annex A 5.16 is broader and covers the whole identity lifecycle beyond nationality attributes.
This control is broader than ISM-0430.
Annex A 5.16 requires organisations to manage identities through their full life cycle, including timely deprovisioning when access is no longer required. ISM-0430 specifies a concrete leavers/movers requirement: access must be removed or suspended on the same day a person no longer has a legitimate need. ISM-0430 is a targeted offboarding/deprovisioning control, while Annex A 5.16 also covers identity creation, modification and ongoing governance beyond same-day removal.
This control is broader than ISM-1583.
ISM-1583 requires organisations to ensure personnel who are contractors are clearly identified as contractors within systems. Annex A 5.16 requires management of the full identity life cycle, which includes establishing identity attributes (such as worker type/engagement) and keeping them current as people join, change, or leave. ISM-1583 is a specific identity attribute requirement within the broader ISO identity life cycle capability.
This control is broader than ISM-1591.
ISM-1591 requires organisations to remove or suspend access as soon as practicable when a user is detected performing malicious activity. Annex A 5.16 requires the full identity lifecycle to be managed, which encompasses processes to disable, revoke, and otherwise change identities and their access when conditions arise. ISM-1591 is a specific lifecycle action tied to a malicious-activity trigger and urgent timing, while Annex A 5.16 covers the broader end-to-end identity lifecycle across all joiner/mover/leaver and governance events.
- ISM-1593Verify user identity before issuing, resetting, disabling or enrolling credentialsBroader than
This control is broader than ISM-1593.
ISM-1593 mandates that users provide sufficient evidence to verify their identity upon requesting new credentials, such as during issuance or re-issuance. Annex A 5.16 encompasses the broader management of identities throughout their life cycle, including creation, verification, changes and removal. Thus, ISM-1593 can be seen as focusing particularly on the identity proofing part of this life cycle, whereas Annex A 5.16 deals with a wider governance aspect.
This control is broader than ISM-1619.
ISM-1619 requires service accounts to be created specifically as group Managed Service Accounts (gMSAs) to improve security of service identity use. Annex A 5.16 requires the organisation to manage the full identity life cycle (creation, management, changes, and retirement) for identities, which includes service account identities. ISM-1619 is a specific technical implementation choice within the broader identity life cycle management outcomes required by Annex A 5.16.
This control is broader than ISM-1845.
Annex A 5.16 requires organisations to manage identities through to deactivation, ensuring access paths are removed when an account is disabled. ISM-1845 provides a specific deprovisioning step in Active Directory: removing disabled users from all security group memberships to prevent residual authorisations. ISM-1845 is a narrow technical requirement for group membership clean-up, while Annex A 5.16 covers the wider identity lifecycle including provisioning, modification and review across systems.
This control is broader than ISM-1920.
ISM-1920 requires controlling how users enrol MFA by blocking self-enrolment from untrustworthy devices for sensitive-data services. ISO/IEC 27001:2022 Annex A 5.16 requires managing the full identity life cycle, which commonly includes onboarding steps such as registering authentication factors and enforcing conditions for that registration. Annex A 5.16 covers many identity processes beyond authentication-factor enrolment, whereas ISM-1920 targets a specific anti-takeover safeguard during MFA enrolment.
This control is broader than ISM-1934.
ISM-1934 requires a six-monthly review and removal of unnecessary DCSync permissions on user accounts to reduce excessive replication privileges. Annex A 5.16 requires the organisation to manage the full life cycle of identities, including changes in roles and revocation of entitlements as identities evolve. ISM-1934 is narrower because it focuses on one high-risk entitlement (DCSync) and a fixed review cadence rather than end-to-end identity lifecycle management.
This control is broader than ISM-1943.
ISM-1943 requires strong mapping controls to ensure certificates are accurately and securely linked to user identities in Active Directory. Annex A 5.16 requires management of the full identity lifecycle (creation, changes, and removal), which underpins maintaining correct bindings between credentials (including certificates) and identities. ISM-1943 focuses on one identity-binding mechanism in AD, whereas Annex A 5.16 covers broader governance and lifecycle processes beyond certificate mapping.
This control is broader than ISM-1951.
ISM-1951 requires that hard match takeover is disabled on Microsoft Entra Connect servers to prevent unauthorised account takeover via identity matching mechanisms. Annex A 5.16 (Identity life cycle management) relates because controlling how identities are created, linked, and managed across their lifecycle includes preventing unsafe account linking/takeover paths in synchronisation tooling. ISM-1951 is a specific technical safeguard in one product, while Annex A 5.16 is broader and covers end-to-end identity lifecycle processes across the organisation.
This control is broader than ISM-2047.
ISM-2047 requires secondary-channel notification to the human user whenever an authentication factor reset occurs, providing a direct user-visible signal for account recovery abuse. This is a specific control activity that would normally be defined within ISO/IEC 27001 Annex A 5.16 (Identity life cycle management), which covers management of identities across creation, changes (including credential recovery) and retirement. Annex A 5.16 is broader across the whole identity lifecycle, while ISM-2047 focuses narrowly on the notification step for factor reset events.
This control is broader than ISM-2133.
ISM-2133 requires each AI agent to be issued its own unique identity that is not a personnel account and not shared with other agents. ISO/IEC 27001:2022 Annex A 5.16 (Identity life cycle management) requires managing identities across their full life cycle, including creation, changes, suspension, and removal for all identity types (human and non-human). ISM-2133 is a prescriptive constraint within the broader identity governance processes expected by Annex A 5.16.
This control is broader than ISM-2145.
ISM-2145 requires organisations to revoke user account credentials when they are no longer required. ISO/IEC 27001:2022 Annex A 5.16 requires management of the full identity lifecycle, which includes joiner/mover/leaver processes and associated credential deprovisioning. ISM-2145 is a specific credential-revocation requirement within the broader identity lifecycle scope of Annex A 5.16.
- ISM-2148Revoke sessions and tokens on reset, compromise, non-compliance or risky sign-inBroader than
This control is broader than ISM-2148.
ISM-2148 requires revocation of sessions and tokens in response to lifecycle and risk events (reset/re-enrolment, compromise, non-compliance, risky sign-ins). Annex A 5.16 requires management of the full identity lifecycle, including changes, suspension and revocation actions when risk or status changes occur. ISM-2148 is a specific identity lifecycle response focused on invalidating current authenticated sessions/tokens, while Annex A 5.16 also covers onboarding, changes, deprovisioning and other identity governance activities.
This control partially overlaps ISM-0380.
Annex A 5.16 requires managing identities across creation, change, review and deactivation, including ensuring accounts are retired when no longer required (leavers and role changes). ISM-0380 overlaps by explicitly requiring unneeded user accounts to be disabled or removed, which is a direct lifecycle offboarding outcome and also applies during movers when accounts/functions become unnecessary. However, ISM-0380 also extends beyond identities into hardening (components/services/functionality), while Annex A 5.16 covers broader identity lifecycle governance beyond disabling/removal alone.
This control partially overlaps ISM-0446.
Annex A 5.16 requires identity lifecycle management so that identity attributes, roles and entitlements are controlled as personnel join, move, or leave. ISM-0446 overlaps by imposing an eligibility constraint on privileged role assignment for foreign nationals on AUSTEO/REL systems, which must be enforced during onboarding, role changes, and periodic entitlement review. ISM-0446 is classification-specific and focused on privileged access eligibility, while Annex A 5.16 is broader and applies to all identity types and lifecycle stages.
This control partially overlaps ISM-2053.
ISM-2053 requires organisations to define end-of-life procedures for software, including how to archive or destroy user accounts and associated data when software is retired. ISO/IEC 27001:2022 Annex A 5.16 overlaps because it requires identities to be managed across their full lifecycle, including modification and de-provisioning when systems are decommissioned. Annex A 5.16 is identity-centric across all systems, whereas ISM-2053 is triggered by software retirement and covers software removal as well.
- ISM-2146Revoking static application and workload credentials when no longer requiredPartially overlaps
This control partially overlaps ISM-2146.
ISM-2146 requires static credentials used by applications and workloads to be revoked when no longer required. ISO/IEC 27001:2022 Annex A 5.16 focuses on managing the full life cycle of identities, which can include service identities and their associated credentials. They overlap where an application/workload identity is decommissioned and its credentials must be removed, but Annex A 5.16 is identity-centric (joiner/mover/leaver), while ISM-2146 is credential-centric and explicitly targets static secrets regardless of identity lifecycle events.
This control supports ISM-1950.
Annex A 5.16 requires organisations to manage identities across their lifecycle, including maintaining integrity of identity records and linkages between identity stores. ISM-1950 supports this by reducing the risk of incorrect identity linkage between AD DS and Microsoft Entra ID after initial synchronisation, which helps ensure the right identity is updated/disabled over time. ISM-1950 is a technology-specific hardening measure, while Annex A 5.16 is technology-agnostic and includes governance and process controls across all identity types.
ASD Essentials for enterprise IT: 2 mappings
This control is broader than IT.PRO-13.1.
IT.PRO-13.1 requires default and unused accounts to be identified and disabled or removed regularly, with exceptions only where an account is documented, justified, hardened and monitored. This is a specific part of managing the full life cycle of identities required by ISO/IEC 27001 Annex A 5.16, particularly the removal of identities that are no longer needed. Annex A 5.16 also covers how identities are created and changed, while IT.PRO-13.1 focuses on default and unused accounts.
- IT.IDE-01.2Keep current records of infrastructure, software, identities, credentials and dataPartially overlaps
This control partially overlaps IT.IDE-01.2.
IT.IDE-01.2 requires current records of infrastructure, operating systems, applications, identities, credentials and data assets. Keeping identity records current contributes directly to ISO/IEC 27001 Annex A 5.16, which requires the full life cycle of identities to be managed. IT.IDE-01.2 spans many asset types but only addresses record keeping, whereas Annex A 5.16 covers how identities are created, changed and removed.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.