Glossary · I
Identity and access management
Identity and access management is the discipline of establishing who a user or system is, what it is permitted to do, and enforcing and recording that across the organization’s systems.
Extended definition
In more detail.
It covers directories, authentication, authorization, provisioning and de-provisioning, privileged access, review of entitlements and the logging of access. Most breaches involve a stolen or misused identity, which is why identity is the foundation of zero trust and why MFA, privileged access management and timely removal of leavers’ access are the controls examiners check first.
In our work
Where it appears.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days