ISO 27001 A.5.16: Identity management

Set up a centralised identity provider (Active Directory, Azure AD, Okta, or similar) as the single authoritative source for all identities. Integrate it with your applications through SAML or OIDC. Define your lifecycle processes clearly. Registration needs identity verification before any account is created. Use a consistent naming convention. Link every identity to a real individual and track attributes like department, role, manager, and employment status. For service accounts, document purpose, owner, and review schedule. Tie provisioning to HR onboarding. When HR creates a new employee record, that should trigger account creation, role assignment, and notifications. Automate this with identity governance tooling if you can - manual processes create delays and errors. Handle changes proactively. Role changes, transfers, and promotions should trigger identity updates. Run regular reviews to catch dormant accounts and excessive privileges that have crept in. Make deprovisioning fast and thorough. Disable accounts on or before the last working day. Set a retention period before permanent deletion (check your legal requirements). For contractors and temps, set expiry dates at provisioning time so they do not slip through the cracks. Prevent identity duplication by keeping a single authoritative source. Never allow shared accounts where individual accountability is required. Make sure service and system accounts are inventoried, owned, and reviewed regularly.