Which standards require an identity and access management standard?

ISO/IEC 27001:2022: 5.16, 5.18; ISO/IEC 27701:2025: A.3.8.

What must an identity and access management standard contain under ISO 27001?

5.16: Manage the full life cycle of identities. 5.18: Provision, review, modify and remove access rights in line with the access control policy. The ISO 27002 guidance beside 5.16: Requires the full life cycle of identities to be managed, from creation through change to removal.

Who should own the identity and access management standard?

The clauses imply the head of IT operations. The register names the role so the line on your list can carry a name.

How often should an identity and access management standard be reviewed?

Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).

Is there a template for an identity and access management standard?

Yes: https://compliance.theartofservice.com/policy-templates/identity-and-access-management-policy

Every policy type · Access and identity

Identity and access management standard

How identities are created, linked to a person, changed and removed across the systems, and how shared and service accounts are handled.

How the register reads it

Also called	IAM standard, account management standard
Family	Access and identity
Document type	Standard. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Folds into	The regimes accept it folded into the access control policy; when neither is listed, the gap is counted once, under the parent.
Expected owner	The head of IT operations.
Review cadence	Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list when	never on its own: the register recognises it and names the clauses, but no ticked regime lists it as a separate document (its parent, access control policy, is).
Template	Identity and access management policy.

Which standards require it, and what each expects it to contain

3 requiring clauses, 2 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 5.16 Identity management

Manage the full life cycle of identities.

What the ISO 27002 guidance expects the document to say: Requires the full life cycle of identities to be managed, from creation through change to removal.

Evidence an auditor accepts: The identity lifecycle procedure covering creation, change and removal, for internal users, external users and non human identities; records showing each identity is traceable to a person or to an accountable owner where the identity is for a service or device; approval records for identity creation, sourced from an authoritative system such as human resources or contract management
Common gap: relying on manual spreadsheets for provisioning
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

ISO 27001 5.18 Access rights

Provision, review, modify and remove access rights in line with the access control policy.

What the ISO 27002 guidance expects the document to say: Requires access rights to information and other associated assets to be provisioned, reviewed, modified and removed in accordance with the organisation's topic specific policy and rules on access control.

Evidence an auditor accepts: Provisioning records showing the authorisation behind each access grant, tied to the access control rules; modification records where access changed after a role change, showing removal of the previous entitlements; removal records on termination, with the date of removal against the date of departure
Common gap: Reviews lack documented corrective actions
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

ISO/IEC 27701:2025

ISO 27701 A.3.8 Identity management

Procedures for the registration and de-registration of users who administer or operate systems and services that process PII shall address the situation where those users' access control is compromised, such as the corruption or compromise of passwords or other registration data. The organization shall not reissue deactivated or expired user identifiers on systems and services that process PII. Where the organization provides PII processing as a service, the customer can be responsible for some or all aspects of user identifier management and such cases shall be included in the documented information; some jurisdictions impose specific requirements on the frequency of checks for unused authentication credentials on systems that process PII.

Evidence an auditor accepts: Registration and de-registration procedures covering credential compromise; evidence identifiers on systems processing PII are never reissued; documented split of identifier management responsibility with customers
Common gap: Identifiers reissued to new joiners so historical access records point at the wrong person
Source: ISO/IEC 27701:2025

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Access review procedure · Password and authentication standard