Key takeaways
- Manage the full life cycle of user identities, from creation to removal.
- Every user, service and device needs a unique, managed identity so actions can be traced and access can be revoked.
- Start here: issue unique identities to each person; avoid shared accounts.
Purpose
Manage the full life cycle of user identities, from creation to removal.
Requirement
Requirement summaryThe full life cycle of identities shall be managed.
Why it matters
Every user, service and device needs a unique, managed identity so actions can be traced and access can be revoked.
How to implement
- Issue unique identities to each person; avoid shared accounts.
- Define how identities are created, changed and disabled across the lifecycle.
- Document and limit any shared or service accounts, with owners.
- Reconcile identities against HR records regularly.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.16. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your process for creating, changing and removing user accounts.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.16 marked as used or not used, a short reason, and its current status.
Records and examples to show
- A full user list showing everyone has their own account.
- A list of shared or system accounts, each with a named owner and reason.
- Examples of recent joiners and leavers showing accounts were created and removed correctly.
Things you should be able to show or explain
- Be able to explain how accounts are kept in step with HR changes.
How much to show: A handful of joiners and leavers plus all shared accounts.
Common mistakes
- Shared logins with no one accountable.
- System accounts with no owner.
- Orphaned accounts left behind after people leave.
- Service accounts nobody owns.
- Tip: One identity per person; avoid shared accounts.
Policies & documents to have
- Access Control Policy
FAQ
Is A.5.16 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.16?
Be ready to explain how the control works in your organisation and to provide things like: Your process for creating, changing and removing user accounts…