Cybersecurity Auditing

Chapter 6Identity and Access Management

Identity and access management (IAM) sits at the center of cybersecurity assurance. It defines how trust is established, maintained, and revoked across every layer of an organization’s technology ecosystem. From onboarding new users to managing privileged credentials and machine identities, the effectiveness of these controls determines whether the enterprise can enforce least privilege and maintain accountability in a complex digital environment. As threat actors increasingly exploit identity weaknesses rather than technical vulnerabilities, understanding and auditing this domain has become one of the most critical elements of enterprise security governance.

Modern identity systems extend far beyond usernames and passwords. They integrate with cloud directories, federated partners, and automated workflows that grant and revoke access across thousands of systems in real time. This chapter examines the full life cycle of identity assurance—from how user and service identities are created and governed to how authentication, elevation, and emergency access are controlled and monitored. It also addresses how evidence from disparate systems such as HR platforms, identity providers, and privileged access management (PAM) tools must align to demonstrate compliance and operational integrity.

For organizations building AI-driven or cloud-native architectures, ...