Chapter 3 of 5 · ISC2 CC
Identity and Access Management (IAM) Concepts
Identity lifecycle management from role definition to deprovisioning, and logical access controls such as least privilege and SoD.
- 2topics
- 6 minfast track
- 20%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Identity Lifecycle ManagementDefining roles, provisioning, reviewing and deprovisioning access, account types, identity proofing and managing AI agents and…3 min
- 2Logical Access ControlsLeast privilege, separation of duties, just-in-time access, and the DAC, MAC, RBAC, rule-based and ABAC access control models…3 min
About this chapter
What this chapter covers
Identity and Access Management (IAM) Concepts is worth 20 percent of the CC exam. It covers how people and systems get the right access, keep only what they need, and lose it when they no longer need it.
It covers identity lifecycle management (defining roles, provisioning, reviewing and deprovisioning access, and the frameworks and tools that support it) and logical access controls (least privilege, separation of duties and access control models). The 2026 outline applies the same ideas to AI bots, agents and service accounts, which need identities, owners and limited access just like people.
How the topics fit together
CC questions describe a joiner, mover or leaver, or an account with too much access, and ask what should happen. The answer usually applies least privilege, keeps accountability with a named owner, and removes access that is no longer needed.
Treat AI agents and service accounts like employees: each needs its own identity, an accountable owner, only the access its job requires, and removal when it is retired.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISC2 CC question bank has 671 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.