Chapter 5 of 8 · ISC2 CISSP
Identity and Access Management (IAM)
Physical and logical access, identification and authentication, federation, authorization models and the identity lifecycle.
- 4topics
- 12 minfast track
- 1diagrams and exhibits
- 13%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Access Control and Authentication StrategyPhysical and logical access control, AAA, authentication factors, MFA, passwordless, biometric error rates, session management…3 min
- 2Federation and Authentication SystemsFederated identity with SAML, OAuth 2.0 and OpenID Connect, cloud and hybrid identity, and authentication systems such as…Diagram3 min
- 3Authorization MechanismsAuthorization models for CISSP: discretionary, mandatory, role-based, rule-based, attribute-based and risk-based access control…3 min
- 4Identity and Access Provisioning LifecycleProvisioning and deprovisioning accounts, role changes, access reviews, privilege escalation controls, service accounts and…3 min
About this chapter
What this chapter covers
Identity and Access Management is worth 13 percent of the CISSP exam. It covers how people, devices and services are identified, how they prove who they are, what they are allowed to do, and how access is granted, reviewed and removed over time.
It covers controlling physical and logical access to information, systems, devices, facilities, applications and services, designing identification and authentication strategy (groups and roles, AAA, MFA, passwordless, session management, registration and proofing, federated identity, credential management, single sign-on, just-in-time access), federated identity with third-party services, authorization mechanisms (role, rule, mandatory, discretionary, attribute and risk based, access policy enforcement), the identity and access provisioning lifecycle (provisioning, deprovisioning, role changes, account access reviews, privilege escalation, service accounts) and implementing authentication systems.
How the topics fit together
Questions often ask which authorization model fits a scenario, which protocol handles authentication versus authorization, and which lifecycle control stops privilege creep.
Keep the steps apart. Identification is claiming an identity, authentication is proving it, authorization is deciding what it may do, and accountability ties actions back to it.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.