CISSP Domain 5: Identity and Access Management (IAM) explained

Domain 5 at a glance

The subdomains in plain words

1. 5.1 Physical and logical access: what access control protects, subjects and objects, and central versus local administration.
2. 5.2 Identification and authentication: identity proofing, authentication factors, passwords, tokens, biometrics, passwordless methods and single sign-on.
3. 5.3 Federated identity: trusting identities across organisations with SAML, OAuth and OpenID Connect.
4. 5.4 Authorisation models: discretionary, mandatory, role-based, rule-based and attribute-based control, and how policy is enforced.
5. 5.5 The identity and access lifecycle: provisioning, reviews, role changes, privilege escalation, service accounts and deprovisioning.
6. 5.6 Authentication systems: Kerberos, directories, RADIUS and TACACS+, and zero-trust enforcement.

What the exam tends to test

• The order of steps. Identification, then authentication, then authorisation, then accounting.
• Least privilege and need to know over convenience, nearly every time.
• The owner approves access. IT grants it; the data or system owner decides.
• Lifecycle discipline. Access is reviewed regularly and removed promptly when people leave or change roles.
• Matching the model to the setting. Role-based control suits large organisations with frequent staff movement; mandatory control suits labelled, classified environments.

How deep to go

Know the protocols well enough to say what each one proves and who trusts whom, not their message formats. Biometrics are tested through error types and suitability rather than hardware detail. The deeper skill is reading a scenario and spotting the missing lifecycle step: a review that never happened, an account never disabled, an approval that came from IT instead of the owner.

Common traps

• Two passwords as multi-factor. Two things you know are still one factor type.
• OAuth as authentication. OAuth grants authorisation; OpenID Connect adds authentication on top.
• Deleting an account at termination. Disable it first, so the audit trail and data survive; for a hostile departure, disable before or as the person is told.
• Ignoring privilege creep after transfers. Moving roles without removing old rights is a classic scenario.
• Mixing up biometric errors. A false rejection (Type I) annoys users; a false acceptance (Type II) lets the wrong person in.

How to study it

1. Walk one employee through the whole lifecycle at a company you know: offer letter, first-day accounts, a transfer from Chennai to the Gurugram office, a promotion, an exit. Mark the control at each step.
2. Make a one-line comparison of SAML, OAuth and OpenID Connect: what each does, what format it uses, who trusts whom.
3. Draw the Kerberos ticket exchange once from memory; questions about its weak points become easy.
4. Connect this domain to Domain 1 (personnel security) and Domain 7 (privileged account management).
5. From 15 April 2027 the outline names passwordless authentication (FIDO, WebAuthn and passkeys) and just-in-time access under 5.2; see what changes in 2027.

Worked example: thinking it through

Our own illustration, not an exam item.

The situation. An internal audit finds that an analyst who moved from finance to marketing six months ago can still approve vendor payments. Several similar cases turn up. As the security manager, what is the best long-term fix?

• Remove the analyst's finance access today.
• Discipline the managers who approved the transfers.
• Define role-based access for each job, remove old rights at every transfer, and run regular access reviews signed off by the owners.
• Turn on more detailed logging of payment approvals.

The reasoning. Removing one person's access fixes one case, but the audit found a pattern, so the cause is the process. Blame does not repair a process. Logging helps you detect misuse after the fact, but it does not stop excess access existing. Role-based access, a transfer step that strips old rights, and periodic reviews by the people who own the systems address privilege creep at its root. In this domain, the best answer usually fixes the lifecycle rather than the single account.

Next steps

Compare weights on the domains overview, then practise lifecycle and federation scenarios in our own practice questions.