A business could let in a malicious outsider disguised as an employee, leaking sensitive customer data to competitors. Access control and identity management is the set of security processes that determine who is allowed into a system, what they can do once inside, and what actions get recorded for review. For a CISA candidate, mastering this topic means understanding how to audit these systems to prevent the most common data breaches.
Jump to a section
A simple way to picture Access Control and Identity Management
A nightclub bouncer named Priya. She stands at the door of a popular club on a busy Saturday night. Her job is not just to let people in. She has a list called the 'guest list' (the identity database). First, she checks your ID to confirm you are who you say you are (authentication). She looks at the photo, feels the card for fakes, and checks the expiry date. Once she is certain you are you, she looks at the guest list to see if you are allowed in (authorisation). The list says some people are VIPs who get access to the rooftop bar, some are general guests for the main floor, and some are a banned because of past behaviour (access control rules). She also keeps a log of who entered and at what time (audit log). If you try to sneak in through the fire exit, that is a breach. If your friend hands you their ID to try to get in, that failed because Priya matches the face to the photo. Every part of Priya's job maps exactly to an IT access control system: verify identity (authentication), check permissions (authorisation), enforce boundaries (access control), and record events (auditing). Without Priya, anyone could walk in and cause chaos.
Priya is not just a gatekeeper. She also handles the 'guest list' changes throughout the night. When a VIP arrives late, she checks a separate list sent from the manager. When a guest causes trouble and gets banned, she updates her mental list. She never just trusts a name being spoken. She demands proof. This is the same as how an IT system handles identity management: it constantly updates who has access to what, and it always verifies before granting entry.
Access Control and Identity Management is the core of IT security. It answers three simple but critical questions: 'Who are you?', 'What are you allowed to do?', and 'Did you actually do it?'. Let us break down each piece.
Identity Management is the process of creating, storing, and managing digital identities. A digital identity is a unique representation of a person, device, or program. For you, that is your username and password, but it can also include biometrics like a fingerprint or a security token. The system that stores these identities is often called an Identity Provider (IdP). Think of it as the master list of every employee, contractor, customer, and even machine identity.
Authentication is the step that answers 'Who are you?'. It is the process of proving you are the owner of that digital identity. The industry uses three categories of proof, called factors: something you know (a password or PIN), something you have (a phone, a smart card, or a hardware token), and something you are (your fingerprint, face, or voice). Multi-factor authentication (MFA) combines at least two different factors, making it much harder for an attacker to pretend to be you even if they steal your password.
Authorisation is the step that answers 'What are you allowed to do?'. Once the system knows you are you, it checks a set of rules to decide your permissions. The simplest model is Access Control Lists (ACLs), which are like a spreadsheet listing who can read, write, or delete each file or system. A more modern approach is Role-Based Access Control (RBAC), where permissions are assigned to roles (like 'Manager' or 'Auditor'), and people are assigned to roles. This is much easier to manage than individual permissions for thousands of users.
Access Control also covers the physical world. Data centres have locks, badge readers, and guards (physical access controls). The CISA exam expects you to understand that both logical (digital) and physical controls must be evaluated together. If a server room is unlocked, anyone can walk in and plug in a USB device (a physical attack) bypassing all digital controls.
Auditing and logging is the final piece. Every time a user authenticates, accesses a file, or attempts an action, the system should record it in an audit log. These logs are reviewed by auditors to spot suspicious activity like multiple failed logins (a brute force attack) or a user accessing files they never normally touch. The principle of least privilege says every user should have only the minimum access needed to do their job. The principle of segregation of duties says that no single person should have control over two conflicting tasks, like ordering goods and approving payment.
Before these systems existed, security relied on physical guards in server rooms and paper sign-out sheets for sensitive files. This did not scale and was easily fooled. Modern Identity and Access Management (IAM) systems automate all of this, allowing organisations to control access for tens of thousands of users across hundreds of applications from a centralised dashboard.
IAM systems also handle the lifecycle of a digital identity: when an employee joins, their account is created with basic permissions (onboarding). When they change roles, their permissions are updated. When they leave, their account is disabled or deleted (offboarding). Poor offboarding is a common security gap discovered during CISA audits.
The key takeaway for CISA is not to memorise every product name. It is to understand the control objectives: ensure only authorised people access systems, ensure they can only do what is necessary, and ensure their actions are trackable. An auditor tests that these controls exist, work as intended, and are documented.
Identify the user
A user (or device) presents a claim of identity, usually a username or email. This is the starting point for all access control. The system must have an identity provider (IdP) that stores the user's unique digital identity.
Authenticate the user
The system challenges the user to prove they own the claimed identity. This is done using one or more authentication factors (password, phone, fingerprint). Successful authentication produces a token or session that proves the user is who they say they are.
Authorise the user
After authentication, the system checks the user's permissions. It looks up rules (like Role-Based Access Control or Access Control Lists) to determine what resources and actions the user is allowed to access. This step prevents a legitimate user from accessing data they should not see.
Grant or deny access
Based on the authorisation decision, the system either grants the user's request (e.g., open a file) or denies it. Denial should trigger an audit log entry. This step is the enforcement point, where the access control policy is actually applied.
Log the activity
The system records the event: who accessed what, when, from where, and whether the access was successful or denied. These logs are the audit trail. They are vital for detecting suspicious patterns (like repeated failed logins) and for proving compliance with regulations.
Review and revoke
Periodically, an administrator or automated system reviews the logs and the current permissions. Users whose jobs have changed or who have left the organisation must have their accounts disabled or permissions adjusted. This 'access recertification' step is critical for maintaining least privilege over time.
An IT professional, often a security analyst or IAM administrator, faces a typical day. A new employee named Maria joins a company of 2000 people. Maria needs access to the email system, the HR database to run payroll reports, and the shared drive for her department.
Step 1: Request. Maria's manager submits an access request form through the company's IAM portal. The form specifies Maria's job title and department. The system automatically checks if her manager is authorised to make such a request.
Step 2: Approval. The IAM system sends an approval request to the HR system owner (because the HR database is sensitive). That owner reviews the request and approves it. No one bypasses this step because the system enforces a policy: no access without manager and data owner approval.
Step 3: Provisioning. The IAM system automatically creates Maria's user account in Microsoft Entra ID (the directory). Based on her role, it assigns her to the 'HR_User' role, which grants read and write access to the employee database (but not to delete records) and read access to the shared HR folder. The system also automatically emails Maria her temporary password and instructions to set up MFA.
Step 4: Authentication. Maria logs in with her new password. The IAM system prompts her to download the Microsoft Authenticator app on her phone and register it. Now, every time she logs in, she must enter her password and approve a notification on her phone (MFA). The system checks that her device is company-managed (device compliance).
Step 5: Monitoring. The security team reviews logs. They notice that an hour after Maria's account was created, someone tried to log in 50 times from an IP address in a different country. The IAM system automatically blocked the IP after 5 failed attempts and flagged it for review. This is an example of an 'account lockout' policy in action.
Step 6: Audit. Six months later, an internal auditor runs a report to find all users with access to the HR database who are no longer working there. The IAM system shows that five former employees still have active accounts. The auditor flags this, and the security team disables them immediately. This is how the principle of least privilege is tested in real audits.
A senior IT professional will also configure 'access reviews' (sometimes called 'certification campaigns'), where managers are sent a list of all their team members' access rights every quarter and must confirm each one is still needed. This is a standard control required by regulations like SOX or GDPR.
Common IT actions include:
Resetting passwords and unlocking accounts when users get locked out.
Adding or removing users from Active Directory groups (which assign permissions).
Configuring 'conditional access' policies (e.g., 'Deny access from all countries except the head office country').
Reviewing privileged access (admin accounts) which are the most dangerous if compromised.
Investigating 'suspicious sign-in' alerts from the IAM system.
An IT professional does not just set up access. They continuously check that the controls work, that no one has excessive rights, and that the system can prove who did what, when.
The CISA exam tests 'Access Control and Identity Management' heavily. Expect around 15-20% of questions to touch this area. The exam does not ask you to configure a specific product like Microsoft Entra ID. Instead, it tests your ability to evaluate whether an organisation's controls are adequate.
Concepts the exam loves to test:
The three factors of authentication (knowledge, possession, inherence). You must know them by heart and recognise examples of each.
The principle of least privilege: users should have only the access necessary for their job. A typical trap is a scenario where an employee has more rights than needed. The correct answer is always to reduce their access.
Segregation of duties (SoD): a single person should not both request and approve their own access. An auditor would flag this as a weakness. The exam will give you a case where the purchasing manager also approves payments. That is a violation.
Biometric controls: know that they are based on 'something you are'. A common exam trap suggests biometrics are foolproof, but they can be spoofed (e.g., a high-quality fingerprint replica).
Biometric error rates: False Acceptance Rate (FAR) is when the system incorrectly accepts an unauthorised person. False Rejection Rate (FRR) is when it rejects an authorised person. The exam expects you to know which one is more serious in a high-security environment (FAR).
Single Sign-On (SSO) vs. Federated Identity: SSO lets you log in once to access multiple systems within the same organisation. Federated Identity lets you use one identity across different organisations (e.g., logging into a partner's website with your work email). The exam often presents a scenario where a company needs to grant access to external partners, and the correct answer is federated identity management.
Password policies: minimum length, complexity, expiry, and history. The exam will test that a 30-day password change policy is a compensating control but not as effective as MFA.
Common traps set by the exam:
Confusing authentication with authorisation. A question might say 'the system verified the user's identity' and then ask what the next step is. The correct answer is always 'authorisation'.
Assuming MFA is only for external users. The correct answer is that MFA should be mandatory for all users, especially administrators.
Thinking that a fire extinguisher in a server room is an access control. It is not. Access controls are about preventing and detecting unauthorised access, not environmental safety.
Suggesting that sharing passwords is acceptable among team members. It is never acceptable. Each person must have a unique identity for accountability.
Exam questions will often present a scenario with a specific control failure (e.g., a terminated employee still having access). The correct answer is to identify that the offboarding process is weak. Another pattern is a question about the best control to prevent a brute force attack: the answer is account lockout policy or MFA, not a stronger password alone.
Key definitions to memorise for the exam:
Access Control: The process of limiting access to the resources of a system to authorised users, programs, or processes.
Identity Management: The process of managing the lifecycle of digital identities.
Authentication: The process of verifying the identity of a user, device, or system.
Authorisation: The process of granting rights to an authenticated user.
Audit Trail: A chronological record of system activities that enables the reconstruction and examination of events.
Biometrics: Automated methods of verifying the identity of a person based on physiological or behavioural characteristics.
Smart Card: A device that contains an embedded integrated circuit chip that can store data and is used for authentication.
Token: A hardware or software device that generates a one-time password (OTP) for authentication.
Authentication verifies identity; authorisation determines what that identity can do.
Multi-factor authentication (MFA) combines two or more factors: something you know, something you have, and something you are.
The principle of least privilege states that users should have only the minimum access needed to perform their job functions.
Segregation of duties prevents a single person from having conflicting responsibilities, reducing the risk of fraud and error.
Biometric systems have measurable error rates: False Acceptance Rate (FAR) and False Rejection Rate (FRR).
An audit trail records user activities and is essential for detecting and investigating security incidents.
Identity lifecycle management includes onboarding (creating accounts), role changes (updating permissions), and offboarding (disabling accounts).
Federated identity management allows users from one organisation to access resources in another organisation using their existing login credentials.
These come up on the exam all the time. Here's how to tell them apart.
Authentication
Proves who you are (identity verification)
Happens first in the access process
Examples: password, fingerprint, smart card
Authorisation
Determines what you can do (permissions)
Happens after authentication
Examples: can read file, can delete record, cannot access payroll
Role-Based Access Control (RBAC)
Permissions assigned to a role (e.g., 'Sales Team')
Users inherit permissions by being added to the role
Easier to manage for many users and many resources
Access Control Lists (ACLs)
Permissions assigned directly to each resource (e.g., 'File X: User A = read')
Each resource has its own list of users and permissions
Becomes hard to manage with many users and resources
Single Sign-On (SSO)
One login for multiple systems within a single organisation
The same identity provider (IdP) is used for all internal apps
Example: logging into email, CRM, and HR from one portal
Federated Identity Management
One login used across different organisations
Involves trust agreements between separate IdPs
Example: logging into a partner's website using your work email
False Acceptance Rate (FAR)
System incorrectly accepts an unauthorised user
More serious security risk
Example: a fingerprint scanner letting an impostor in
False Rejection Rate (FRR)
System incorrectly rejects an authorised user
Causes user frustration and lost productivity
Example: a fingerprint scanner not recognising a legitimate user
Mistake
Passwords alone are sufficient security for most systems.
Correct
Passwords are no longer considered sufficient because they can be stolen in data breaches, guessed, or phished. Multi-factor authentication (MFA) is now the minimum standard for any moderately sensitive system.
People rely on passwords because they are simple and familiar. Many users have never experienced an account takeover themselves, so they underestimate the risk.
Mistake
Access control is only about technology, not about people or processes.
Correct
Access control is a combination of technology, policies, and human behaviour. A strong password policy means nothing if employees write passwords on sticky notes, or if the process for removing a leaver's access is not followed.
IT professionals and beginners alike often focus on the technical solution (e.g., 'install this software') rather than the human and procedural layers that the CISA exam emphasises.
Mistake
Once a user logs in, they can access anything on the network.
Correct
After authentication, the system performs authorisation to determine what specific resources the user is allowed to access. Most networks use the principle of least privilege, so a salesperson cannot access HR payroll data.
Many beginners think of a network as a single door: once you are inside, you are inside everything. In reality, networks have many internal doors (permissions) that limit movement.
Mistake
Biometric authentication is completely secure and cannot be bypassed.
Correct
Biometrics are very strong but not perfect. They can be spoofed with high-quality replicas of fingerprints or photos of faces. They also have issues with false rejections (denying a legitimate user) and cannot be reset like a password if stolen.
Movies often show biometrics as unbreakable. In reality, researchers have bypassed many consumer-grade fingerprint and facial recognition systems. The CISA exam tests awareness of these limitations.
Mistake
The 'identity' in identity management refers only to human users.
Correct
Identity management also covers non-human entities like service accounts (used by applications), IoT devices, robots, and software bots. These 'machine identities' must be managed, authenticated, and audited just like human users.
Beginners naturally think of people when they hear 'identity'. But modern IT environments have more machine identities than human ones, and they are a common attack vector.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Authentication is about proving who you are (e.g., logging in with a password). Authorisation is about what you are allowed to do after you are logged in (e.g., can you read a file or delete it?). Authentication always comes first.
MFA requires two or more different types of proof to log in, such as a password and a code from your phone. It makes it much harder for hackers to take over your account even if they steal your password.
Least privilege means giving a user only the exact access they need to do their job, and nothing more. This limits the damage if their account is compromised and reduces the risk of accidental changes.
RBAC is a model where permissions are assigned to roles (like 'Manager', 'Employee', 'Auditor'), and users are assigned to roles. This is easier to manage than assigning permissions to each user individually.
The offboarding process should immediately disable the user's account, revoke all active sessions, and remove them from all groups and roles. A proper audit trail of this action must be maintained.
SSO allows a user to log in once and then access multiple applications or systems without being asked for credentials again. It improves user convenience and centralises authentication management.
An IdP is a system that stores digital identities and provides authentication services. When you log into a website using 'Sign in with Google', Google is acting as the IdP.
You've finished Access Control and Identity Management. Continue through the CISA study guide to build a complete picture of the exam.
Done with this chapter?