Identity and Access Management Standards Reference

Identity and Access Management (IAM) encompasses the policies, technologies, and regulatory frameworks that govern how digital identities are created, verified, and controlled within organizational systems. This reference covers the IAM standards landscape in the United States, including the federal frameworks, compliance obligations, and professional classification boundaries that structure the sector. IAM failures represent one of the most consistently exploited attack surfaces in enterprise and government environments, making standards alignment a measurable security outcome rather than a procedural checkbox.

Definition and scope

IAM refers to the disciplined management of user identities and the access rights those identities carry across systems, applications, and data environments. The functional scope spans four core domains: identity lifecycle management (provisioning, modification, deprovisioning), authentication strength enforcement, authorization and privilege control, and audit/logging for accountability.

The federal reference architecture for IAM is anchored in NIST Special Publication 800-63, Digital Identity Guidelines, which defines the Identity Assurance Level (IAL), Authenticator Assurance Level (AAL), and Federation Assurance Level (FAL) framework. These three tiers—each numbered 1 through 3—determine how rigorously an identity must be proofed and how strongly authentication must be performed based on the sensitivity of the resource being accessed.

For federal agencies, IAM implementation is further shaped by OMB Memorandum M-22-09, which establishes zero trust architecture requirements including the mandate that agencies achieve phishing-resistant multi-factor authentication (MFA) across enterprise systems. Organizations operating in healthcare must additionally align with HIPAA's access control provisions under 45 CFR §164.312(a), which require covered entities to implement technical policies restricting system access to authorized personnel.

The Cybersecurity Providers available through this network include IAM service providers operating across these regulatory contexts.

How it works

IAM frameworks operate through a structured sequence of controls applied at each stage of a user's relationship with a system.

1. Identity proofing — Establishing that a claimed identity corresponds to a real person or entity. NIST SP 800-63A defines three IAL tiers; IAL2 requires either in-person or remote identity proofing with document verification.
2. Credential issuance — Binding authenticators (passwords, hardware tokens, smart cards, biometrics) to a verified identity. NIST SP 800-63B governs authenticator types and their assurance levels.
3. Authentication — Verifying credentials at the point of access. AAL3, the highest tier, requires hardware-based authenticators and verifier impersonation resistance.
4. Authorization — Determining what an authenticated identity is permitted to do. Dominant models include Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), and the increasingly deployed Policy-Based Access Control (PBAC).
5. Privilege management — Controlling elevated or administrative rights through Privileged Access Management (PAM) systems, governed in federal contexts by NIST SP 800-53 control family AC (Access Control) and AU (Audit and Accountability).
6. Lifecycle termination — Revoking credentials and access upon role change, contract end, or termination. Unrevoked orphaned accounts represent a documented failure mode in federal audit findings.

The distinction between RBAC and ABAC is operationally significant. RBAC assigns access based on job role classifications and is simpler to administer at scale; ABAC evaluates multiple attributes—user department, device posture, time of access, data classification—and is required for environments with fine-grained data sensitivity distinctions. Federal zero trust guidance, particularly under OMB M-22-09, favors ABAC-compatible architectures.

Common scenarios

IAM standards apply across a defined set of recurring operational contexts:

Federal agency system access — Agencies subject to FISMA must implement IAM controls aligned with NIST SP 800-53 Rev. 5, with annual assessments conducted through the NIST Risk Management Framework (RMF). The AC control family contains 25 distinct controls governing account management, least privilege, and remote access.

Healthcare workforce access — Covered entities under HIPAA must assign unique user identification to every workforce member accessing electronic protected health information (ePHI). Shared credentials are a direct HIPAA violation under 45 CFR §164.312(a)(2)(i). The HHS Office for Civil Rights enforces these requirements.

Financial services — The FFIEC IT Examination Handbook and NIST Cybersecurity Framework both shape IAM expectations for banks and credit unions. The FFIEC's Authentication and Access to Financial Institution Services and Systems guidance (updated 2021) explicitly classifies single-factor authentication as insufficient for high-risk transactions.

FedRAMP cloud authorization — Cloud service providers seeking federal contracts must satisfy the FedRAMP IAM requirements mapped to NIST SP 800-53, including continuous monitoring of access controls. FedRAMP authorization requires third-party assessment by an accredited 3PAO.

The page describes how this network categorizes service providers operating in these regulatory environments.

Decision boundaries

Selecting the appropriate IAM framework tier or model depends on three primary classification factors:

Data sensitivity vs. operational friction — IAL3 and AAL3 impose hardware token requirements that create deployment cost and user friction. Agencies apply these levels selectively to high-value assets rather than uniformly across all systems, as NIST SP 800-63-3 explicitly permits risk-based tier selection.

Federated vs. enterprise identity — Federated identity (using SAML 2.0, OpenID Connect, or OAuth 2.0 protocols) distributes authentication across trust domains, appropriate for inter-agency or cloud-hybrid environments. Enterprise IAM manages identities within a single organizational boundary. NIST SP 800-63C governs federation assurance at FAL1 through FAL3.

Human vs. non-human identities — Machine identities—service accounts, APIs, and automated processes—require separate lifecycle controls. NIST SP 800-63 applies to human identity proofing; machine identity governance is addressed under NIST SP 800-53 IA (Identification and Authentication) controls, particularly IA-3 (Device Identification) and IA-9 (Service Identification and Authentication).

Organizations researching IAM service providers can apply these classification boundaries when reviewing the How to Use This Cyber Safety Resource reference to identify appropriate provider categories.