Introduction

Data processing systems commonly gather a range of information on their users, be it a person, piece of equipment, or piece of software connected to it and make decisions based on the gathered information. Such identity-based decisions may concern access to applications or other resources.

To address the need to efficiently and effectively implement systems that make identity-based decisions, ISO/IEC 24760 specifies a framework for the issuance, administration, and use of data that serves to characterize individuals, organizations or information technology components, which operate on behalf of individuals or organizations.

For many organizations, the proper management of identity information is crucial to maintain security of the organizational processes. For individuals, correct identity management is important to protect privacy.

This part of ISO/IEC 24760 specifies fundamental concepts and operational structures of identity management with the purpose to realize information system management, so that information systems can meet business, contractual, regulatory and legal obligations.

This part of ISO/IEC 24760 presents practices for identity management. These practices cover assurance in controlling identity information use, controlling the access to identity information and other resources based on identity information, and controlling objectives that should be implemented when establishing and maintaining an identity management system.

This part of ISO/IEC 24760 consists of the following parts:

— ISO/IEC 24760‑1: Terminology and concepts;
— ISO/IEC 24760‑2 : Reference architecture and requirements;
— ISO/IEC 24760‑3 : Practice.

ISO/IEC 24760 is intended to provide foundations for other identity management related International Standards including the following:

— ISO/IEC 29100 , Privacy framework;
— ISO/IEC 29101 , Privacy reference architecture;
— ISO/IEC 29115 , Entity authentication assurance framework;
— ISO/IEC 29146 , A framework for access management.

BS EN ISO/IEC 24760-3:2022

Information technology. Security techniques. A framework for identity management - Practice

Current, Under Review

Published:

30 Nov 2022