Glossary term
IAM (Identity and Access Management)
Also: Identity Management, IGA, PAM
The stack of systems that governs who has access to which systems under which conditions. IAM covers authentication, single sign-on, lifecycle management, access governance (IGA) and privileged access management (PAM), and is the most commonly breached control in enterprise environments.
IAM is a stack decision, not a product decision. A mature enterprise IAM typically spans workforce identity, customer identity, identity governance (IGA), privileged access (PAM) and secrets management. Each layer has different vendors, different buying cycles and different operating models.
The core strategic choice is usually between an integrated suite (Microsoft Entra ID, Okta Workforce Identity) and a best-of-breed architecture (separate IGA, PAM and IAM vendors). Integrated suites are faster to deploy and easier to govern; best-of-breed gives deeper functionality in the layers that matter most.
In practice
IAM decisions interact strongly with compliance. NIS2 Art. 21 names access control as a mandatory measure. DORA Art. 9 requires documented identity governance. BSI IT-Grundschutz has dedicated modules. The IAM memo should map to these explicitly rather than claim general compliance.
Related terms
Zero Trust
A security model built on the principle that no user, device or network location is trusted by default. Access is continuously verified against identity, device posture, context and policy, regardless of whether the request comes from inside or outside the corporate network.
Compliance mapping
The explicit link between a decision (vendor, architecture, control) and the specific regulatory articles, controls or standards it satisfies. Without compliance mapping, a memo cannot be defended under audit against a named clause.
Sovereign cloud
A cloud deployment model that guarantees operational, legal and technical control of data and workloads within a specific jurisdiction (typically the EU). Sovereign cloud answers the concern that hyperscaler deployments remain exposed to foreign jurisdiction, primarily the US CLOUD Act.
ICT Concentration Risk
Risk arising from dependence on a small number of or a single ICT third-party provider. DORA Art. 29 obliges financial entities to perform an explicit analysis and steering. Supervisors focus particularly on cloud hyperscalers and core banking system providers.
IGA
Software category for identity governance: lifecycle management, role modelling, access recertification, segregation of duties, audit trail. Pulls the governance layer out of IAM.
ISO 27001
International standard for information security management systems. Current version ISO/IEC 27001:2022. Certifiable through accredited bodies. Core framework for ISMS implementation, risk treatment, continuous improvement.
ISO 27002
Companion standard to ISO 27001 that fleshes out the 93 Annex A controls. Not certifiable, but the practical handbook for implementation.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).