IAM Policy

What is an IAM policy?

An IAM policy is a governance document that states who may receive which access to company systems, who approves it, how often it is reviewed and when it is removed. It turns principles such as least privilege and separation of duties into rules that IT, managers and auditors can check. In cloud platforms, the term also names a technical permission object.

Key takeaways

• An IAM policy defines who may get which access, who approves each request, how often access is reviewed and when it is removed.
• An IAM policy usually documents the rules that ISO/IEC 27001:2022 Annex A control 5.15 requires to control physical and logical access.
• An IAM policy covers the access control policies that Article 21(2)(i) of the NIS2 Directive lists among required cybersecurity risk-management measures.
• An IAM policy that is never enforced in the identity provider and the SaaS applications only documents intentions, and auditors test what the tools show.

How an IAM policy works

• Scope: the policy lists the systems, identity types (employees, contractors, service accounts) and data classes it covers.
• Default access: roles or job profiles define what each person gets on day one, following least privilege; anything beyond that needs a request.
• Approval: each request has a named approver, usually the manager, plus the application owner for sensitive or costly tools.
• Review: existing access is recertified on a fixed schedule, for example quarterly for admin rights and yearly for standard rights.
• Removal: the policy sets a deadline for revoking access after a departure or a role change, and names who carries it out.

IAM policy document or cloud IAM policy: which one is meant?

• Organizational IAM policy: a document for people, approved by management, that sets the rules for granting, approving, reviewing and removing access across the company.
• Cloud IAM policy: a technical object evaluated by a platform. In AWS, an IAM policy is a JSON document attached to a user, group or role, whose statements combine an Effect (Allow or Deny), Actions, Resources and optional Conditions. An explicit Deny overrides any Allow, and whatever is not allowed is denied by default.

The two meet in enforcement. Article 21 of the NIS2 Directive lists access control policies among the required cybersecurity risk-management measures, yet a written policy protects nothing until its rules exist as roles, groups, approval steps and deprovisioning tasks in the tools. Gaps appear where the document says "removal on the last working day" and nobody owns that task in the applications outside single sign-on.

Examples and use cases

A 180-person fintech writes an IAM policy to prepare its ISO/IEC 27001:2022 certification: role-based default access, manager approval for every extra tool, quarterly reviews of admin rights and removal of all access on the last working day. Six months later, the identity provider follows the policy, but 25 SaaS tools bought by individual teams do not. Admin rights were granted by whoever set up each tool, nobody reviewed them, and two former employees still have active accounts.

Corma closes the gap between the written policy and the tools. It builds an inventory of the SaaS applications in use, routes access requests through approval workflows, runs automated access reviews with audit evidence and automates deprovisioning, including in applications without SCIM.

Related concepts

• Identity and access management (IAM)
• Principle of least privilege
• Role-based access control (RBAC)
• Access review
• Separation of duties (SoD)
• Corma identity governance and administration platform

FAQ

What should an IAM policy include?

Scope, default access by role, the approval path for extra access, the review schedule and removal deadlines for leavers and movers. It also covers privileged accounts, service accounts and exceptions.

Who owns the IAM policy?

Usually the CISO or the IT security lead writes it and management approves it. Managers and application owners apply it every day by approving requests and reviewing access.

Is an IAM policy required for ISO 27001?

In practice, yes. Annex A control 5.15 of ISO/IEC 27001:2022 requires rules to control physical and logical access to be established and implemented, and those rules are normally written as an access control or IAM policy.

What is the difference between an IAM policy and an AWS IAM policy?

An organizational IAM policy is a document that tells people how access is granted and removed. An AWS IAM policy is a JSON permission object evaluated at each request, where an explicit Deny always wins.

Request a demo