The Cyber Academy take
IAM is the discipline that manages who can access what, when, how and under which conditions. Provisioning, authentication, authorisation, deprovisioning. Identity is the new perimeter. Every Zero Trust architecture is, at the core, a hard IAM problem disguised as a network one.
What IAM actually covers
Identity and Access Management is the operational discipline that decides who can access what, when, how and under which conditions. In practice it is built from a small set of repeatable functions: provisioning an identity when a person or service arrives, authenticating that identity at the moment of access, authorising the specific actions and resources allowed, and deprovisioning the identity when the role or relationship ends. The hard part is rarely a single login screen. It is keeping the link between a real-world person, their digital identities and their accumulated entitlements honest over time, across dozens of systems that each have their own idea of what an account is.
A useful mental model is the identity lifecycle. Joiners get accounts and baseline access. Movers change teams and should lose old entitlements as they gain new ones. Leavers must be cut off cleanly. Most access incidents trace back to a failure in this lifecycle: orphaned accounts that were never disabled, or privilege that piled up because access was granted but never reviewed. IAM is the system that makes joiner-mover-leaver reliable rather than a manual scramble.
Identity as the perimeter
IAM matters more now because the network boundary stopped being a meaningful control. Users connect from anywhere, workloads run across cloud providers, and machine identities (service accounts, API keys, workload tokens) often outnumber human ones. When there is no inside and outside to defend, identity becomes the line that decides access. This is the core insight behind Zero Trust: never trust by default, verify every request against identity, device posture and context. A Zero Trust architecture is, at its heart, a demanding IAM problem dressed up as a network one.
IAM is also where several adjacent controls plug in. Multi-factor authentication strengthens the authentication step. Privileged access management protects the small number of identities that can cause the most damage. The principle of least privilege is the policy IAM enforces: grant only the access a role genuinely needs, and no more. Treat these as layers of the same problem rather than separate projects.
Governance and standards context
IAM sits at the centre of most security frameworks because access control is foundational. ISO/IEC 27001 treats access control and identity management as core control areas of an information security management system, expecting organisations to define an access control policy, manage user access through the full lifecycle, and review access rights. The NIST Cybersecurity Framework places identity management and access control among the protective functions every program should cover. For regulated data, access discipline also supports privacy obligations under the GDPR, since limiting who can reach personal data is part of demonstrating appropriate technical measures.
What practitioners actually do reflects this. They build authoritative identity sources, automate provisioning and deprovisioning, centralise authentication through single sign-on, model entitlements as roles where possible, run recurring access reviews, and keep an audit trail of who was granted what and why. Done well, IAM is invisible to users and provable to auditors. Done badly, it is the quiet root cause behind a large share of breaches.
Frequently asked questions
01What is the difference between authentication and authorisation in IAM?
Authentication proves who an identity is, for example through a password plus a second factor. Authorisation decides what that proven identity is allowed to do once verified. IAM has to get both right: a strong login means nothing if the account then has access it should never have had.
02How does IAM relate to Zero Trust?
Zero Trust removes implicit trust based on network location and verifies every request instead. Because that verification leans on identity, device and context, a Zero Trust rollout is largely an IAM programme. Strong authentication, least privilege and continuous access decisions are the building blocks.
03What is the identity lifecycle?
It is the joiner, mover and leaver flow: provisioning access when someone arrives, adjusting it when their role changes, and removing it when they leave. Most access problems, such as orphaned accounts and privilege creep, come from gaps in this lifecycle.
04How is IAM different from PAM?
IAM governs access for the whole population of identities across their lifecycle. Privileged access management focuses on the small set of high-risk accounts, like administrators and service accounts, adding stronger controls such as vaulting, session monitoring and just-in-time elevation. PAM is a specialised layer inside the broader IAM discipline.
05Why are access reviews important?
Access tends to accumulate because granting is easy and revoking is forgotten. Periodic access certification asks owners to confirm who should still have what, catching privilege creep and orphaned entitlements. It is also a control that auditors expect to see evidenced under frameworks like ISO/IEC 27001.