EN ISO/IEC 29146:2023

Information technology - Security techniques - A framework for access management (ISO/IEC 29146:2016, including Amd 1:2022)

ISO/IEC 29146:2016 defines and establishes a framework for access management (AM) and the secure management of the process to access information and Information and Communications Technologies (ICT) resources, associated with the accountability of a subject within some context.
This International Standard provides concepts, terms and definitions applicable to distributed access management techniques in network environments.
This International Standard also provides explanations about related architecture, components and management functions.
The subjects involved in access management might be uniquely recognized to access information systems, as defined in ISO/IEC 24760.
The nature and qualities of physical access control involved in access management systems are outside the scope of this International Standard.

Informationstechnologie - Sicherheitstechniken - Ein Rahmenwerk für die Zugangsverwaltung (ISO/IEC 29146:2016)

Diese Internationale Norm legt ein Rahmenwerk für die Zugangsverwaltung(AM, en: access management) und die sichere Verwaltung des Prozesses für den Zugriff auf Ressourcen der Informations- und Kommunikations
technologie(IKT) im Zusammenhang mit der Rechenschaftspflicht eines Subjekts in einem gegebenen Kontext fest.
Diese Internationale Norm stellt Konzepte und Begriffe zur Verfügung, die auf verteilte Zugangsverwaltungs- techniken in Netzwerkumgebungen anwendbar sind.
Diese Internationale Norm enthält ferner Erläuterungen zu zugehörigen Architekturen, Komponenten und Ver
waltungsfunktionen.
Die an der Zugangsverwaltung beteiligten Subjekte könnten eindeutig als auf Informationssysteme wie in ISO/IEC24760 zugreifend angesehen werden.
Art und Eigenschaften der zu Zugangsverwaltungssystemen gehörenden physischen Zugangssteuerung liegen nicht im Anwendungsbereich dieser Internationalen Norm.

Technologies de l'information - Techniques de sécurité - Cadre pour la gestion de l'accès (ISO/IEC 29146:2016, y compris Amd 1:2022)

La présente Norme internationale définit et établit un cadre pour la gestion de l'accès (AM, access management) et la gestion sécurisée du processus d'accès à l'information et aux ressources des technologies de l'information et de la communication (TIC), associé à la responsabilité d'un sujet dans un certain contexte.
La présente Norme internationale fournit des concepts, des termes et des définitions applicables aux techniques de gestion d'accès distribuée dans des environnements en réseau.
La présente Norme internationale fournit également des explications concernant l'architecture, les composants et les fonctions de gestion associés.
Les sujets impliqués dans la gestion d'accès peuvent être reconnus de manière unique pour accéder aux systèmes d'information, tel que défini dans l'ISO/IEC 24760.
La nature et les qualités du contrôle d'accès physique intervenant dans les systèmes de gestion d'accès ne relèvent pas du domaine d'application de la présente Norme internationale.

Informacijska tehnologija - Varnostne tehnike - Ogrodje za upravljanje dostopa (ISO/IEC 29146:2016, vključno z dopolnilom 1:2022)

Standard ISO/IEC 29146 opredeljuje in vzpostavlja ogrodje za upravljanje dostopa (AM) in varno upravljanje procesa za dostop do virov informacijskih in komunikacijskih tehnologij (ICT), povezanih z odgovornostjo subjekta znotraj določenega konteksta. Vsebuje pojasnila o povezani arhitekturi, komponentah in funkcijah upravljanja ter zasnovah, pogojih in definicijah, ki se uporabljajo za porazdeljeno upravljanje dostopa. Subjekti, vključeni v upravljanje dostopa, so lahko edinstveno prepoznani za dostop do informacijskih sistemov, kot je opredeljeno v standardu ISO/IEC 24760.

General Information

• Status: Published
• Publication Date: 04-Apr-2023
• ICS: 35.030 - IT Security
• Technical Committee: CEN/CLC/TC 13 - Cybersecurity and Data Protection
• Drafting Committee: CEN/CLC/TC 13 - Cybersecurity and Data Protection
• Current Stage: 6060 - Definitive text made available (DAV) - Publishing
• Start Date: 05-Apr-2023
• Due Date: 12-Jan-2025
• Completion Date: 05-Apr-2023
• Ref Project: SIST EN ISO/IEC 29146:2023 - Information technology - Security techniques - A framework for access management (ISO/IEC 29146:2016, including Amd 1:2022)

Standards Content (Sample)

SLOVENSKI STANDARD
01-julij-2023
Informacijska tehnologija - Varnostne tehnike - Ogrodje za upravljanje dostopa
(ISO/IEC 29146:2016, vključno z dopolnilom 1:2022)
Information technology - Security techniques - A framework for access management
(ISO/IEC 29146:2016, including Amd 1:2022)
Informationstechnologie - Sicherheitstechniken - Ein Rahmen für die Zugangsverwaltung
(ISO/IEC 29146:2016, einschließlich Amd 1:2022)
Technologies de l'information - Techniques de sécurité - Cadre pour gestion d'accès
(ISO/IEC 29146:2016, y compris Amd 1:2022)
Ta slovenski standard je istoveten z: EN ISO/IEC 29146:2023
ICS:
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

EUROPEAN STANDARD EN ISO/IEC 29146

NORME EUROPÉENNE
EUROPÄISCHE NORM
April 2023
ICS 35.030
English version
Information technology - Security techniques - A
framework for access management (ISO/IEC 29146:2016,
including Amd 1:2022)
Technologies de l'information - Techniques de sécurité Informationstechnologie - Sicherheitstechniken - Ein
- Cadre pour la gestion de l'accès (ISO/IEC 29146:2016, Rahmen für die Zugangsverwaltung (ISO/IEC
y compris Amd 1:2022) 29146:2016, einschließlich Amd 1:2022)
This European Standard was approved by CEN on 24 March 2023.

CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for
giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to
any CEN and CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.

CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,
Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.

CEN-CENELEC Management Centre:
Rue de la Science 23, B-1040 Brussels
© 2023 CEN/CENELEC All rights of exploitation in any form and by any means
Ref. No. EN ISO/IEC 29146:2023 E
reserved worldwide for CEN national Members and for
CENELEC Members.
Contents Page
European foreword . 3

European foreword
The text of ISO/IEC 29146:2016, including Amd 1:2022 has been prepared by Technical Committee
ISO/IEC JTC 1 "Information technology” of the International Organization for Standardization (ISO) and
has been taken over as EN ISO/IEC 29146:2023 by Technical Committee CEN-CENELEC/JTC 13
“Cybersecurity and Data Protection” the secretariat of which is held by DIN.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by October 2023, and conflicting national standards shall
be withdrawn at the latest by October 2023.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN-CENELEC shall not be held responsible for identifying any or all such patent rights.
Any feedback and questions on this document should be directed to the users’ national standards body.
A complete listing of these bodies can be found on the CEN and CENELEC websites.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland,
Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of
North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and the
United Kingdom.
Endorsement notice
The text of ISO/IEC 29146:2016, including Amd 1:2022 has been approved by CEN-CENELEC as
INTERNATIONAL ISO/IEC
STANDARD 29146
First edition
2016-06-01
Information technology — Security
techniques — A framework for access
management
Technologies de l’information — Techniques de sécurité — Cadre
pour gestion d’accès
Reference number
ISO/IEC 29146:2016(E)
©
ISO/IEC 2016
ISO/IEC 29146:2016(E)
© ISO/IEC 2016, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. [phone]
Fax [phone]
[e-mail]
www.iso.org
ii © ISO/IEC 2016 – All rights reserved

ISO/IEC 29146:2016(E)
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 4
5 Concepts . 5
5.1 A model for controlling access to resources . 5
5.1.1 Overview . 5
5.1.2 Relationship between identity management system and access
management system . 6
5.1.3 Security characteristics of the access method. 7
5.2 Relationships between logical and physical access control . 8
5.3 Access management system functions and processes . 8
5.3.1 Overview . 8
5.3.2 Access control policy . 9
5.3.3 Privilege management .10
5.3.4 Policy-related attribute information management .11
5.3.5 Authorization .12
5.3.6 Monitoring management .12
5.3.7 Alarm management .13
5.3.8 Federated access control.13
6 Reference architecture .14
6.1 Overview .14
6.2 Basic components of an access management system .15
6.2.1 Authentication endpoint .15
6.2.2 Policy decision point (PDP) .15
6.2.3 Policy information point (PIP) .15
6.2.4 Policy administration point (PAP) .15
6.2.5 Policy enforcement point (PEP) .16
6.3 Additional service components .16
6.3.1 General.16
6.3.2 Subject centric implementation . .16
6.3.3 Enterprise centric implementation .18
7 Additional requirements and concerns .19
7.1 Access to administrative information .19
7.2 AMS models and policy issues .19
7.2.1 Access control models .19
7.2.2 Policies in access management .20
7.3 Legal and regulatory requirements .20
8 Practice .20
8.1 Processes .20
8.1.1 Authorization process .20
8.1.2 Privilege management process .21
8.2 Threats .21
8.3 Control objectives .22
8.3.1 General.22
8.3.2 Validating the
...