EN ISO/IEC 24760-3:2022
(Main)Information technology - Security techniques - A framework for identity management - Part 3: Practice (ISO/IEC 24760-3:2016)
Information technology - Security techniques - A framework for identity management - Part 3: Practice (ISO/IEC 24760-3:2016)
ISO/IEC 24760-3:2016 provides guidance for the management of identity information and for ensuring that an identity management system conforms to ISO/IEC 24760-1 and ISO/IEC 24760-2.
ISO/IEC 24760-3:2016 is applicable to an identity management system where identifiers or PII relating to entities are acquired, processed, stored, transferred or used for the purposes of identifying or authenticating entities and/or for the purpose of decision making using attributes of entities. Practices for identity management can also be addressed in other standards.
Informationstechnik - Sicherheitsverfahren - Rahmenwerk für Identitätsmanagement - Teil 3: Umsetzung (ISO/IEC 24760-3:2016)
Dieser Teil von ISO/IEC24760 stellt einen Leitfaden für das Management von Identitätsinformationen und für die Sicherstellung der Konformität eines Identitätsmanagementsystems mit ISO/IEC24760-1 und ISO/IEC24760-2 bereit.
Dieser Teil von ISO/IEC24760 gilt für ein Identitätsmanagementsystem, in dem Identifikatoren oder pbD, die sich auf Entitäten beziehen, zum Zwecke der Identifizierung oder Authentifizierung von Entitäten und/oder zum Zwecke der Entscheidungsfindung unter Verwendung von Attributen von Entitäten erfasst, verarbeitet, gespeichert, übertragen oder verwendet werden. Umsetzungen für das Identitätsmanagement können auch in anderen Normen behandelt werden.
Technologies de l'information - Techniques de sécurité - Cadre pour la gestion de l'identité - Partie 3: Mise en oeuvre (ISO/IEC 24760-3:2016)
La présente partie de l'ISO/IEC 24760 fournit des recommandations pour la gestion des informations d'identité et pour s'assurer qu'un système de gestion de l'identité est conforme à l'ISO/IEC 24760-1 et à l'ISO/IEC 24760-2.
La présente partie de l'ISO/IEC 24760 est applicable à un système de gestion de l'identité dans lequel des identificateurs ou des DCP relatifs à des entités sont acquis, traités, stockés, transférés ou utilisés à des fins d'identification ou d'authentification d'entités et/ou à des fins de prise de décision à l'aide d'attributs d'entités. Les pratiques relatives à la gestion de l'identité peuvent également être traitées dans d'autres normes.
Informacijska tehnologija - Varnostne tehnike - Okvir za upravljanje identitete - 3. del: Izvajanje (ISO/IEC 24760-3:2016)
ISO/IEC 24760-3:2016 podaja smernice za upravljanje informacij o identiteti in za zagotavljanje, da je sistem za upravljanje identitete skladen s standardoma ISO/IEC 24760-1 in ISO/IEC 24760-2.
ISO/IEC 24760-3:2016 se uporablja za sisteme upravljanja identitete, v katerih se identifikatorji ali PII v zvezi s subjekti pridobivajo, obdelujejo, shranjujejo, prenašajo ali uporabljajo za namene identifikacije ali preverjanja pristnosti subjektov in/ali za namen odločanja na podlagi atributov subjektov. Prakse za upravljanje identitete lahko obravnavajo tudi drugi standardi.
General Information
Standards Content (Sample)
SLOVENSKI STANDARD
SIST EN ISO/IEC 24760-3:2023
01-januar-2023
Informacijska tehnologija - Varnostne tehnike - Okvir za upravljanje identitete - 3.
del: Izvajanje (ISO/IEC 24760-3:2016)
Information technology - Security techniques - A framework for identity management -
Part 3: Practice (ISO/IEC 24760-3:2016)
Informationstechnik - Sicherheitsverfahren - Rahmenwerk für Identitätsmanagement -
Teil 3: Umsetzung (ISO/IEC 24760-3:2016)
Technologies de l'information - Techniques de sécurité - Cadre pour la gestion de
l'identité - Partie 3: Mise en oeuvre (ISO/IEC 24760-3:2016)
Ta slovenski standard je istoveten z: EN ISO/IEC 24760-3:2022
ICS:
35.030 Informacijska varnost IT Security
SIST EN ISO/IEC 24760-3:2023 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
---------------------- Page: 1 ----------------------
SIST EN ISO/IEC 24760-3:2023
---------------------- Page: 2 ----------------------
SIST EN ISO/IEC 24760-3:2023
EUROPEAN STANDARD EN ISO/IEC 24760-3
NORME EUROPÉENNE
EUROPÄISCHE NORM
September 2022
ICS 35.030
English version
Information technology - Security techniques - A
framework for identity management - Part 3: Practice
(ISO/IEC 24760-3:2016)
Technologies de l'information - Techniques de sécurité Informationstechnik - Sicherheitsverfahren -
- Cadre pour la gestion de l'identité - Partie 3: Mise en Rahmenwerk für Identitätsmanagement - Teil 3:
oeuvre (ISO/IEC 24760-3:2016) Umsetzung (ISO/IEC 24760-3:2016)
This European Standard was approved by CEN on 5 September 2022.
CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for
giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to
any CEN and CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.
CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,
Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.
CEN-CENELEC Management Centre:
Rue de la Science 23, B-1040 Brussels
© 2022 CEN/CENELEC All rights of exploitation in any form and by any means
Ref. No. EN ISO/IEC 24760-3:2022 E
reserved worldwide for CEN national Members and for
CENELEC Members.
---------------------- Page: 3 ----------------------
SIST EN ISO/IEC 24760-3:2023
EN ISO/IEC 24760-3:2022 (E)
Contents Page
European foreword . 3
2
---------------------- Page: 4 ----------------------
SIST EN ISO/IEC 24760-3:2023
EN ISO/IEC 24760-3:2022 (E)
European foreword
The text of ISO/IEC 24760-3:2016 has been prepared by Technical Committee ISO/IEC JTC 1
"Information technology” of the International Organization for Standardization (ISO) and has been
taken over as EN ISO/IEC 24760-3:2022 by Technical Committee CEN-CENELEC/ JTC 13 “Cybersecurity
and Data Protection” the secretariat of which is held by DIN.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by March 2023, and conflicting national standards shall
be withdrawn at the latest by March 2023.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN-CENELEC shall not be held responsible for identifying any or all such patent rights.
Any feedback and questions on this document should be directed to the users’ national standards body.
A complete listing of these bodies can be found on the CEN and CENELEC websites.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland,
Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of
North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and the
United Kingdom.
Endorsement notice
The text of ISO/IEC 24760-3:2016 has been approved by CEN-CENELEC as EN ISO/IEC 24760-3:2022
without any modification.
3
---------------------- Page: 5 ----------------------
SIST EN ISO/IEC 24760-3:2023
---------------------- Page: 6 ----------------------
SIST EN ISO/IEC 24760-3:2023
INTERNATIONAL ISO/IEC
STANDARD 24760-3
First edition
2016-08-01
Information technology — Security
techniques — A framework for
identity management —
Part 3:
Practice
Technologies de l’information — Techniques de sécurité — Cadre
pour la gestion de l’identité —
Partie 3: Mise en oeuvre
Reference number
ISO/IEC 24760-3:2016(E)
©
ISO/IEC 2016
---------------------- Page: 7 ----------------------
SIST EN ISO/IEC 24760-3:2023
ISO/IEC 24760-3:2016(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2016, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. +41 22 749 01 11
Fax +41 22 749 09 47
copyright@iso.org
www.iso.org
ii © ISO/IEC 2016 – All rights reserved
---------------------- Page: 8 ----------------------
SIST EN ISO/IEC 24760-3:2023
ISO/IEC 24760-3:2016(E)
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Symbols and abbreviated terms . 2
5 Mitigating identity related risk in managing identity information . 2
5.1 Overview . 2
5.2 Risk assessment . 2
5.3 Assurance in identity information . 3
5.3.1 General. 3
5.3.2 Identity proofing . 3
5.3.3 Credentials . 3
5.3.4 Identity profile . 3
6 Identity information and identifiers . 4
6.1 Overview . 4
6.2 Policy on accessing identity information . 4
6.3 Identifiers . 4
6.3.1 General. 4
6.3.2 Categorization of identifier by the type of entity to which the identifier is linked 4
6.3.3 Categorization of identifier by the nature of linking . 5
6.3.4 Categorization of identifier by the grouping of entities . 6
6.3.5 Management of identifiers . 6
7 Auditing identity information usage . 6
8 Control objectives and controls . 6
8.1 General . 6
8.2 Contextual components for control . 7
8.2.1 Establishing an identity management system . 7
8.2.2 Establishing identity information . 9
8.2.3 Managing identity information .10
8.3 Architectural components for control .11
8.3.1 Establishing an identity management system .11
8.3.2 Controlling an identity management system .13
Annex A (normative) Practice of managing identity information in a federation of identity
management systems .15
Annex B (normative) Identity management practice using attribute-based credentials to
enhance privacy protection .24
Bibliography .31
© ISO/IEC 2016 – All rights reserved iii
---------------------- Page: 9 ----------------------
SIST EN ISO/IEC 24760-3:2023
ISO/IEC 24760-3:2016(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for
the different types of document should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the meaning of ISO specific terms and expressions related to conformity
assessment, as well as information about ISO’s adherence to the WTO principles in the Technical
Barriers to Trade (TBT) see the following URL: Foreword - Supplementary information
The committee responsible for this document is ISO/IEC JTC 1, Information technology, SC 27, IT Security
techniques.
ISO/IEC 24760 consists of the following parts, under the general title Information technology — Security
techniques — A framework for identity management
— Part 1: Terminology and concepts
— Part 2: Reference architecture and requirements
— Part 3: Practice
iv © ISO/IEC 2016 – All rights reserved
---------------------- Page: 10 ----------------------
SIST EN ISO/IEC 24760-3:2023
ISO/IEC 24760-3:2016(E)
Introduction
Data processing systems commonly gather a range of information on their users, be it a person, piece of
equipment, or piece of software connected to it and make decisions based on the gathered information.
Such identity-based decisions may concern access to applications or other resources.
To address the need to efficiently and effectively implement systems that make identity-based decisions,
ISO/IEC 24760 specifies a framework for the issuance, administration, and use of data that serves to
characterize individuals, organizations or information technology components, which operate on
behalf of individuals or organizations.
For many organizations, the proper management of identity information is crucial to maintain security
of the organizational processes. For individuals, correct identity management is important to protect
privacy.
This part of ISO/IEC 24760 specifies fundamental concepts and operational structures of identity
management with the purpose to realize information system management, so that information systems
can meet business, contractual, regulatory and legal obligations.
This part of ISO/IEC 24760 presents practices for identity management. These practices cover
assurance in controlling identity information use, controlling the access to identity information and
other resources based on identity information, and controlling objectives that should be implemented
when establishing and maintaining an identity management system.
This part of ISO/IEC 24760 consists of the following parts:
— ISO/IEC 24760-1: Terminology and concepts;
— ISO/IEC 24760-2: Reference architecture and requirements;
— ISO/IEC 24760-3: Practice.
ISO/IEC 24760 is intended to provide foundations for other identity management related International
Standards including the following:
— ISO/IEC 29100, Privacy framework;
— ISO/IEC 29101, Privacy reference architecture;
— ISO/IEC 29115, Entity authentication assurance framework;
— ISO/IEC 29146, A framework for access management.
© ISO/IEC 2016 – All rights reserved v
---------------------- Page: 11 ----------------------
SIST EN ISO/IEC 24760-3:2023
---------------------- Page: 12 ----------------------
SIST EN ISO/IEC 24760-3:2023
INTERNATIONAL STANDARD ISO/IEC 24760-3:2016(E)
Information technology — Security techniques — A
framework for identity management —
Part 3:
Practice
1 Scope
This part of ISO/IEC 24760 provides guidance for the management of identity information and for
ensuring that an identity management system conforms to ISO/IEC 24760-1 and ISO/IEC 24760-2.
This part of ISO/IEC 24760 is applicable to an identity management system where identifiers or PII
relating to entities are acquired, processed, stored, transferred or used for the purposes of identifying
or authenticating entities and/or for the purpose of decision making using attributes of entities.
Practices for identity management can also be addressed in other standards.
2 Normative references
The following documents, in whole or in part, are normatively referenced in this document and are
indispensable for its application. For dated references, only the edition cited applies. For undated
references, the latest edition of the referenced document (including any amendments) applies.
ISO/IEC 24760-1, Information technology — Security techniques — A framework for identity
management — Part 1: Terminology and concepts
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 24760-1 and the
following apply.
3.1
identity management system
system comprising of policies, procedures, technology and other resources for maintaining identity
information including meta data
[SOURCE: ISO/IEC 24760-2:2015, 3.3]
3.2
identity profile
identity containing attributes specified by an identity template
3.3
identity template
definition of a specific set of attributes
Note 1 to entry: Typically, the attributes in a profile are to support a particular technical or business purpose as
needed by relying parties.
3.4
identity theft
result of a successful false claim of identity
© ISO/IEC 2016 – All rights reserved 1
---------------------- Page: 13 ----------------------
SIST EN ISO/IEC 24760-3:2023
ISO/IEC 24760-3:2016(E)
3.5
federation manager
actor in a federation responsible for managing the issues arising from the operation of the federation
Note 1 to entry: An existing federation member or an independent third party can carry out the role of federation
manager.
3.6
principal
entity to which identity information in an identity management system pertains
[SOURCE: ISO/IEC 24760-2:2015, 3.4]
4 Symbols and abbreviated terms
For the purposes of this document, the following symbols and abbreviated terms apply.
ICT Information and Communication Technology
IIP Identity Information Provider
IIA Identity Information Authority
PII Personally Identifiable Information
RP Relying Party
5 Mitigating identity related risk in managing identity information
5.1 Overview
Clause 5 presents practices to address identity related risk when operating an identity management
system conforming to ISO/IEC 24760-1, ISO/IEC 24760-2 and ISO/IEC 29115.
5.2 Risk assessment
One function of an identity management system is to manage the risk of identity errors, and the
confidentiality, integrity and availability of identity information that it stores, processes and
communicates. It is necessary to understand the level of risk, which will depend on the application.
The owner of the application should conduct a risk assessment to determine the level of risk. The result
will provide information, which can be used to determine the necessary risk management criteria and
processes for the identity management system. The information an identity management system needs
includes the level of assurance in identity information required and the requirements for confidentiality,
integrity and availability of this information.
ISO/IEC 24760-2 specifies tools to manage risks as policies, regulation, design and architecture. In some
contexts involving consumers, protecting personally identifiable information and giving principals
control over the use of their personally identifiable information is paramount. ISO/IEC 29100,
ISO/IEC 29101, ISO/IEC 29134 and ISO/IEC 29151 (to be published) specify requirements and provide
guidance for the protection of privacy.
Identity information managed by an identity management system may also be managed by reference to
identity information providers in another domain. For example, identity proofing may be undertaken
by a service provider, which operates in a different domain to that of the identity management system.
When identity information is collected and stored, risk management measures shall be implemented by
the identity management service to mitigate the risks identified by a risk assessment carried out in the
2 © ISO/IEC 2016 – All rights reserved
---------------------- Page: 14 ----------------------
SIST EN ISO/IEC 24760-3:2023
ISO/IEC 24760-3:2016(E)
application domain by the relying party. Levels of assurance in regard to identity information and access
services shall be determined and specified by the relying party according to assessed levels of risk.
5.3 Assurance in identity information
5.3.1 General
Confidence in identity information provided by an identity management system comes from processes
that assure the validity of the information from its collection through its subsequent storage and
maintenance by the system. Assurance is typically quantified in terms of assurance levels with higher
levels corresponding to greater assurance. The level of assurance achieved depends on the quality of
the identity information and the rigour of the identity validation processes. Levels of assurance are
described in ISO/IEC 29115.
5.3.2 Identity proofing
Identity proofing, i.e. validating identity information for enrolment of an entity in a domain, shall meet
a defined level of assurance. The level of assurance of identity proofing achievable depends on the type
and characteristics of information and, in some case, the scope of this information, e.g. the number of
independent identity information providers used as sources of the information.
An increased level of assurance in identity verification may be achieved
— with verification of additional credentials issued from multiple sources, and
— using a trusted external party that knows the entity to validate claimed identity information.
NOTE 1 ISO/IEC 29003 provides requirements for identity proofing.
NOTE 2 ISO/IEC 29115 specifies how to achieve different levels of assurance.
5.3.3 Credentials
An identity management system may issue multiple types of credential differing in the level of assurance
of the identity information represented by the credential.
An identity management system issuing credentials with a high level of assurance supported by
a cryptographic mechanism should provide a service for relying parties to actively support the
cryptographic validation process.
5.3.4 Identity profile
An identity management system may use one or more identity profiles for gathering, structuring, or
presenting identity information.
NOTE Although a profile can contain identity information, it is not intended for identification. Its purpose is
to provide identity information about an entity to system processes that need the information for their processes.
An entity may have multiple identity profiles, each containing a different set of attributes for the entity.
For instance, a language preference may be present in a profile for an access interface and not in a
profile for book interests.
An identity template may be established as an international or industry standard. The use of a
standardised identity template to record identity attributes would facilitate the usage of identity
profiles across domains.
An identity profile may be used in access management to determine the required identity attributes for
being authorized for a role or privilege in accessing information. An identity profile may be used as a
pre-configured subset of identity information to be presented when interacting with a service.
© ISO/IEC 2016 – All rights reserved 3
---------------------- Page: 15 ----------------------
SIST EN ISO/IEC 24760-3:2023
ISO/IEC 24760-3:2016(E)
An attribute in an identity profile may be associated with a level of assurance. Using an identity
profile with associated levels of assurance to present identity information shall imply that each item
of information has been validated at minimally its associated level of assurance. An identity profile
specifying requirements for access to services or resources may be associated with a specific additional
entity identifier that may indicate the activities linked to the specific privileges.
6 Identity information and identifiers
6.1 Overview
Organizations should understand the information security concerns for their business and for
compliance with relevant legislation and should provide management support to meet the business
needs. In regard to identity management, organizations should understand their liabilities and ensure
that adequate controls are implemented to mitigate the risks and consequences of identity information
leakage, corruption and loss of availability when collecting, storing, using, transmitting and disposing
of identity information. Organizations should specify control objectives and controls to ensure that
information security requirements are met.
6.2 Policy on accessing identity information
The identity information pertaining to an entity should be managed to ensure that the following:
— identity information remains accurate and up-to-date over time;
— only authorized entities have access to the identity information and are accountable for all uses and
changes in identity information, guaranteeing traceability of any processing of identity information
by any entity, whether a person, a process or a system;
— the organization fulfils its obligations with respect to regulations and contractual agreements;
— principals are protected against the risk of identity-related theft and other identity related crime.
NOTE Typically, an information security policy highlights the necessity to securely manage identity
information. The preservation and protection of any entities identity information is also required when dealing
with third parties as typically documented within the operational procedures.
6.3 Identifiers
6.3.1 General
An identifier allows distinguishing unambiguously one entity from another entity in a domain of
applicability. An entity may have multiple, different identifiers in the same domain. This may facilitate
the representation of the entity in some situations, e.g. hiding the entity’s identity when providing the
entity’s identity information for use in some processes or within some systems. An identifier created in
one domain may be reused intentionally in another domain provided the reused identifier continues to
provide uniqueness of identity within the other domain.
6.3.2 Categorization of identifier by the type of entity to which the identifier is linked
6.3.2.1 Person identifiers
A person identifier may be, e.g. a full name, a date of birth, a place of birth, or various pseudonyms, such
as a number assigned by an authority as a reference, e.g. a passport number, a national identity number
or an identity-card number.
4 © ISO/IEC 2016 – All rights reserved
---------------------- Page: 16 ----------------------
SIST EN ISO/IEC 24760-3:2023
ISO/IEC 24760-3:2016(E)
The use of pseudonyms as identifiers is frequent for person identifiers; see.6.3.3.2.
NOTE A pseudonym can enhance the privacy of persons in an identity-authentication exchange with a
relying party as a pseudonym may reveal less personally identifiable information than if a
...
SLOVENSKI STANDARD
oSIST prEN ISO/IEC 24760-3:2022
01-julij-2022
Informacijska tehnologija - Varnostne tehnike - Okvir za upravljanje identitete - 3.
del: Izvajanje (ISO/IEC 24760-3:2016)
Information technology - Security techniques - A framework for identity management -
Part 3: Practice (ISO/IEC 24760-3:2016)
Informationstechnik - Sicherheitsverfahren - Rahmenwerk für Identitätsmanagement -
Teil 3: Umsetzung (ISO/IEC 24760-3:2016)
Technologies de l'information - Techniques de sécurité - Cadre pour la gestion de
l'identité - Partie 3: Mise en oeuvre (ISO/IEC 24760-3:2016)
Ta slovenski standard je istoveten z: prEN ISO/IEC 24760-3
ICS:
35.030 Informacijska varnost IT Security
oSIST prEN ISO/IEC 24760-3:2022 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
---------------------- Page: 1 ----------------------
oSIST prEN ISO/IEC 24760-3:2022
---------------------- Page: 2 ----------------------
oSIST prEN ISO/IEC 24760-3:2022
INTERNATIONAL ISO/IEC
STANDARD 24760-3
First edition
2016-08-01
Information technology — Security
techniques — A framework for
identity management —
Part 3:
Practice
Technologies de l’information — Techniques de sécurité — Cadre
pour la gestion de l’identité —
Partie 3: Mise en oeuvre
Reference number
ISO/IEC 24760-3:2016(E)
©
ISO/IEC 2016
---------------------- Page: 3 ----------------------
oSIST prEN ISO/IEC 24760-3:2022
ISO/IEC 24760-3:2016(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2016, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. +41 22 749 01 11
Fax +41 22 749 09 47
copyright@iso.org
www.iso.org
ii © ISO/IEC 2016 – All rights reserved
---------------------- Page: 4 ----------------------
oSIST prEN ISO/IEC 24760-3:2022
ISO/IEC 24760-3:2016(E)
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Symbols and abbreviated terms . 2
5 Mitigating identity related risk in managing identity information . 2
5.1 Overview . 2
5.2 Risk assessment . 2
5.3 Assurance in identity information . 3
5.3.1 General. 3
5.3.2 Identity proofing . 3
5.3.3 Credentials . 3
5.3.4 Identity profile . 3
6 Identity information and identifiers . 4
6.1 Overview . 4
6.2 Policy on accessing identity information . 4
6.3 Identifiers . 4
6.3.1 General. 4
6.3.2 Categorization of identifier by the type of entity to which the identifier is linked 4
6.3.3 Categorization of identifier by the nature of linking . 5
6.3.4 Categorization of identifier by the grouping of entities . 6
6.3.5 Management of identifiers . 6
7 Auditing identity information usage . 6
8 Control objectives and controls . 6
8.1 General . 6
8.2 Contextual components for control . 7
8.2.1 Establishing an identity management system . 7
8.2.2 Establishing identity information . 9
8.2.3 Managing identity information .10
8.3 Architectural components for control .11
8.3.1 Establishing an identity management system .11
8.3.2 Controlling an identity management system .13
Annex A (normative) Practice of managing identity information in a federation of identity
management systems .15
Annex B (normative) Identity management practice using attribute-based credentials to
enhance privacy protection .24
Bibliography .31
© ISO/IEC 2016 – All rights reserved iii
---------------------- Page: 5 ----------------------
oSIST prEN ISO/IEC 24760-3:2022
ISO/IEC 24760-3:2016(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for
the different types of document should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the meaning of ISO specific terms and expressions related to conformity
assessment, as well as information about ISO’s adherence to the WTO principles in the Technical
Barriers to Trade (TBT) see the following URL: Foreword - Supplementary information
The committee responsible for this document is ISO/IEC JTC 1, Information technology, SC 27, IT Security
techniques.
ISO/IEC 24760 consists of the following parts, under the general title Information technology — Security
techniques — A framework for identity management
— Part 1: Terminology and concepts
— Part 2: Reference architecture and requirements
— Part 3: Practice
iv © ISO/IEC 2016 – All rights reserved
---------------------- Page: 6 ----------------------
oSIST prEN ISO/IEC 24760-3:2022
ISO/IEC 24760-3:2016(E)
Introduction
Data processing systems commonly gather a range of information on their users, be it a person, piece of
equipment, or piece of software connected to it and make decisions based on the gathered information.
Such identity-based decisions may concern access to applications or other resources.
To address the need to efficiently and effectively implement systems that make identity-based decisions,
ISO/IEC 24760 specifies a framework for the issuance, administration, and use of data that serves to
characterize individuals, organizations or information technology components, which operate on
behalf of individuals or organizations.
For many organizations, the proper management of identity information is crucial to maintain security
of the organizational processes. For individuals, correct identity management is important to protect
privacy.
This part of ISO/IEC 24760 specifies fundamental concepts and operational structures of identity
management with the purpose to realize information system management, so that information systems
can meet business, contractual, regulatory and legal obligations.
This part of ISO/IEC 24760 presents practices for identity management. These practices cover
assurance in controlling identity information use, controlling the access to identity information and
other resources based on identity information, and controlling objectives that should be implemented
when establishing and maintaining an identity management system.
This part of ISO/IEC 24760 consists of the following parts:
— ISO/IEC 24760-1: Terminology and concepts;
— ISO/IEC 24760-2: Reference architecture and requirements;
— ISO/IEC 24760-3: Practice.
ISO/IEC 24760 is intended to provide foundations for other identity management related International
Standards including the following:
— ISO/IEC 29100, Privacy framework;
— ISO/IEC 29101, Privacy reference architecture;
— ISO/IEC 29115, Entity authentication assurance framework;
— ISO/IEC 29146, A framework for access management.
© ISO/IEC 2016 – All rights reserved v
---------------------- Page: 7 ----------------------
oSIST prEN ISO/IEC 24760-3:2022
---------------------- Page: 8 ----------------------
oSIST prEN ISO/IEC 24760-3:2022
INTERNATIONAL STANDARD ISO/IEC 24760-3:2016(E)
Information technology — Security techniques — A
framework for identity management —
Part 3:
Practice
1 Scope
This part of ISO/IEC 24760 provides guidance for the management of identity information and for
ensuring that an identity management system conforms to ISO/IEC 24760-1 and ISO/IEC 24760-2.
This part of ISO/IEC 24760 is applicable to an identity management system where identifiers or PII
relating to entities are acquired, processed, stored, transferred or used for the purposes of identifying
or authenticating entities and/or for the purpose of decision making using attributes of entities.
Practices for identity management can also be addressed in other standards.
2 Normative references
The following documents, in whole or in part, are normatively referenced in this document and are
indispensable for its application. For dated references, only the edition cited applies. For undated
references, the latest edition of the referenced document (including any amendments) applies.
ISO/IEC 24760-1, Information technology — Security techniques — A framework for identity
management — Part 1: Terminology and concepts
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 24760-1 and the
following apply.
3.1
identity management system
system comprising of policies, procedures, technology and other resources for maintaining identity
information including meta data
[SOURCE: ISO/IEC 24760-2:2015, 3.3]
3.2
identity profile
identity containing attributes specified by an identity template
3.3
identity template
definition of a specific set of attributes
Note 1 to entry: Typically, the attributes in a profile are to support a particular technical or business purpose as
needed by relying parties.
3.4
identity theft
result of a successful false claim of identity
© ISO/IEC 2016 – All rights reserved 1
---------------------- Page: 9 ----------------------
oSIST prEN ISO/IEC 24760-3:2022
ISO/IEC 24760-3:2016(E)
3.5
federation manager
actor in a federation responsible for managing the issues arising from the operation of the federation
Note 1 to entry: An existing federation member or an independent third party can carry out the role of federation
manager.
3.6
principal
entity to which identity information in an identity management system pertains
[SOURCE: ISO/IEC 24760-2:2015, 3.4]
4 Symbols and abbreviated terms
For the purposes of this document, the following symbols and abbreviated terms apply.
ICT Information and Communication Technology
IIP Identity Information Provider
IIA Identity Information Authority
PII Personally Identifiable Information
RP Relying Party
5 Mitigating identity related risk in managing identity information
5.1 Overview
Clause 5 presents practices to address identity related risk when operating an identity management
system conforming to ISO/IEC 24760-1, ISO/IEC 24760-2 and ISO/IEC 29115.
5.2 Risk assessment
One function of an identity management system is to manage the risk of identity errors, and the
confidentiality, integrity and availability of identity information that it stores, processes and
communicates. It is necessary to understand the level of risk, which will depend on the application.
The owner of the application should conduct a risk assessment to determine the level of risk. The result
will provide information, which can be used to determine the necessary risk management criteria and
processes for the identity management system. The information an identity management system needs
includes the level of assurance in identity information required and the requirements for confidentiality,
integrity and availability of this information.
ISO/IEC 24760-2 specifies tools to manage risks as policies, regulation, design and architecture. In some
contexts involving consumers, protecting personally identifiable information and giving principals
control over the use of their personally identifiable information is paramount. ISO/IEC 29100,
ISO/IEC 29101, ISO/IEC 29134 and ISO/IEC 29151 (to be published) specify requirements and provide
guidance for the protection of privacy.
Identity information managed by an identity management system may also be managed by reference to
identity information providers in another domain. For example, identity proofing may be undertaken
by a service provider, which operates in a different domain to that of the identity management system.
When identity information is collected and stored, risk management measures shall be implemented by
the identity management service to mitigate the risks identified by a risk assessment carried out in the
2 © ISO/IEC 2016 – All rights reserved
---------------------- Page: 10 ----------------------
oSIST prEN ISO/IEC 24760-3:2022
ISO/IEC 24760-3:2016(E)
application domain by the relying party. Levels of assurance in regard to identity information and access
services shall be determined and specified by the relying party according to assessed levels of risk.
5.3 Assurance in identity information
5.3.1 General
Confidence in identity information provided by an identity management system comes from processes
that assure the validity of the information from its collection through its subsequent storage and
maintenance by the system. Assurance is typically quantified in terms of assurance levels with higher
levels corresponding to greater assurance. The level of assurance achieved depends on the quality of
the identity information and the rigour of the identity validation processes. Levels of assurance are
described in ISO/IEC 29115.
5.3.2 Identity proofing
Identity proofing, i.e. validating identity information for enrolment of an entity in a domain, shall meet
a defined level of assurance. The level of assurance of identity proofing achievable depends on the type
and characteristics of information and, in some case, the scope of this information, e.g. the number of
independent identity information providers used as sources of the information.
An increased level of assurance in identity verification may be achieved
— with verification of additional credentials issued from multiple sources, and
— using a trusted external party that knows the entity to validate claimed identity information.
NOTE 1 ISO/IEC 29003 provides requirements for identity proofing.
NOTE 2 ISO/IEC 29115 specifies how to achieve different levels of assurance.
5.3.3 Credentials
An identity management system may issue multiple types of credential differing in the level of assurance
of the identity information represented by the credential.
An identity management system issuing credentials with a high level of assurance supported by
a cryptographic mechanism should provide a service for relying parties to actively support the
cryptographic validation process.
5.3.4 Identity profile
An identity management system may use one or more identity profiles for gathering, structuring, or
presenting identity information.
NOTE Although a profile can contain identity information, it is not intended for identification. Its purpose is
to provide identity information about an entity to system processes that need the information for their processes.
An entity may have multiple identity profiles, each containing a different set of attributes for the entity.
For instance, a language preference may be present in a profile for an access interface and not in a
profile for book interests.
An identity template may be established as an international or industry standard. The use of a
standardised identity template to record identity attributes would facilitate the usage of identity
profiles across domains.
An identity profile may be used in access management to determine the required identity attributes for
being authorized for a role or privilege in accessing information. An identity profile may be used as a
pre-configured subset of identity information to be presented when interacting with a service.
© ISO/IEC 2016 – All rights reserved 3
---------------------- Page: 11 ----------------------
oSIST prEN ISO/IEC 24760-3:2022
ISO/IEC 24760-3:2016(E)
An attribute in an identity profile may be associated with a level of assurance. Using an identity
profile with associated levels of assurance to present identity information shall imply that each item
of information has been validated at minimally its associated level of assurance. An identity profile
specifying requirements for access to services or resources may be associated with a specific additional
entity identifier that may indicate the activities linked to the specific privileges.
6 Identity information and identifiers
6.1 Overview
Organizations should understand the information security concerns for their business and for
compliance with relevant legislation and should provide management support to meet the business
needs. In regard to identity management, organizations should understand their liabilities and ensure
that adequate controls are implemented to mitigate the risks and consequences of identity information
leakage, corruption and loss of availability when collecting, storing, using, transmitting and disposing
of identity information. Organizations should specify control objectives and controls to ensure that
information security requirements are met.
6.2 Policy on accessing identity information
The identity information pertaining to an entity should be managed to ensure that the following:
— identity information remains accurate and up-to-date over time;
— only authorized entities have access to the identity information and are accountable for all uses and
changes in identity information, guaranteeing traceability of any processing of identity information
by any entity, whether a person, a process or a system;
— the organization fulfils its obligations with respect to regulations and contractual agreements;
— principals are protected against the risk of identity-related theft and other identity related crime.
NOTE Typically, an information security policy highlights the necessity to securely manage identity
information. The preservation and protection of any entities identity information is also required when dealing
with third parties as typically documented within the operational procedures.
6.3 Identifiers
6.3.1 General
An identifier allows distinguishing unambiguously one entity from another entity in a domain of
applicability. An entity may have multiple, different identifiers in the same domain. This may facilitate
the representation of the entity in some situations, e.g. hiding the entity’s identity when providing the
entity’s identity information for use in some processes or within some systems. An identifier created in
one domain may be reused intentionally in another domain provided the reused identifier continues to
provide uniqueness of identity within the other domain.
6.3.2 Categorization of identifier by the type of entity to which the identifier is linked
6.3.2.1 Person identifiers
A person identifier may be, e.g. a full name, a date of birth, a place of birth, or various pseudonyms, such
as a number assigned by an authority as a reference, e.g. a passport number, a national identity number
or an identity-card number.
4 © ISO/IEC 2016 – All rights reserved
---------------------- Page: 12 ----------------------
oSIST prEN ISO/IEC 24760-3:2022
ISO/IEC 24760-3:2016(E)
The use of pseudonyms as identifiers is frequent for person identifiers; see.6.3.3.2.
NOTE A pseudonym can enhance the privacy of persons in an identity-authentication exchange with a
relying party as a pseudonym may reveal less personally identifiable information than if a real name is used as
an identifier.
6.3.2.2 Identifier assigned to a non-person entity
Non-person entities, e.g. devices or other information objects, may have their activities identified and
recorded as for persons.
Device identifiers allow distinction between devices in the domain in which they operate.
NOTE 1 Example: The International Mobile Equipment Identity (IMEI) is an identifier of the mobile telephone
handset in the domain of GSM mobile telephone services.
NOTE 2 Example 2: The GSM SIM card number (ICCID) is a unique device identifier in the domain of a mobile
telephone service. A SIM card also contains other identifiers including that of the user who registered the SIM card.
Information object identifiers may also need to be distinguished in their domains. One of their attributes
of a combination of their attributes is usually used as identifier.
NOTE 3 Example: Process name, session name, path name, uniform resource names (URN),
uniform resource identifier (URI) are examples of information-object identifiers.
NOTE 4 Example: URI is an example of identifier for a location, but the object at that location
may change at any time.
6.3.3 Categorization of identifier by the nature of linking
6.3.3.1 Verinymous identifier
A verinymous identifier is an identifier, persistent in its domain of applicability that may be used within
and across domains and allows a relying party to obtain further identity information for the entity
associated with the identifier. Commonly observed verinimous identifiers includes email address,
mobile phone number, passport number, driving license number, social security number and the name-
date of birth pair.
A verynimous identifier may allow identity information for entities known in different domains to be
correlated. While it is fine to correlate the identities if so desired by the person, unexpected correlation,
e.g. profiling, has a negative privacy impact. By the nature of the veronymous identifier, if information
leakage incident happens, it allows adversaries to perform such correlation and create threats, e.g. of
generating any privacy-related information that the principal did not intend to disclose.
6.3.3.2 Pseudonymous identifier
A pseudonymous identifier is an identifier, persistent in its domain that does not disclose additional
identity information. As long as no other identifying information is available in the domain, identities
from different domain cannot be correlated using a pseudonymous identifier. A pseudonymous identifier
may be used to prevent unwanted correlation of identity information for entities across domains.
NOTE The mere use of pseudonymous identifiers does not equate with identity data being pseudonymous.
Other attributes combined at one point in time or across multiple points in time may be enough to derive
verinymous identifiers.
© ISO/IEC 2016 – All rights reserved 5
---------------------- Page: 13 ----------------------
oSIST prEN ISO/IEC 24760-3:2022
ISO/IEC 24760-3:2016(E)
6.3.3.3 Ephemeral identifier
An ephemeral identifier is an identifier that is used only for a short period of time and only within a
single domain. It may change for multiple uses to the same service or resource.
NOTE 1 If used correctly, an ephemeral identifier will make it very difficult for two visits by an entity to be
correlated.
NOTE 2 An ephemeral identifier is often used in the context of attribute based access control where access
to a resource is granted if the entity has a particular attribute. For example, if the resource access is granted
for a person because they are a member of a particular group, the identity would be composed of an ephemeral
identifier and a group identifier. These would serve the access control purpose while minimizing the data
disclosed or the possibility of linking multiple accesses, while still differentiating each entity.
6.3.4 Categorization of identifier by the grouping of entities
6.3.4.1 Individual identifier
An individual identifier is an identifier that is associated with only one entity within a domain of
applicability.
6.3.4.2 Group identifiers
Entities are sometimes grouped in a group entity when the need exists to execute activities in a group.
A distinct group identity will represent the gr
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.