IAM

What is IAM?

IAM (Identity and Access Management) is the combination of processes, policies and technology an organisation uses to manage the digital identities of people, systems and devices and to decide who gets access to which resources, at what time and under which conditions. IAM covers two closely linked disciplines: identity management (IdM), which governs the lifecycle of an identity from creation to deletion, and access management, which determines what that identity is allowed to do. Together they form the foundation of security and cybersecurity, compliance and accountability in both IT and OT environments.

IAM answers three questions: who are you, what are you allowed to do, and how is that access controlled, monitored and revoked again.

🧠 Why is IAM important?

Stolen or misused credentials are one of the most common entry points for attackers. A well-known example is the 2021 ransomware attack on Colonial Pipeline: the attackers got in using the password of an old VPN account that was no longer in use but still worked and had no multi-factor authentication. With sound identity management, that account would have been removed long before.

🔄 What is the difference between identity management and access management?

The terms are often used interchangeably, but they describe different layers of the same framework:

IAM is the umbrella term: without reliable identities, access management has nothing to enforce, and without access management an identity has no meaning. Related terms such as access control usually refer to the technical enforcement point, for example a login prompt, a firewall rule or a door badge reader.

🔧 What are the components of IAM?

• Directory - central store of identities, such as Active Directory, Entra ID (Azure AD until 2023) or an LDAP directory
• Authentication - establishing who someone is, with a password, token, certificate or biometrics, preferably backed by MFA
• Authorisation - deciding what someone may do, based on roles (RBAC) or attributes and context (ABAC)
• Provisioning and deprovisioning - automatically creating and revoking accounts, linked to the HR system
• Federation and single sign-on - one identity for many applications through standards such as SAML and OpenID Connect
• Privileged Access Management (PAM) - extra protection, session recording and just-in-time rights for administrator accounts
• Access reviews (recertification) - managers periodically confirm that permissions are still appropriate
• Self-service - users reset their own password or request access through a portal with an approval step
• Logging and auditing - recording who did what and when, often forwarded to a SIEM and sometimes linked to SOAR, for example to block a suspicious account automatically

🔁 What does the lifecycle of an identity look like?

The lifecycle follows the joiner-mover-leaver model:

1. Joiner (create) - when someone starts, the HR system creates an identity and the IAM system automatically assigns the baseline roles for the job.
2. Mover (change) - when someone changes jobs, they gain new permissions and lose the old ones. The second half is often forgotten, which lets rights pile up (privilege creep).
3. Use and review - permissions are enforced per session and reviewed periodically on a need-to-know basis.
4. Leaver (revoke) - on departure, project closure or suspicious behaviour, accounts are disabled immediately and deleted later.

Non-human identities belong in this cycle too: service accounts, API keys, certificates and device identities. In OT, a typical example is the account a historian uses to read data from a SCADA server.

🏭 How do you apply IAM in OT environments?

In OT, identity management is often less mature than in IT. Many legacy systems only support local or shared accounts, default passwords and no link to a central directory. In the attack on the water authority of Aliquippa (USA) in late 2023, attackers abused an internet-facing Unitronics PLC/HMI on which the factory default password was still active.

Availability comes first in OT: an operator must never be locked out during an emergency because of an expired password or an unreachable directory server. Design controlled emergency accounts (break-glass) with strict logging, and make sure authentication keeps working locally if the connection to IT is lost.

🔐 Which standards and laws set IAM requirements?

• IEC 62443-3-3 - foundational requirement FR 1 (identification and authentication control) and FR 2 (use control). SR 1.1 requires all human users to be identified and authenticated. From security level 2 this must be unique per person (RE 1), from security level 3 multi-factor authentication is required for access via untrusted networks (RE 2), and at security level 4 for all networks (RE 3).
• ISO 27001:2022 - Annex A includes controls 5.15 (access control), 5.16 (identity management), 5.17 (authentication information), 5.18 (access rights), 8.2 (privileged access rights) and 8.5 (secure authentication).
• NIS2 - Article 21 explicitly lists access control policies and the use of multi-factor or continuous authentication as cybersecurity risk-management measures. In the Netherlands this is implemented through the Cyberbeveiligingswet (Cybersecurity Act), in force since 15 August 2026.
• BIO and AVG - require public bodies, and anyone processing personal data, to demonstrate control over who can reach which data.

Principles such as Security by Design, Zero Trust (re-evaluating every session) and a documented security policy provide the framework within which IAM is designed.

🛠 Which IAM solutions are commonly used?

• Microsoft Entra ID and Active Directory - the most common directories in office environments, often also used for OT domains
• Okta, OneLogin and Ping Identity (which absorbed ForgeRock in 2023) - cloud-based identity platforms with single sign-on and federation
• Keycloak - open-source identity provider for SSO and OpenID Connect
• CyberArk, BeyondTrust and comparable PAM solutions - for managing privileged accounts
• OT-specific remote access solutions - combine identity checks, per-session approval and recording for suppliers

📋 How do you implement IAM step by step?

1. Inventory all identities - people, service accounts, shared accounts and default accounts on devices; link this to your asset inventory or CMDB.
2. Connect a source of truth - let the HR system pass joiners and leavers on automatically.
3. Design a role model - for example operator, engineer, maintenance, supplier and administrator, each with the minimum rights needed.
4. Remove shared and default accounts, or put them under PAM control with password rotation.
5. Introduce MFA - first for remote access and administrator accounts, then more widely.
6. Log and monitor - send sign-in events to a SIEM and flag anomalies such as logins outside working hours or from unknown locations.
7. Review periodically - have managers confirm access rights at least annually, and privileged rights more often.
8. Rehearse the incident scenario - include account lockout and revoking compromised identities in the Incident Response Plan and in continuity management.

Record who decides on roles and exceptions in your governance, so that the process owner, not the system administrator, decides who gets access.

❓ Frequently asked questions

What is the difference between IAM and identity management?

Identity management governs the lifecycle of digital identities: creating, changing and deleting them. IAM (Identity and Access Management) is broader and also covers authentication, authorisation, privileged access and access monitoring. Identity management is therefore one part of IAM.

Why are shared accounts a problem in OT?

With a shared account it is impossible to establish which person performed an action, so incidents and mistakes cannot be traced. The password also tends to remain known to former staff and suppliers. IAM replaces shared accounts with personal accounts, or enforces traceable user switching on shared workstations.

Is MFA mandatory for OT access?

NIS2 and the Dutch Cyberbeveiligingswet list multi-factor or continuous authentication as a measure organisations must take where appropriate. IEC 62443-3-3 requires MFA for access via untrusted networks from security level 3. In practice, MFA for remote access to OT is the first priority within IAM.

What is privilege creep?

Privilege creep is the build-up of access rights when an employee changes roles and gains new permissions without losing the old ones. It is caused by a missing mover process in identity management. Periodic access reviews and role-based assignment within IAM prevent it.

Can an OT network use the same Active Directory domain as office IT?

It can, but it is generally discouraged: a compromised office domain would then also give attackers access to the production environment. A separate OT domain or a dedicated identity provider in the OT zone limits that impact. The IAM process itself can stay central, with one source of truth for joiners and leavers.

How can small organisations get started with IAM?

Start with an overview of all accounts, remove default and unused accounts, and introduce MFA for remote access. Then define a simple role model and link the joiner and leaver process to creating and revoking accounts. This way identity management delivers quick risk reduction without a large IAM platform.

📌 In summary

IAM combines identity management and access management into one controlled framework: every person, system and device has a unique identity, receives only the rights it needs, and loses those rights as soon as they are no longer needed. In OT this demands extra attention to shared accounts, suppliers, legacy equipment and availability, and standards such as IEC 62443, ISO 27001 and NIS2 make it a demonstrable obligation.

IAM ensures that the right identity has exactly the right access at the right time, and that every action in IT and OT can be traced to a single person or system.