iTeh StandardsiTeh Standards
EURUSD
Your shopping cart is empty.
ISO

ISO/IEC 24760-3:2016/Amd 1:2023

(Amendment)

Information technology — Security techniques — A framework for identity management — Part 3: Practice — Amendment 1: Identity Information Lifecycle processes

Information technology — Security techniques — A framework for identity management — Part 3: Practice — Amendment 1: Identity Information Lifecycle processes

Technologies de l'information — Techniques de sécurité — Cadre pour la gestion de l'identité — Partie 3: Mise en oeuvre — Amendement 1: Titre manque

General Information

Status
Published
Publication Date
30-Jan-2023
ICS
35.030 - IT Security
Technical Committee
ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
Drafting Committee
ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
Current Stage
9599 - Withdrawal of International Standard
Start Date
16-Sep-2025
Completion Date
20-Sep-2025
Ref Project

Relations

Amends
ISO/IEC 24760-3:2016 - Information technology — Security techniques — A framework for identity management — Part 3: Practice
Effective Date
06-Jun-2022
Revised
ISO/IEC 24760-3:2025 - Information security, cybersecurity and privacy protection — A framework for identity management — Part 3: Practice
Effective Date
22-Jul-2023
ISO/IEC 24760-3:2016/Amd 1:2023 - Information technology — Security techniques — A framework for identity management — Part 3: Practice — Amendment 1: Identity Information Lifecycle processes Released:1/31/2023ISO/IEC 24760-3:2016/Amd 1:2023 - Information technology — Security techniques — A framework for identity management — Part 3: Practice — Amendment 1: Identity Information Lifecycle processes Released:1/31/2023
PreviousNext
Standard
ISO/IEC 24760-3:2016/Amd 1:2023 - Information technology — Security techniques — A framework for identity management — Part 3: Practice — Amendment 1: Identity Information Lifecycle processes Released:1/31/2023
English language
3 pages
sale 15% off
Preview
sale 15% off
Preview

Standards Content (Sample)


INTERNATIONAL ISO/IEC
STANDARD 24760-3
First edition
2016-08-01
AMENDMENT 1
2023-01
Information technology — Security
techniques — A framework for
identity management —
Part 3:
Practice
AMENDMENT 1: Identity Information
Lifecycle processes
Reference number
ISO/IEC 24760-3:2016/Amd. 1:2023(E)
© ISO/IEC 2023
ISO/IEC 24760-3:2016/Amd. 1:2023(E)
© ISO/IEC 2023
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
© ISO/IEC 2023 – All rights reserved

ISO/IEC 24760-3:2016/Amd. 1:2023(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work.
The procedures used to develop this document and those intended for its further maintenance
are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria
needed for the different types of document should be noted. This document was drafted in
accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives or
www.iec.ch/members_experts/refdocs).
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents) or the IEC
list of patent declarations received (see https://patents.iec.ch).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to
the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see
www.iso.org/iso/foreword.html. In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, Information security, cybersecurity and privacy protection.
A list of all parts in the ISO/IEC 24760 series can be found on the ISO and IEC websites.
Any feedback or questions on this document should be directed to the user’s national standards
body. A complete listing of these bodies can be found at www.iso.org/members.html and
www.iec.ch/national-committees.
iii
© ISO/IEC 2023 – All rights reserved

ISO/IEC 24760-3:2016/Amd. 1:2023(E)
Information technology — Security techniques — A
framework for identity management —
Part 3:
Practice
AMENDMENT 1: Identity Information Lifecycle processes
Clause 3
Delete 3.1 and 3.6.
5.1
Remove the reference to ISO/IEC 29115 so the text reads as follows:
Clause 5 presents practices to address identity related risk when operating an identity management
system conforming to ISO/IEC 24760-1 and ISO/IEC 24760-2.

Add the following text and figure below the first paragraph:
Figure 1 shows the operational scope of an identity management system. The arrows in the figure
identify processes that affect the recorded identity information. Details of these processes are
presented in ISO/IEC 24760-1:2019, Clause 7. These processes are the prime areas of concern in
assessing risks in the implementation of an identity management system.
NOTE ISO/IEC 24760-1: 2019, Figure 1 shows that when an identity is registered, it can be in different
stages: established, active, suspended or archived. Authentication of an entity typically can only be
successful if its identity is active.

Figure 1 — Operational scope of an identity management system
5.2
Replace the first paragraph with the following:
© ISO/IEC 2023 – All rights reserved

ISO/IEC 24760-3:2016/Amd. 1:2023(E)
A function of an identity management system is managing identity as data; secure operation of
this data management system involves managing the risk of identity errors while
...

Questions, Comments and Discussion

Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.

This May Also Interest You

ISO
ISO/IEC TS 27564:2025(Main)
Privacy protection — Guidance on the use of models for privacy engineering

This document provides guidance on how to use modelling in privacy engineering. It describes categories of models that can be used, the use of modelling to support engineering, and the relationships with other references, including International Standards on privacy engineering and on modelling. It provides high-level use cases describing how models are used.

  • Technical specification
    32 pages
    English language
    sale 15% off
ISO
ISO/IEC 24760-2:2025(Main)
Information security, cybersecurity and privacy protection — A framework for identity management — Part 2: Reference architecture and requirements

This document: — provides guidelines for the implementation of systems for the management of identity information; — specifies requirements for the implementation and operation of a framework for identity management; — is applicable to any information system where information relating to identity is processed or stored; — is considered to be a horizontal document for the following reasons: ¾ it applies concepts such as distinguishing the term “identity” from the term “identifier” on the implementation of systems for the management of identity information and on the requirements for the implementation and operation of a framework for identity management, ¾ it provides an important contribution to assess identity management systems with regard to their privacy-friendliness and their ability to assure the relevant attributes of an identity, and consequently it provides a foundation and a common understanding for any other standard addressing identity, identity information, and identity management.

  • Standard
    46 pages
    English language
    sale 15% off
ISO
ISO/IEC 24760-3:2025(Main)
Information security, cybersecurity and privacy protection — A framework for identity management — Part 3: Practice

This document: — provides requirements and guidance for the management of identity information and for ensuring that an identity management system conforms to ISO/IEC 24760-1 and ISO/IEC 24760-2; — is applicable to any information system where information relating to identity is processed or stored; — is considered to be a horizontal document for the following reasons: — it applies concepts such as distinguishing the term “identity” from the term “identifier” on the implementation of systems for the management of identity information and on the requirements for the implementation and operation of a framework for identity management, — it provides an important contribution to assess identity management systems with regard to their privacy-friendliness and their ability to assure the relevant attributes of an identity, and consequently it provides a foundation and a common understanding for any other standard addressing identity, identity information, and identity management.

  • Standard
    31 pages
    English language
    sale 15% off
ISO
ISO/IEC 24760-1:2025(Main)
Information security, cybersecurity and privacy protection — A framework for identity management — Part 1: Core concepts and terminology

This document: — defines terms for identity management and specifies core concepts of identity and identity management, and their relationships; — is applicable to any information system where information relating to identity is processed or stored; — is considered to be a horizontal document for the following reasons: ¾ it applies concepts such as distinguishing the term “identity” from the term “identifier” on the implementation of systems for the management of identity information and on the requirements for the implementation and operation of a framework for identity management, ¾ it provides an important contribution to assess identity management systems with regard to their privacy-friendliness and their ability to assure the relevant attributes of an identity, and consequently it provides a foundation and a common understanding for any other standard addressing identity, identity information, and identity management.

  • Standard
    23 pages
    English language
    sale 15% off
ISO
ISO/IEC 27018:2025(Main)
Information security, cybersecurity and privacy protection — Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors

This document establishes commonly accepted control objectives, controls and guidelines for implementing measures to protect personally identifiable information (PII) in line with the privacy principles in ISO/IEC 29100 for the public cloud computing environment. In particular, this document specifies guidelines based on ISO/IEC 27002:2022, taking into consideration the regulatory requirements for the protection of PII which can be applicable within the context of the information security risk environment(s) of a provider of public cloud services. This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations, which provide information processing services as PII processors via cloud computing under contract to other organizations. The guidelines in this document can also be relevant to organizations acting as PII controllers.

  • Standard
    35 pages
    English language
    sale 15% off
ISO
ISO/IEC 27553-2:2025(Main)
Information security, cybersecurity and privacy protection — Security and privacy requirements for authentication using biometrics on mobile devices — Part 2: Remote modes

This document provides high-level security and privacy requirements for authentication using biometrics on mobile devices, in particular, for functional components, communication, storage and remote processing. This document is applicable to remote modes, i.e. the cases where: — the biometric sample is captured through mobile devices, and — the biometric data or derived biometric data are transmitted between the mobile devices and the remote services in either or both directions. The following are out of scope of this document: — the cases where the biometric data or derived biometric data never leave the mobile devices (i.e. local modes), — the preliminary steps for biometric enrolment before authentication procedure, and — the use of biometric identification as part of the authentication.

  • Standard
    39 pages
    English language
    sale 15% off
ISO
ISO/IEC 19792:2025(Main)
Information security, cybersecurity and privacy protection — General principles, requirements and guidance for security evaluation of biometric systems

This document specifies general principles, requirements and guidance for a security evaluation of a biometric system. This document provides an overview of the main biometric-specific aspects, i.e. recognition performance, presentation attack detection and privacy, and specifies principles to consider for the security evaluation of a biometric system. This document does not address the non-biometric aspects which can form part of the overall security evaluation of a system using biometric technology (e.g. requirements on databases or communication channels).

  • Standard
    25 pages
    English language
    sale 15% off
ISO
ISO/IEC 18014-1:2008/Amd 1:2025(Amendment)
Information technology — Security techniques — Time-stamping services — Part 1: Framework — Amendment 1
  • Standard
    2 pages
    English language
    sale 15% off
ISO
ISO/IEC TS 20540:2025(Main)
Information security, cybersecurity and privacy protection — Testing cryptographic modules in their field

This document provides recommendations, requirements and checklists which can be used to support the specification and field testing of cryptographic modules in their field within an organization’s security system. The cryptographic modules have an overall security rating commensurate with the four security levels defined in ISO/IEC 19790:2025, to provide for: — a wide spectrum of data sensitivity (e.g. low-value administrative data, million-dollar funds transfers, life-protecting data, personal identity information, and sensitive information used by government), and — a diversity of application environments (e.g. a guarded facility, an office, removable media, and a completely unprotected location). This document is limited to the security related to the cryptographic module. It does not include assessing the security of the field or application environment. It does not define techniques for the identification, assessment and acceptance of the organization’s operational risk. This document applies to the field testers who perform the field testing for the cryptographic modules in their field and the authorizing officials of cryptographic modules.

  • Technical specification
    44 pages
    English language
    sale 15% off
ISO
ISO/IEC 27031:2025(Main)
Cybersecurity — Information and communication technology readiness for business continuity

This document describes the concepts and principles of information and communication technology (ICT) readiness for business continuity (IRBC). It provides a framework of methods and processes to identify and specify aspects for improving an organization's ICT readiness to ensure business continuity. This document serves the following business continuity objectives for ICT: — minimum business continuity objective (MBCO), — recovery point objective (RPO), — recovery time objective (RTO) as part of the ICT business continuity planning. This document is applicable to all types and sizes of organizations. This document describes how ICT departments plan and prepare to contribute to the resilience objectives of the organization.

  • Standard
    33 pages
    English language
    sale 15% off
  • Standard
    35 pages
    French language
    sale 15% off
  • Standard
    35 pages
    French language
    sale 15% off