iTeh StandardsiTeh Standards
EURUSD
Your shopping cart is empty.
ISO

ISO/IEC 24760-2:2025

(Main)

Information security, cybersecurity and privacy protection — A framework for identity management — Part 2: Reference architecture and requirements

Information security, cybersecurity and privacy protection — A framework for identity management — Part 2: Reference architecture and requirements

This document: — provides guidelines for the implementation of systems for the management of identity information; — specifies requirements for the implementation and operation of a framework for identity management; — is applicable to any information system where information relating to identity is processed or stored; — is considered to be a horizontal document for the following reasons: ¾ it applies concepts such as distinguishing the term “identity” from the term “identifier” on the implementation of systems for the management of identity information and on the requirements for the implementation and operation of a framework for identity management, ¾ it provides an important contribution to assess identity management systems with regard to their privacy-friendliness and their ability to assure the relevant attributes of an identity, and consequently it provides a foundation and a common understanding for any other standard addressing identity, identity information, and identity management.

Sécurité de l'information, cybersécurité et protection de la vie privée — Cadre pour la gestion de l'identité — Partie 2: Architecture de référence et exigences

General Information

Status
Published
Publication Date
15-Sep-2025
ICS
35.030 - IT Security
Technical Committee
ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
Drafting Committee
ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
Current Stage
6060 - International Standard published
Start Date
16-Sep-2025
Due Date
19-Jul-2024
Completion Date
16-Sep-2025
Ref Project

Relations

Revises
ISO/IEC 24760-2:2015 - Information technology — Security techniques — A framework for identity management — Part 2: Reference architecture and requirements
Effective Date
06-Jun-2022
ISO/IEC 24760-2:2025 - Information security, cybersecurity and privacy protection — A framework for identity management — Part 2: Reference architecture and requirements Released:16. 09. 2025ISO/IEC 24760-2:2025 - Information security, cybersecurity and privacy protection — A framework for identity management — Part 2: Reference architecture and requirements Released:16. 09. 2025
PreviousNext
Standard
ISO/IEC 24760-2:2025 - Information security, cybersecurity and privacy protection — A framework for identity management — Part 2: Reference architecture and requirements Released:16. 09. 2025
English language
46 pages
sale 15% off
Preview
sale 15% off
Preview

Standards Content (Sample)


International
Standard
ISO/IEC 24760-2
Second edition
Information security, cybersecurity
2025-09
and privacy protection —
A framework for identity
management —
Part 2:
Reference architecture and
requirements
Sécurité de l'information, cybersécurité et protection de la vie
privée — Cadre pour la gestion de l'identité —
Partie 2: Architecture de référence et exigences
Horizontal document
Reference number
© ISO/IEC 2025
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2025 – All rights reserved
ii
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Symbols and abbreviated terms. 3
5 Reference architecture . 3
5.1 General .3
5.2 Deployment scenarios .3
5.3 Stakeholders .4
5.3.1 General .4
5.3.2 Principal .5
5.3.3 Identity management authority .5
5.3.4 Identity information authority .6
5.3.5 Relying party .6
5.3.6 Regulatory body .6
5.3.7 Consumer/citizen representative or advocate .6
5.4 Actors .7
5.4.1 General .7
5.4.2 Principal .8
5.4.3 Identity management authority .8
5.4.4 Identity registration authority .9
5.4.5 Relying party .10
5.4.6 Identity information authority .10
5.4.7 Identity information provider .11
5.4.8 Verifier . 12
5.4.9 Auditor . 13
5.5 Processes and services . 13
5.5.1 Documentation. 13
5.5.2 Identity information management processes .14
5.5.3 Specific identity information management processes . 15
5.5.4 Additional functions . .17
5.6 Viewpoints . 20
5.6.1 General . 20
5.6.2 Context viewpoint . 20
5.6.3 Functional viewpoint . 20
5.7 Use cases .21
5.7.1 General .21
5.7.2 Principal use cases . 22
5.8 Components . 23
5.8.1 General . 23
5.8.2 Principal . 23
5.8.3 Identity register . 23
5.9 Compliance and governance .24
5.10 Physical model .24
6 Architecture for managing internal identities, the enterprise model .24
6.1 Context .24
6.2 Stakeholders and concerns . 25
6.3 The enterprise deployment scenario . 26
6.4 Use cases . 26
6.4.1 Employee use cases . 26
6.4.2 Employer use cases .27

© ISO/IEC 2025 – All rights reserved
iii
7 Architecture for managing external identities .27
7.1 Context .27
7.2 Stakeholders and concerns .27
7.3 Deployment scenarios with external identities . 29
7.3.1 The federated deployment scenario . 29
7.3.2 The service deployment scenario . 29
7.3.3 The federated deployment scenario as applied as a service . 29
7.4 Use cases . 29
7.4.1 Device use cases . 29
7.4.2 Sharing use cases . 29
8 Requirements for the management of identity information .30
8.1 General . 30
8.2 Access policy for identity information . 30
8.3 Functional requirements for management of identity information . 30
8.3.1 Policy for identity information lifecycle . 30
8.3.2 Conditions and procedure to maintain identity information .31
8.3.3 Identity information interface .
...

Questions, Comments and Discussion

Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.

This May Also Interest You

ISO
ISO/IEC TS 27564:2025(Main)
Privacy protection — Guidance on the use of models for privacy engineering

This document provides guidance on how to use modelling in privacy engineering. It describes categories of models that can be used, the use of modelling to support engineering, and the relationships with other references, including International Standards on privacy engineering and on modelling. It provides high-level use cases describing how models are used.

  • Technical specification
    32 pages
    English language
    sale 15% off
ISO
ISO/IEC 24760-3:2025(Main)
Information security, cybersecurity and privacy protection — A framework for identity management — Part 3: Practice

This document: — provides requirements and guidance for the management of identity information and for ensuring that an identity management system conforms to ISO/IEC 24760-1 and ISO/IEC 24760-2; — is applicable to any information system where information relating to identity is processed or stored; — is considered to be a horizontal document for the following reasons: — it applies concepts such as distinguishing the term “identity” from the term “identifier” on the implementation of systems for the management of identity information and on the requirements for the implementation and operation of a framework for identity management, — it provides an important contribution to assess identity management systems with regard to their privacy-friendliness and their ability to assure the relevant attributes of an identity, and consequently it provides a foundation and a common understanding for any other standard addressing identity, identity information, and identity management.

  • Standard
    31 pages
    English language
    sale 15% off
ISO
ISO/IEC 24760-1:2025(Main)
Information security, cybersecurity and privacy protection — A framework for identity management — Part 1: Core concepts and terminology

This document: — defines terms for identity management and specifies core concepts of identity and identity management, and their relationships; — is applicable to any information system where information relating to identity is processed or stored; — is considered to be a horizontal document for the following reasons: ¾ it applies concepts such as distinguishing the term “identity” from the term “identifier” on the implementation of systems for the management of identity information and on the requirements for the implementation and operation of a framework for identity management, ¾ it provides an important contribution to assess identity management systems with regard to their privacy-friendliness and their ability to assure the relevant attributes of an identity, and consequently it provides a foundation and a common understanding for any other standard addressing identity, identity information, and identity management.

  • Standard
    23 pages
    English language
    sale 15% off
ISO
ISO/IEC 27018:2025(Main)
Information security, cybersecurity and privacy protection — Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors

This document establishes commonly accepted control objectives, controls and guidelines for implementing measures to protect personally identifiable information (PII) in line with the privacy principles in ISO/IEC 29100 for the public cloud computing environment. In particular, this document specifies guidelines based on ISO/IEC 27002:2022, taking into consideration the regulatory requirements for the protection of PII which can be applicable within the context of the information security risk environment(s) of a provider of public cloud services. This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations, which provide information processing services as PII processors via cloud computing under contract to other organizations. The guidelines in this document can also be relevant to organizations acting as PII controllers.

  • Standard
    35 pages
    English language
    sale 15% off
ISO
ISO/IEC 27553-2:2025(Main)
Information security, cybersecurity and privacy protection — Security and privacy requirements for authentication using biometrics on mobile devices — Part 2: Remote modes

This document provides high-level security and privacy requirements for authentication using biometrics on mobile devices, in particular, for functional components, communication, storage and remote processing. This document is applicable to remote modes, i.e. the cases where: — the biometric sample is captured through mobile devices, and — the biometric data or derived biometric data are transmitted between the mobile devices and the remote services in either or both directions. The following are out of scope of this document: — the cases where the biometric data or derived biometric data never leave the mobile devices (i.e. local modes), — the preliminary steps for biometric enrolment before authentication procedure, and — the use of biometric identification as part of the authentication.

  • Standard
    39 pages
    English language
    sale 15% off
ISO
ISO/IEC 19792:2025(Main)
Information security, cybersecurity and privacy protection — General principles, requirements and guidance for security evaluation of biometric systems

This document specifies general principles, requirements and guidance for a security evaluation of a biometric system. This document provides an overview of the main biometric-specific aspects, i.e. recognition performance, presentation attack detection and privacy, and specifies principles to consider for the security evaluation of a biometric system. This document does not address the non-biometric aspects which can form part of the overall security evaluation of a system using biometric technology (e.g. requirements on databases or communication channels).

  • Standard
    25 pages
    English language
    sale 15% off
ISO
ISO/IEC 18014-1:2008/Amd 1:2025(Amendment)
Information technology — Security techniques — Time-stamping services — Part 1: Framework — Amendment 1
  • Standard
    2 pages
    English language
    sale 15% off
ISO
ISO/IEC TS 20540:2025(Main)
Information security, cybersecurity and privacy protection — Testing cryptographic modules in their field

This document provides recommendations, requirements and checklists which can be used to support the specification and field testing of cryptographic modules in their field within an organization’s security system. The cryptographic modules have an overall security rating commensurate with the four security levels defined in ISO/IEC 19790:2025, to provide for: — a wide spectrum of data sensitivity (e.g. low-value administrative data, million-dollar funds transfers, life-protecting data, personal identity information, and sensitive information used by government), and — a diversity of application environments (e.g. a guarded facility, an office, removable media, and a completely unprotected location). This document is limited to the security related to the cryptographic module. It does not include assessing the security of the field or application environment. It does not define techniques for the identification, assessment and acceptance of the organization’s operational risk. This document applies to the field testers who perform the field testing for the cryptographic modules in their field and the authorizing officials of cryptographic modules.

  • Technical specification
    44 pages
    English language
    sale 15% off
ISO
ISO/IEC 27031:2025(Main)
Cybersecurity — Information and communication technology readiness for business continuity

This document describes the concepts and principles of information and communication technology (ICT) readiness for business continuity (IRBC). It provides a framework of methods and processes to identify and specify aspects for improving an organization's ICT readiness to ensure business continuity. This document serves the following business continuity objectives for ICT: — minimum business continuity objective (MBCO), — recovery point objective (RPO), — recovery time objective (RTO) as part of the ICT business continuity planning. This document is applicable to all types and sizes of organizations. This document describes how ICT departments plan and prepare to contribute to the resilience objectives of the organization.

  • Standard
    33 pages
    English language
    sale 15% off
  • Standard
    35 pages
    French language
    sale 15% off
  • Standard
    35 pages
    French language
    sale 15% off
ISO
ISO/IEC 11770-3:2021/Amd 1:2025(Amendment)
Information security — Key management — Part 3: Mechanisms using asymmetric techniques — Amendment 1: TFNS identity-based key agreement
  • Standard
    2 pages
    English language
    sale 15% off