TechKnowSurge
NIST 800-53 AC-2 ISC2 CISSP 5.5 CompTIA Security+ 4.6 NIST CSF PR.AA-01
TechKnowSurge Catalog Videos Identity and Access Management (IAM)
VideoSecurityFree

Identity and Access Management (IAM)

Identity and access management (IAM) is a critical cybersecurity discipline covering account provisioning, maintenance, and de-provisioning — yet most IT departments operate at only about 60% of where they should be. Understanding the full IAM lifecycle and keeping processes well documented is essential to reducing organizational risk.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Identity and access management sits at the core of both IT operations and cybersecurity, making it one of the highest-priority disciplines for any organization to get right. Despite its importance, most IT departments operate at only around 60% of where they should be in terms of IAM maturity, leaving significant gaps that can expose the organization to unnecessary risk. The IAM lifecycle can be understood across three key phases: provisioning, ongoing maintenance and change management, and de-provisioning. Each phase carries its own risks and operational requirements, and failures at any point can create vulnerabilities. Change management in particular is consistently one of the weakest areas observed across IT environments, meaning accounts and access rights often go unreviewed or unrevoked long after circumstances change. Strong IAM practice requires that every process across the lifecycle be clearly defined, consistently followed, and thoroughly documented. Treating IAM with the same rigor applied to other critical IT functions is not optional — it is a foundational requirement for maintaining security, meeting compliance obligations, and protecting organizational assets.

What you'll learn

What's covered

Identity & Access Management

Aligned to

NIST 800-53
AC-2 Account Management
ISC2 CISSP
5.5 Manage the identity and access provisioning lifecycle
CompTIA Security+
4.6 Given a scenario, implement and maintain identity and access management.
NIST CSF
PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization.

Key terms

Identity and Access Management
IAM
A framework of policies and technologies that ensures the right users have appropriate access to resources.
Provisioning
The process of creating and configuring user accounts and granting appropriate access rights when a user joins or changes roles in an organization.
De-provisioning
The process of revoking and removing a user's access rights and accounts when they leave an organization or no longer require access.
Change Management
A structured process for requesting, reviewing, approving, and documenting changes to IT systems or organizational procedures. Change management reduces security risk by ensuring modifications are tested and authorized before deployment.
Access Control
A security mechanism that restricts access to resources based on policies, roles, or identity.

Topics

Identity And Access Management Account Lifecycle Account Provisioning Account Deprovisioning Cybersecurity Access Control

Transcript

Identity and access management is a huge part of the IT department and cyber security, so it's really important to get this correct.

This is a huge topic and I can't go into all the different facets of identity and access management. I will say that this is a huge part of cyber security, and because it is so critical, I find that most IT departments are at least doing 60% of what they should to make sure that they're doing identity and access management correctly. Probably one of the weakest areas that I see is around change management.

We just have to think about it from an account perspective: there's this provisioning, maintaining, change management and de-provisioning that happens, and we need to evaluate our processes and make sure that we have it well documented, just like any of these other functions that we've talked about.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →