Overview
EN ISO/IEC 24760-3:2022 (ISO/IEC 24760-3:2016) provides practical guidance for managing identity information and for ensuring that an identity management system (IMS) conforms with ISO/IEC 24760‑1 and ISO/IEC 24760‑2. It applies where identifiers or personally identifiable information (PII) about entities are acquired, processed, stored, transferred or used for identification, authentication or attribute-based decision making. The standard focuses on operational practices to mitigate identity-related risks, protect privacy and support secure identity lifecycle operations.
Key topics and technical requirements
- Risk assessment and mitigation - guidance on assessing identity-related risks and applying appropriate controls.
- Assurance in identity information - practices covering identity proofing, credential management, and assurance levels for identity data.
- Identity profiles and templates - definition and management of identity profiles built from attribute sets.
- Identifiers and PII management - classification, lifecycle control and policy considerations for identifiers (types, linking, grouping, management).
- Access policy for identity information - rules and controls for who can access identity data and under what conditions.
- Auditing identity information usage - logging and audit practices to track usage of identifiers and PII.
- Control objectives and controls - contextual and architectural control objectives for establishing, operating and controlling an IMS (including establishing identity information and managing identity information).
- Architectural and federation practices - normative annexes address federated identity management practices and use of attribute‑based credentials to enhance privacy.
Note: EN ISO/IEC 24760-3 is practice-focused guidance rather than prescriptive technical specifications; it references ISO/IEC 24760‑1 for terminology and concepts.
Applications and who should use it
- Identity and Access Management (IAM) teams - to design policies, assurance processes and lifecycle controls for identifiers and credentials.
- Security architects and system integrators - to align IMS architectures with recognized identity management practices.
- Privacy officers and compliance teams - to manage PII handling, privacy-preserving attributes and auditability.
- Service providers and federations - for interoperable identity federation and attribute-based credential deployments.
- Auditors and assessors - to evaluate IMS conformance against identity management frameworks.
Related standards
EN ISO/IEC 24760-3 is valuable for organizations implementing secure, privacy-aware identity management systems and for those aiming to demonstrate alignment with international identity management practices.