Overview
EN ISO/IEC 29146:2026 defines a comprehensive framework for access management (AM) in information technology and information and communications technologies (ICT). Developed by CEN and based on ISO/IEC 29146:2024, this international standard establishes essential concepts, terms, and definitions relevant to the secure management of access to resources in distributed ICT environments. It outlines reference architectures, components, and management functions for access control in networked systems, focusing on logical rather than physical access. This standard supports accountability and proper administration of who (or what) can access information systems and under what conditions.
Key Topics
-
Access Management Framework: Sets out a unified structure for how access control is managed and enforced within ICT environments.
-
Logical Access Control: Emphasizes protecting data and IT systems through processes that ensure only authorized subjects (entities, users, or services) have access, leaving physical access controls out of scope.
-
Core Access Control Concepts:
- Authentication: Ensures that subjects are uniquely recognized before access is granted.
- Authorization: Determines whether a subject can access a particular resource, based on predefined policies.
- Access Control Policies: Rules and guidelines that enforce business and security requirements, based on identity, role, or attributes.
- Privileges and Roles: Define access rights and assign them based on necessity and organizational requirements.
-
Reference Architecture Components:
- Policy Administration Point (PAP): Manages the creation and update of access policies.
- Policy Decision Point (PDP): Evaluates requests and issues authorization decisions.
- Policy Enforcement Point (PEP): Enforces the PDP’s decisions at the resource.
- Policy Information Point (PIP): Supplies necessary attributes for decision-making.
-
Distributed Environments: Provides explanations and structures applicable to federated or networked environments where resources and users may span organizational boundaries.
-
Management Functions: Includes both operational (assigning and enforcing access privileges) and administrative (monitoring, record-keeping, and policy management) functions.
Applications
EN ISO/IEC 29146:2026 is applicable across industries and sectors that require rigorous control over access to ICT resources, including:
- Enterprise IT Systems: Centralizes and simplifies access management to internal applications, databases, and services, supporting security, compliance, and operational efficiency.
- Distributed Networks and Federated Systems: Enables consistent access control practices across organizational and technological boundaries, essential for multi-tenant cloud services and collaborative business environments.
- Identity & Access Management (IAM) Solutions: Provides a foundational reference for the design and implementation of IAM platforms, particularly those requiring interoperability or the integration of various access control models such as identity-based, role-based, and attribute-based access control.
- Compliance & Audit: Offers a standard framework for documenting, validating, and auditing how access decisions are made and enforced, supporting regulatory compliance and accountability.
- Policy Harmonization: Helps organizations reconcile differences in access control policies when integrating multiple systems or forming federations with other organizations.
Related Standards
- ISO/IEC 24760 Series: Framework for identity management, addressing how subjects are authenticated-a key prerequisite for access management.
- ISO/IEC 29115: Defines entity authentication assurance frameworks, complementing access management by specifying authentication strength and trust levels.
- General IT Security Standards: Including those covering information security management (e.g., ISO/IEC 27001), which often reference or build upon access management principles outlined in ISO/IEC 29146.
By providing a shared language and best practices for access management, EN ISO/IEC 29146:2026 supports secure, scalable, and interoperable solutions for organizations managing digital resource access in increasingly complex ICT environments. This standard is essential for organizations aiming to maintain robust information security and meet regulatory and business demands.