# CAIQ IAM-01: Identity and access management policy By The Citesheet team · Published October 20, 2026 Short answer IAM-01 asks two things: do you have a written identity and access management (IAM) policy that is approved, communicated and actually followed, and is it reviewed at least once a year? Your access control policy proves the first. The second needs its own proof, such as a review date, a version history or a sentence that says the policy is reviewed annually. IAM-01 is the first control in the Identity & Access Management domain of the [Cloud Controls Matrix](https://cloudsecurityalliance.org/ccm/) (CCM v4), and in the CAIQ it becomes two yes/no questions. It is about the policy itself, not about any single technical control. ## What the control asks * **IAM-01.1:** Are identity and access management policies and procedures "established, documented, approved, communicated, implemented, applied, evaluated, and maintained"? In plain English: is there a written access policy, did someone with authority approve it, do staff know about it, and is it followed? * **IAM-01.2:** Are those policies and procedures reviewed and updated at least annually? The wording is the same lifecycle list the CCM uses for every "policy and procedures" control (A&A-01, BCR-01, CEK-01 and so on), so if you can answer IAM-01 well, you have a pattern for the others. ## Which policy usually proves it * **IAM-01.1:** an _Access Control Policy_ or _Access Management Policy_. A security policy with a substantial access section also works. * **IAM-01.2:** whatever shows the review cycle. That might be a "Review" section in the policy, a document-control procedure that covers all policies, or a dated revision history. Buyers rarely ask for proof of each of the seven lifecycle words. A policy with an owner, an approver, a date and a scope is normally enough for IAM-01.1\. The annual review is different. "At least annually" is a specific claim, and it needs a specific sentence or record. ## Quoted evidence from public policies GitLab's public Access Management Policy states its rules as short, auditable sentences: > Access requests are opened for all new or changing access. > > _GitLab Handbook, [Access Management Policy](https://handbook.gitlab.com/handbook/security/security-and-technology-policies/access-management-policy/), CC BY-SA 4.0._ GitLab proves the annual review with a separate procedure that covers every controlled document, including that policy: > Controlled documents are required to be reviewed and approved on at least an annual basis. > > _GitLab Handbook, [Controlled Document Procedure](https://handbook.gitlab.com/handbook/security/controlled-document-procedure/), CC BY-SA 4.0._ Tailscale puts the review cycle inside the access policy itself: > Tailscale’s Security team is responsible for administering access to systems and reviewing and updating the Access Control process on an annual basis. > > _Tailscale, [Access control policy](https://tailscale.com/security-policies/access-control), CC0._ ## How GitLab answered In its CAIQ v4.0.3 self-assessment on the [CSA STAR Registry](https://cloudsecurityalliance.org/star/registry/services/gitlab), GitLab answered **Yes** to both IAM-01 questions and linked its Access Management Policy as the evidence for IAM-01.1. ## A good answer, if your policy supports it > **IAM-01.1: Yes.** Our Access Control Policy defines how access is requested, approved, changed and removed. It is approved by \[role\] and published to all staff. See Access Control Policy, sections 2–4. > > **IAM-01.2: Yes.** All security policies are reviewed at least annually by \[role\]; the last review was \[date\]. See Policy Management Procedure, "Review". Replace the brackets with what your documents actually say. If your policy has no review sentence and no revision history, the honest answer to IAM-01.2 is **No** (with a plan), not Yes. ## When N/A is honest Almost never. Every provider has staff and systems that need access rules, so "not applicable" reads as "we have no policy." If you have no written policy yet, answer **No** and describe what you do in practice. Our [guide to answering without SOC 2](https://citesheet.com/guides/security-questionnaire-without-soc-2/) has sample wording. ## Where answers usually go wrong * **Claiming the annual review without proof.** IAM-01.2 is where tools and people most often over-claim. A policy dated last month says nothing about whether it is reviewed every year. * **Pointing at a policy that defers everything.** GitLab's public policy points to an internal Access Management Standard for the details. That is fine for IAM-01, but it means the detailed controls (IAM-03 to IAM-10) need other evidence. ## How Citesheet handles it Citesheet answers IAM-01.1 from your access policy with the exact sentence quoted. If no sentence proves the annual review, IAM-01.2 should not inherit that Yes: a specific condition like "at least annually" needs its own proof, so the row goes to _Needs review_ or "No proof found" for a person to check. ## Sources 1. [Cloud Security Alliance: Cloud Controls Matrix (CCM)](https://cloudsecurityalliance.org/ccm/) (accessed October 20, 2026) 2. [CSA STAR Registry: GitLab.com (CAIQ v4.0.3 submission, 2025-03-25)](https://cloudsecurityalliance.org/star/registry/services/gitlab) (accessed October 20, 2026) 3. [GitLab Handbook: Access Management Policy (CC BY-SA 4.0)](https://handbook.gitlab.com/handbook/security/security-and-technology-policies/access-management-policy/) (accessed October 20, 2026) 4. [GitLab Handbook: Controlled Document Procedure (CC BY-SA 4.0)](https://handbook.gitlab.com/handbook/security/controlled-document-procedure/) (accessed October 20, 2026) 5. [Tailscale security policies: Access control policy (CC0)](https://tailscale.com/security-policies/access-control) (accessed October 20, 2026) ## Related * [CAIQ IAM-02: Strong password policyWhat CAIQ v4 control IAM-02 asks about password policy, which document proves it, quoted examples from GitLab, Tailscale and PostHog, and common gaps.](https://citesheet.com/caiq/iam-02-strong-password-policy/) * [CAIQ IAM-08: User access reviewCAIQ v4 control IAM-08 asks whether you regularly re-check who has access. What proves it, why the frequency matters, quoted examples, and sample answers.](https://citesheet.com/caiq/iam-08-user-access-review/) * [CAIQ questionnaire automationFill the CSA's CAIQ in Excel from your own policies. Every answer has a word-for-word quote, and questions without proof say "No proof found".](https://citesheet.com/caiq-questionnaire-automation/) * [What is the CAIQ?The CAIQ is the Cloud Security Alliance's yes/no security questionnaire for cloud and SaaS providers. What it covers, its versions, and where you'll meet it.](https://citesheet.com/glossary/caiq/) ## Send one questionnaire. See the proof. First questionnaire free. Same-day turnaround. Tell us where to send it back and we'll reply with next steps. Send your first questionnaire free Takes about 15 seconds. Or email [hello@citesheet.com](mailto:hello@citesheet.com). Need an NDA first? Ask, and we'll sign before you send anything.