CAIQ IAM-01: Identity and access management policy

IAM-01 is the first control in the Identity & Access Management domain of the Cloud Controls Matrix (CCM v4), and in the CAIQ it becomes two yes/no questions. It is about the policy itself, not about any single technical control.

What the control asks

• IAM-01.1: Are identity and access management policies and procedures "established, documented, approved, communicated, implemented, applied, evaluated, and maintained"? In plain English: is there a written access policy, did someone with authority approve it, do staff know about it, and is it followed?
• IAM-01.2: Are those policies and procedures reviewed and updated at least annually?

The wording is the same lifecycle list the CCM uses for every "policy and procedures" control (A&A-01, BCR-01, CEK-01 and so on), so if you can answer IAM-01 well, you have a pattern for the others.

Which policy usually proves it

• IAM-01.1: an Access Control Policy or Access Management Policy. A security policy with a substantial access section also works.
• IAM-01.2: whatever shows the review cycle. That might be a "Review" section in the policy, a document-control procedure that covers all policies, or a dated revision history.

Buyers rarely ask for proof of each of the seven lifecycle words. A policy with an owner, an approver, a date and a scope is normally enough for IAM-01.1. The annual review is different. "At least annually" is a specific claim, and it needs a specific sentence or record.

Quoted evidence from public policies

GitLab's public Access Management Policy states its rules as short, auditable sentences:

Access requests are opened for all new or changing access.

GitLab Handbook, Access Management Policy, CC BY-SA 4.0.

GitLab proves the annual review with a separate procedure that covers every controlled document, including that policy:

Controlled documents are required to be reviewed and approved on at least an annual basis.

GitLab Handbook, Controlled Document Procedure, CC BY-SA 4.0.

Tailscale puts the review cycle inside the access policy itself:

Tailscale’s Security team is responsible for administering access to systems and reviewing and updating the Access Control process on an annual basis.

Tailscale, Access control policy, CC0.

How GitLab answered

In its CAIQ v4.0.3 self-assessment on the CSA STAR Registry, GitLab answered Yes to both IAM-01 questions and linked its Access Management Policy as the evidence for IAM-01.1.

A good answer, if your policy supports it

IAM-01.1: Yes. Our Access Control Policy defines how access is requested, approved, changed and removed. It is approved by [role] and published to all staff. See Access Control Policy, sections 2–4.

IAM-01.2: Yes. All security policies are reviewed at least annually by [role]; the last review was [date]. See Policy Management Procedure, "Review".

Replace the brackets with what your documents actually say. If your policy has no review sentence and no revision history, the honest answer to IAM-01.2 is No (with a plan), not Yes.

When N/A is honest

Almost never. Every provider has staff and systems that need access rules, so "not applicable" reads as "we have no policy." If you have no written policy yet, answer No and describe what you do in practice. Our guide to answering without SOC 2 has sample wording.

Where answers usually go wrong

• Claiming the annual review without proof. IAM-01.2 is where tools and people most often over-claim. A policy dated last month says nothing about whether it is reviewed every year.
• Pointing at a policy that defers everything. GitLab's public policy points to an internal Access Management Standard for the details. That is fine for IAM-01, but it means the detailed controls (IAM-03 to IAM-10) need other evidence.

How Citesheet handles it

Citesheet answers IAM-01.1 from your access policy with the exact sentence quoted. If no sentence proves the annual review, IAM-01.2 should not inherit that Yes: a specific condition like "at least annually" needs its own proof, so the row goes to Needs review or "No proof found" for a person to check.