CAIQ IAM-03: Identity inventory
By The Citesheet team · Published
Short answer
IAM-03 asks whether you manage, store and review information about system identities and their level of access: in practice, a list of who has which account and role, kept up to date and checked. A policy sentence that access requests and reviews are documented is the usual written proof. The strongest answer also names where the record lives, such as your identity provider or ticketing system.
What the control asks
IAM-03.1: Is system identity information, and the level of access each identity has, managed, stored and reviewed?
"System identities" means every account that can reach your systems: staff, contractors, service accounts and API keys. The question has three verbs, and a careful reviewer reads all three:
- managed: accounts are created and changed through a process, not ad hoc
- stored: there is a record of who has what
- reviewed: someone checks that record (the review itself is IAM-08)
Which policy usually proves it
The Access Control Policy, in the section on access requests and records. Many small companies have the practice (their identity provider is the inventory) but never wrote it down. One sentence fixes that: "Our identity provider is the system of record for all staff accounts and their group memberships."
Quoted evidence from public policies
GitLab covers "managed" and "stored" in two short lines:
Access requests are approved prior to making access changes.
Access requests and reviews are documented.
GitLab Handbook, Access Management Policy, CC BY-SA 4.0.
Tailscale describes where the record comes from (a ticket for each request):
Personnel that require access to systems must submit a ticket for review and approval by a manager or a member of the Security Team to provision access.
Tailscale, Access control policy, CC0.
Neither public policy names the inventory system itself. That detail usually sits in an internal standard; GitLab's policy links to an internal Access Management Standard for it.
How GitLab answered
Yes, citing its Access Management Policy, in its CAIQ v4.0.3 submission on the CSA STAR Registry.
A good answer, if your policy supports it
IAM-03.1: Yes. [Identity provider] is the system of record for staff accounts and group-based access. Every access change goes through an approved request in [ticketing tool], which records who asked, who approved and what changed. Access is reviewed [quarterly]. See Access Control Policy, sections 3 and 5.
Only include the review frequency if a document states it.
When N/A is honest
Not for a SaaS provider. Every service has identities. If customers manage their own users inside your product, that is their side of the shared responsibility model (the CAIQ's "CSC-owned" column), but your own staff and service accounts still count.
Where answers usually go wrong
- Forgetting non-human identities. API keys, CI tokens and service accounts are identities too. If your inventory covers people only, say so, or mark the answer Partially.
- Over-reading the evidence. "Access requests are documented" proves a record exists. It does not prove a complete inventory of every identity. Whether that is enough is a judgment call.
How Citesheet handled this one
This is a real judgment call, and our own test shows it. In our benchmark, Citesheet answered IAM-03.1 "Yes" from GitLab's policy where our label said "Partial". We then set a rule: standard policy wording counts as proof of that wording, while specific conditions (frequencies, "all", named systems) still need their own proof. Under that rule the label became "Yes". We show both, because a buyer's reviewer could reasonably read it either way.