Converged Security Framework - Identity and Access Management Standard

Identity and Access Management Standard. Board-approved standard, v2.0. Not a peer-reviewed Journal article. The purpose is accountable identity and access decisions, coordinated cross-domain lifecycle control and resilience, supported by lawful processing and verifiable evidence, expressed as outcome-based requirements rather than guarantees of eliminated vulnerability or specific business benefit. The adopter shall document organisational entities, users, workforce and external identities, service/workload identities, facilities, systems, resources, security domains and material identity dependencies. Scope shall distinguish human authentication, machine access and physical entry, and identify systems where identity controls cannot safely use a common implementation. Cloud, mobile, hybrid, voice/video/data integration and third-party access shall be addressed where present. An absent OT estate shall be explained, not invented. Joint ventures, vendors and downstream partners shall not be deemed wholly controlled simply because they access systems. Lawful agreements shall bound verification, information sharing, access rights, remediation and incident cooperation. The adopter shall identify binding legal, regulatory, contractual and scheme obligations by entity, jurisdiction, sector and processing activity. UK and EU GDPR, NIS2 implementing measures, DORA, eIDAS (including the amended European Digital Identity framework under Regulation (EU) 2024/1183 where applicable), phased CRA/AI Act provisions and relevant North American instruments shall each be assessed on their own terms and shall not be treated as universal equivalents of one another. NIST guidance is not automatically a statute or certification programme. Instruments such as FISMA, FICAM, CMMC/CUI requirements, HIPAA, state privacy and financial rules, and Canadian federal and provincial laws have distinct scopes and shall be verified for applicability rather than assumed. A "most restrictive" formula cannot resolve laws that differ in jurisdiction, object or actual conflict. Required changes shall meet binding effective dates; a post-effective-date allowance is not a grace period for unlawful non-compliance. Issued by Global Converged Security Board. The adopting organisation is responsible for implementation; publication does not itself confer accreditation or a credential.