ISO/IEC 24760-2:2025 PDF

Overview

ISO/IEC 24760-2:2025 - "Information security, cybersecurity and privacy protection - A framework for identity management - Part 2: Reference architecture and requirements" defines a reference architecture and implementation requirements for identity management. As a horizontal standard it applies to any information system that processes or stores identity information and provides a common foundation for other identity, privacy and security standards. The 2025 second edition updates the 2015 version and adds coverage of emerging concepts such as mobile identity and the principal’s private IMS (PPI).

Key topics and technical requirements

This standard describes architecture, stakeholders, actors, processes and technical requirements for managing identity information:

• Reference architecture and deployment scenarios
  • Enterprise/internal identity models and architectures for external identities (including federated and service deployment scenarios).
• Stakeholders and actors
  • Principals, identity management authority, identity information authority, relying parties, verifiers, auditors, regulators and consumer/citizen advocates.
• Processes, services and use cases
  • Identity registration, lifecycle management, verification, provisioning, auditing and additional identity functions.
• Components and physical model
  • Identity registers, identity information providers, interfaces and component models to support interoperable implementations.
• Functional requirements
  • Policy for identity information lifecycle, conditions and procedures to maintain identity information, identity information interfaces, reference identifiers, and identity information quality and compliance.
• Non-functional requirements
  • Availability, confidentiality, integrity, privacy-friendliness, archiving, termination and secure deletion of identity information.
• Governance and compliance
  • Guidance to assess privacy-friendliness and assurance of identity attributes across implementations.

Practical applications and who benefits

ISO/IEC 24760-2:2025 is intended for organizations and professionals implementing or assessing identity management systems:

• IAM architects and engineers designing identity stores, identity providers, federated authentication and SSO.
• Security and cybersecurity teams enforcing identity-related controls and non-functional security requirements.
• Privacy officers and data protection teams evaluating privacy-friendliness and lifecycle controls for identity data.
• Auditors and regulators assessing compliance, governance and assurance of identity attributes.
• Software vendors and cloud service providers building identity management solutions, mobile identity services (PPI), or identity-as-a-service offerings.
• Enterprises and government agencies that manage employee, citizen or customer identities.

Related standards

• ISO/IEC 24760 series (see Part 1 for concepts and terminology)
• ISO/IEC SC 27 work on information security, cybersecurity and privacy protection

ISO/IEC 24760-2:2025 is a practical, standards-based blueprint for designing privacy-aware, interoperable and secure identity management frameworks usable across sectors and deployment scenarios.