CISSP IAM Concepts
Dr. Abeer Alshammari · Published 7/29/2026
Identity and Access Management (IAM) governs who can access what, and how that access is proven, granted, and eventually revoked. It is one of the most operationally hands-on domains, but the exam tests it at the concept level, not the product level.
Access control models
| Model | How access is granted |
|---|---|
| DAC (Discretionary) | The resource owner decides who gets access |
| MAC (Mandatory) | Access decided by system-enforced classification labels, not the owner |
| RBAC (Role-Based) | Access tied to a defined job role, not the individual |
| ABAC (Attribute-Based) | Access decided dynamically by attributes (department, time, location, device) |
Authentication factors
Something you know (password), something you have (token, phone), something you are (biometric). True multi-factor authentication requires factors from at least two different categories -- a password plus a security question is not MFA, since both are "something you know."
إدارة الهوية والوصول (IAM) covers identity lifecycle management: provisioning access when someone joins, adjusting it as their role changes, and de-provisioning it promptly when they leave. Privileged accounts require extra scrutiny -- this is where إدارة الوصول المميز (PAM, Privileged Access Management) applies additional controls like session recording and just-in-time elevation.
Try it yourself
An interactive CyberAbeer experience for this topic is in development.
Coming soon