CISM Domain 3 - Identity and Access Management MindMap

Introduction

Hey, I’m Nick from Destination Certification, and I’m here to help YOU pass the CISM exam.

In this video, we’re going to break down a full MindMap of some of the most important concepts in Identity and Access Management from Domain 3— not just to help you memorize terms, but to really understand how they interconnect and why they matter.

This is the eighth of thirteen videos for domain 3. I have included links to the other MindMap videos in the description below. These MindMaps are one part of our complete CISM MasterClass.

Access Control

Have you ever wondered how organizations really know who’s inside their systems — and what they’re allowed to do once they’re in? That’s the foundation of Identity and Access Management. This framework protects resources through systematic verification of identities and controlled assignment of permissions

Think of IAM as writing the guest list. Access control is the bouncer at the door, checking IDs and deciding who gets in and under what conditions. Organizations implement access control through policies and technologies that evaluate requests against established criteria, ensuring users can only perform actions aligned with their roles and responsibilities. This systematic approach prevents unauthorized access while enabling legitimate users to accomplish their tasks efficiently. Ensuring that this is viable starts with identification. 

Identification

Identification represents the first step in the access control process where users claim their identity to a system, typically through usernames, email addresses, or employee IDs. This process establishes who someone claims to be without yet verifying that claim. Organizations must ensure identification methods are unique and consistent across systems to prevent confusion and maintain accountability. The identification phase sets the foundation for all subsequent security decisions, making proper identifier management critical for maintaining system integrity.

Authentication

The second step is authentication. It validates that users are who they claim to be by requiring proof of identity through various verification methods. This critical security process transforms an unverified claim into a trusted identity that systems can rely upon for access decisions. Passwords alone are yesterday’s news. Today, real security means proving you are who you say you are — with multiple checks that raise the bar for attackers and set the tone for every decision in the system.

Factors

Before discussing other elements of access control, let’s break down authentication factors. These are the different categories of evidence users provide to prove their identity to systems. Example of authentication factors can be knowledge, ownership, and characteristic. To start off, let’s consider knowledge. 

Knowledge

Knowledge factors involve something the user knows, such as passwords, PINs, or answers to security questions.

Ownership

Secondly, ownership factors require something the user has, like smart cards, mobile devices, or hardware tokens.

Characteristic

Thirdly, characteristic factors use something the user is, including biometric identifiers like fingerprints, facial recognition, or iris scans.

Single vs MFA

When it comes to authentication more broadly, it’s important to understand the difference between single-factor and multi-factor.

Single-factor authentication relies on one verification method while multi-factor authentication combines two or more different factor types. MFA dramatically improves security by requiring attackers to compromise multiple authentication methods rather than just one, making unauthorized access exponentially more difficult. Single-factor authentication is like a club with just a bouncer checking IDs — fool the bouncer, and you’re in. Multi-factor is like a club with a bouncer, a wristband check inside, and a fingerprint scanner at the VIP lounge. To sneak in, an imposter would have to beat every layer, which makes crashing the party a whole lot harder.

Now that we’ve discussed authentication in-depth, let’s move on to authorization. 

Authorization

Authorization determines what authenticated users are permitted to do within systems by evaluating their permissions against requested actions. This process translates identity into specific access rights, ensuring users can only perform operations appropriate to their roles and responsibilities. Effective authorization requires granular control mechanisms that can adapt to changing business needs while maintaining security boundaries. Organizations must regularly review and update authorization policies to prevent privilege creep and ensure access remains aligned with current job functions.

Accounting

The last element of access control of our video is accounting.

Accounting tracks and records all user activities within systems, creating an audit trail that supports security investigations, compliance requirements, and operational analysis. Think of accounting as the system’s memory. It logs every move, so when something goes wrong you’ve got receipts for the auditors, clues for the investigators, and insights to keep getting better. This continuous monitoring captures who did what, when, and from where, providing the visibility needed to detect anomalies and investigate incidents. 

And that is an overview of Identity and Access Management within Domain 3, covering the most critical concepts you need to know for the exam.
Something really cool we are providing with these MindMap videos is a completely FREE downloadable version of all the MindMaps in PDF format. We even include a blank version of each MindMap in case you want to print them out and take notes as you listen along. Link to download the MindMaps is in the description below.

If you found this video helpful you can hit the thumbs up button and if you want to be notified when we release additional videos in this MindMap series, then please subscribe and hit the bell icon to get notifications.
I will provide links to the other MindMap videos in the description below.

Thanks very much for watching! And all the best in your studies