# SP-010 Identity Management Pattern

Status: published. Release 26.02. Modified 2026-02-06. Licence: CC BY-SA 4.0.

Scope: Security architecture for the lifecycle management of digital identities, covering identity provisioning, authentication, federation, authorisation, credential management, and privacy considerations across enterprise and cross-organisational boundaries.
Use when: This pattern applies to any organisation that stores, processes, or transmits identity information for employees, customers, business partners, or other entities. It is essential when the organisation operates multiple applications requiring authentication, when business processes cross organisational boundaries requiring identity federation, when regulatory requirements mandate specific identity data handling...
Not when: Organisations that do not process personal or confidential identity information and do not store identity data may not require the full scope of this pattern.

## Threats and the controls that mitigate them (10)
- T-IM-001 Credential Theft via Phishing and Social Engineering: 
- T-IM-002 Credential Stuffing and Brute-Force Attacks: 
- T-IM-003 Privilege Escalation and Entitlement Creep: 
- T-IM-004 Orphaned Account Exploitation: 
- T-IM-005 Identity Fraud and Account Takeover: 
- T-IM-006 Federation Assertion Manipulation and Replay: 
- T-IM-007 Machine Identity Compromise (API Keys, Certificates): 
- T-IM-008 Privacy Violation from Excessive Identity Data Collection: 
- T-IM-009 Insider Threat via Excessive Privileged Access: 
- T-IM-010 Directory Service Compromise and Lateral Movement: 

## More
- Every control and what it mitigates, as JSON: /api/v1/patterns/SP-010/crosswalk
- The same for every control, with its clauses in a framework: /api/v1/patterns/SP-010/crosswalk?framework={framework id}. Framework ids are listed in /llms.txt
- The pattern's prose, examples and references as JSON, 18 KB: /api/v1/patterns/SP-010
- Page for people: /patterns/sp-010/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.
- Related: SP-008 Public Web Server Pattern; SP-011 Cloud Computing Pattern; SP-013 Data Security Pattern; SP-014 Awareness and Training Pattern; SP-018 Information Security Management System

This card, the API and the page are generated from one file. Checking one against another adds no evidence.