IAM Compliance: What the Rules Actually Require, and How to Prove It

Key points

• IAM compliance means proving that identity and access rules are enforced day to day, not just written down in a policy binder.
• Rules like SOX, HIPAA, PCI DSS 4.0 (effective 31 March 2025) and GDPR all require access controls, though each frames the duty differently.
• Auditors are shifting from sampling quarterly access reviews to asking for continuous, timestamped evidence.
• Non-human identities, meaning service accounts, API keys and machine tokens, now outnumber human users at most organisations and fall inside the same rules.
• Failed access reviews and stale accounts remain the most common audit findings across frameworks.

IAM stands for identity and access management: the systems that decide who can log in to what, and what they are allowed to do once inside. IAM compliance is the practice of showing a regulator or auditor that those rules are actually being followed.

That second half matters more than it used to.

For years, organisations passed audits by producing a written policy, a spreadsheet of user reviews, and a few screenshots. Regulators have grown sceptical of that approach. They want to see the control working on a Tuesday afternoon in March, not just on the day of the audit.

Which rules actually apply?

It depends on the sector, but most large organisations sit under several at once. Each frames identity controls in its own language.

In the United States, the Sarbanes-Oxley Act requires public companies to control access to systems that touch financial reporting. Section 404 is the part auditors care about most: management has to attest that internal controls, including access controls, are effective.

Healthcare organisations fall under HIPAA, the Health Insurance Portability and Accountability Act. Its Security Rule at 45 CFR 164.312(a) requires unique user IDs, automatic logoff, and access limited to what each worker needs.

Anyone handling card payments is bound by PCI DSS, the Payment Card Industry Data Security Standard. Version 4.0.1 became the only supported version on 31 March 2025, and Requirements 7 and 8 spell out least-privilege access and authentication rules in some detail.

In Europe, GDPR Article 32 requires "appropriate technical and organisational measures" to protect personal data. Regulators have consistently read that to include access control, though the text does not use those exact words. The NIS2 Directive, which EU member states were supposed to transpose by 17 October 2024, pushes identity controls further into critical-sector firms and adds personal liability for senior managers.

What does "continuous" evidence look like?

It means logs and system state, not screenshots. Auditors increasingly want to see that a joiner-mover-leaver process actually revoked an employee's access within a set window, with a timestamp to prove it.

A quarterly access review, where a manager clicks through a list and approves everyone, is still common. It is also the control most likely to fail on audit. The finding usually reads the same way: reviews happened, but stale accounts were approved anyway.

The direction of travel, as The Hacker News noted in its recent explainer, is toward tooling that pulls entitlements from every connected system and flags drift automatically. That includes non-human identities, the service accounts and API keys that run between machines. At most organisations they outnumber staff by a factor of ten or more, and they rarely get reviewed at all.

What should a compliance team focus on first?

Start with the accounts that carry the most risk: privileged users, shared admin accounts, and any identity that can reach regulated data. Get those under multi-factor authentication, log every use, and review them monthly rather than quarterly.

Then work outward. Map each identity control to the specific clause it satisfies, so that when an auditor asks about PCI DSS Requirement 8.3 or HIPAA 164.312(d), you can point to the exact log query that answers them.

Common questions

Is IAM compliance the same as cybersecurity?

No. Compliance proves you meet a written standard. Security is whether you can actually withstand an attack. A firm can pass an audit and still be breached, which is why regulators are moving toward evidence of real enforcement.

Do small companies have to worry about this?

Yes, if they take card payments, handle health data, or supply a regulated customer. PCI DSS and GDPR apply regardless of size, and NIS2 pulls in mid-sized firms in critical sectors across the EU.