What does IAM stand for?
IAM stands for Identity and Access Management. Identity and access management: the processes and tools that create identities, authenticate them and control what they can access. Identity logs are a key source of indicators of compromise.
IAM covers the whole life of an identity: creating the account, proving who is signing in, deciding what the account may reach, reviewing that access over time and removing it when it is no longer needed. Good IAM follows least privilege, so each account has only the rights its role requires, and it covers service accounts and devices as well as people.
IAM in practice: an example
A developer moves to the sales team. Under role-based IAM her developer role is removed and the sales role added on the day of the move, so she gains the CRM and loses access to the source code. Without that process she would simply keep collecting rights, which is called privilege creep.
What IAM is confused with
IAM vs PAM: what is the difference?
Privileged access management is the part of IAM that protects administrator and other high-risk accounts with vaulting, session recording and just-in-time elevation. What PAM stands for
IAM vs SSO: what is the difference?
SSO is one IAM feature. IAM also includes provisioning, authorization, reviews and deprovisioning. What SSO stands for
Which exams cover IAM?
IAM is on the official CompTIA acronym list for three of the four exams covered here.
- CySA+ CS0-004: 1.1, 1.2 (Security Operations).
- Network+ N10-009: 4.0 (Network Security).
- A+ 220-1201 and 220-1202: 220-1202 2.0 (Security). Listed there as “Identity Access Management”.
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. An audit finds that long-serving staff hold access from every job they ever had. Which IAM activity addresses this?
- Regular access reviews and recertification
- Increasing password length
- Installing a WAF
- Changing the DHCP scope
Show the answer
A. Regular access reviews and recertification. Periodic reviews remove rights that are no longer justified. This accumulation is called privilege creep.
2. Which principle says an account should have only the rights it needs for its tasks?
- Defence in depth
- Least privilege
- Non-repudiation
- Implicit trust
Show the answer
B. Least privilege. Least privilege limits the damage a compromised or misused account can do.
Sources: NIST glossary: identity and access management. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.