The IAM Framework Citation Gap

IAM practitioners rely on a small set of frameworks to defend their work, and the citations do not always match what the documents say. The mismatches are not confined to obscure corners. They appear on the controls teams are most confident about, where a reference to ISO or NIST diverges from the source. This paper maps how those citations fail, through four patterns observed in practice: the wrong concept, the wrong document, the stale edition, and the invented requirement. Each is worked against the primary source at a named edition, so the distance between what a standard says and what the field believes it says is visible.

The paper then turns to application. It sets out how to defend each citation to an auditor, and it addresses the question every practitioner reaches, whether the frameworks can be relied on alone. They cannot, and the closing sections describe what carries the remaining weight once the citation is correct: the risk and architecture decisions the standards leave to the organization, and the evidence that a control is working. A reference table pairs the most-cited IAM concepts with the controls that ground them.