Identification, Authentication, Authorization, and Accountability

From Claim to Record

Subdomain 1.1 names Authentication, Authorization, Accounting (AAA). An identity is the claim that someone or something is asking for access. Authentication verifies the claim. Authorization decides what the verified identity may do. Accounting records the action so that accountability is possible.

Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomains 1.1 and 3.1, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.

Roles Come First

Subdomain 3.1, Understand identity life cycle management, begins with roles definition, followed by provisioning, review, and deprovisioning. A role states what a job needs. Defining roles before provisioning keeps each account tied to a documented need, which is what authorization decisions depend on.

What the Outline Lists for This Section

The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:

• 1.1: Confidentiality
• 1.1: Integrity
• 1.1: Availability
• 1.1: Authentication, Authorization, Accounting (AAA)
• 1.1: Non-repudiation
• 1.1: Privacy
• 3.1: Roles definition
• 3.1: Provision
• 3.1: Review
• 3.1: Deprovision
• 3.1: Frameworks and tools

Common Traps

A common trap is naming the wrong objective. If the scenario is about who acted, the objective is accountability, not availability. Name the objective the scenario states before choosing among controls.