01
Identity
A single record of a person or of a system account that applies across applications, and its life cycle from creation to removal. The terms and basic concepts are described in the ISO/IEC 24760-1:2025 standard.
Solutions and services · Cyber security
Identity and access management
Identity and access management (IAM) answers one question: who has which access rights in which system — and who gave them. This includes single sign-on, the assignment of access rights by job role and the account lifecycle from joining to leaving.
We design it as part of the information systems we build and operate, on open standards — and to the extent required by the NBÚ decree on security measures.
When access management comes up
Access management is rarely addressed pre-emptively. It comes up with an audit, with the deployment of a new system or with a question that cannot be answered off the top of one's head.
A typical situation: an organisation runs several applications and each has its own sign-in and its own list of users. Rights are assigned by comparison — "set him up the same as his colleague". After an employee leaves, the account stays active because no one keeps a central record of it. And when an auditor asks for a list of people with access to sensitive data, it is collected by hand from the administrators of the individual systems.
It concerns IT directors and system administrators, information security managers, project managers on the client side and organisations that fall under the Cybersecurity Act.
What access management covers
Identity and access management rests on four questions. Each has its own mechanism and its own record.
02
Authentication
Verification that a user is who they claim to be. One sign-in works for all connected applications — the user does not have to remember ten passwords and the administrator cancels one account instead of ten.
03
Authorisation
A decision on what a user may do in an application. Rights are not tied to a person but to a role; the person is given a role. The role model is described by the INCITS 359-2012 (R2022) standard.
04
Traceability
A record of who granted a right, when and on what basis. Without it, the state of permissions cannot be reconstructed during an audit or after an incident.
How we do it in the systems we build
We design access management as part of the information system, not as a separate product. The basis is an open platform in our technology stack — built on standards, not on a single sign-in vendor.
- a single sign-in to all modules of the system instead of a separate password for each module,
- rights tied to a role — officer, approver, administrator — and not to a particular person,
- connection to the organisation's existing directory via LDAP or Active Directory, if the customer runs one,
- the standard protocols OpenID Connect and SAML 2.0, so that third-party applications can be connected too,
- a record of sign-ins and of changes to permissions.
The scope follows from what already runs in the customer's environment. If the organisation operates Active Directory, we build access management on top of it; if it does not, the system itself holds the list of users.
Technologies and standards
What we work with and which standards the solution is based on.
- Protocols
- OpenID Connect · SAML 2.0
- Directories
- LDAP · Active Directory
- Access control
- RBAC
- ISO/IEC 27001:2022
- The standard for an information security management system. Its Annex A also contains controls for access control, identity management, authentication information and access rights. Qintec holds a certificate to this standard.
- ISO/IEC 24760-1:2025
- A framework for identity management — basic concepts and terminology (Core concepts and terminology). The current edition is the third one, from September 2025; the 2019 edition was withdrawn. Parts 2 and 3 of the framework were also published in 2025.
- INCITS 359-2012 (R2022)
- A role-based access control (RBAC) model. A role is a set of permissions and a user receives them solely through the role. The designation (R2022) means that the standard was reaffirmed as valid in 2022.
- Act No. 69/2018 Coll.
- The Cyber Security Act as amended by Act No. 366/2024 Coll., effective from 1 January 2025, which transposes the NIS2 Directive into Slovak law — Directive (EU) 2022/2555.
- NBÚ Decree No. 227/2025 Coll.
- A decree of the National Security Authority of 26 August 2025 on security measures, effective from 1 September 2025. In Section 20(2)(j) it requires precisely what access management addresses: unique identifiers throughout the entire identity life cycle, role-based access control, the lowest necessary permission and restriction of privileged access.
The difference from identity protection
These are two different tasks and at Qintec they are covered by two separate services. The difference is whether you are designing access or defending existing accounts.
This page
Identity and access management
Who has which access rights in the system. It is set up when the system is designed and deployed: roles, single sign-in, the account life cycle, a record of rights granted.
Standalone service
Identity and privileged access protection
Defending accounts that already exist against misuse: multi-factor authentication even where it cannot be deployed natively, privileged and service accounts, monitoring of Active Directory.
Go to identity protectionCertification and documents
Qintec holds the certificate ISO/IEC 27001:2022 for an information security management system — registration number ISMS0651125/2, issued on 13 April 2026 by the certification body CERTICOM, valid until 31 October 2028. Annex A of this standard also covers access control and identity management.
We set up access management in the systems we develop and operate ourselves, and in the infrastructure we design ourselves — from servers and virtualisation to monitoring. We name specific deployments only with the customer's consent.
Frequently asked questions on access management
What is identity and access management (IAM)?
Identity and access management is a set of rules and technical measures that determine who signs in to a system, what they may do in it and how access is granted to them and removed. It covers identity records, sign-in verification, the assignment of rights by role and a record of who granted the right.
What is the difference between access management and identity protection?
Access management defines who has which access rights in a system — it is set up when the system is designed and deployed. Identity protection defends accounts that already exist against misuse: multi-factor authentication, privileged and service accounts, monitoring of Active Directory. Qintec delivers both, but as two separate services.
What does role-based access mean?
Permissions are not tied to a specific person but to a job role — for example clerk, approver or administrator. A user is given a role and with it all the rights that belong to it. When a position changes, the role changes, not the list of individual rights. This model is described by the INCITS 359-2012 (R2022) standard.
What technology do you build it on?
On an open platform from our technology stack. It supports single sign-on and the standard OpenID Connect and SAML 2.0 protocols, so third-party applications can be connected as well.
Can it be connected to our Active Directory?
Yes, if the organisation operates a directory. Users then stay in the existing directory and the system takes identities from it over LDAP. If the organisation has no directory, the list of users is held by the system itself.
Is access management required by any standard or law?
Access control and identity management are covered by ISO/IEC 27001:2022 in Annex A. For entities under Act No. 69/2018 Coll. on cyber security, as amended by Act No. 366/2024 Coll. effective from 1 January 2025, which transposes the NIS2 Directive, the security measures are set out in Decree No. 227/2025 Coll. of the National Security Authority, effective from 1 September 2025. Access management is addressed by its Section 20(2)(j) — unique identifiers, role-based access, least privilege and the restriction of privileged access.
Related services
Identity and privileged access protectionDefence of existing accounts: multi-factor authentication, privileged accounts, monitoring of Active Directory.
Information systems and digitisationSystems in which we configure access management — custom development as well as off-the-shelf solutions.
Infrastructure and data centresServers, virtualisation, monitoring and technical support for the environment in which the system runs.
Access management · Consultation
Do you know who has access to what?
We will go through roles, sign-in and the life cycle of accounts in your systems with you and propose how to set it up.
E-mail: qintec@qintec.sk · Phone: +421 2 3240 1217 (working days 9:00 – 15:30)