Access Control - ISO 27001 Annex A Control
ISO 27001 Annex A 5.15
Access control is the single most-tested family of controls in any audit.
ISO 27001 Annex A 5.15 - Access Control
Access control is the framework that decides who gets to see what. The control sits at the top of a chain that includes identity management, authentication, access rights and privileged access. Annex A 5.15 is about the rules that drive all of those - the principles and policy that the more specific controls implement.
The rules need to be based on business requirements and security requirements, not on convenience. Most organisations work to a least-privilege principle, where staff get the access they need for their role and no more. Role-based access control simplifies this by mapping access to defined roles rather than individual user grants.
Both physical and logical access fall in scope. Physical means doors, server rooms, secure areas. Logical means systems, applications, file shares, cloud services. The same principle applies to both - access is granted in line with the defined rules, reviewed regularly, and removed when no longer needed.
Access control is one of the most-audited areas because it is one of the most common places things go wrong. Old user accounts that should have been removed. Privileged access granted years ago and never reviewed. Shared accounts that nobody owns. Keep on top of these and access control is sorted. Let them drift and the audit findings pile up.
Practical Compliance Guidance
Access control arrangements are described in the IMS1 manual at section 8.2 on information security arrangements and section 8.5 on the topic-specific Access Control Policy. The IT Equipment Logins Register holds the list of active accounts.
| alphaZ document | How to use it |
|---|---|
| ISO 27001 Toolkit | The full alphaZ ISO 27001 toolkit covering manual, policies, procedures, registers and audit checklists. |
| P24 Access Control Policy | The headline access control policy. Sets out the rules for granting, reviewing and removing access, the principles applied and the responsibilities of users and administrators. |
Note - all the above files can be downloaded with an alphaZ subscription.
