Access rights
Purpose
Ensure access to information and associated assets is defined and authorised according to business needs.
How to meet this control
In short: Provision, review, modify and remove access rights per the access control policy.
- Step 01Run a documented joiner-mover-leaver workflow so access is provisioned on hire, adjusted on role change and removed on exit
- Step 02Require asset owner authorisation before granting access and keep the approval record
- Step 03Conduct quarterly user access reviews, including privileged access, with reviewer sign-off and remediation of exceptions
- Step 04Use time-limited or just-in-time access for temporary staff and contractors and auto-expire it
- Step 05Avoid cloning another user when granting access, since it tends to copy excessive rights
Tip: Run quarterly access reviews and keep the signed-off records.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Provision, review, modify and remove access rights in line with the access control policy
- ›Obtain authorisation from the asset owner before granting access
- ›Apply segregation of duties by separating approval from implementation of access rights
- ›Remove or adjust access promptly when people leave or change roles
- ›Use time-limited access for temporary personnel and revoke it on expiry
- ›Maintain a central record of access rights granted and of changes made
- ›Review physical and logical access rights regularly, including privileged access
- ›Take extra care when cloning access from another user, as it can grant excessive rights
Audit evidence to keep
- - Quarterly access review records with reviewer sign-off and remediation actions
- - Access request and authorisation records showing owner approval
- - Evidence that leaver access is removed promptly (within a defined SLA)
- - Central record of access rights granted and changes made
Common mistakes
- - Approving access in chat with no retained record
- - Copying access from another user without checking least privilege
- - Reviewing access but not proving removals were completed
Owner, cadence, and proof
Assign one accountable owner for A.5.18. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.