Access control

Plain-language summary

Setting and applying rules for who may reach which information and assets, through systems and through doors, based on what the business needs and what security requires — so access follows need-to-know and least privilege rather than convenience.

What the clause is really asking

This is the policy control for the identity and access family. It asks you to set rules for who may reach which information and assets — through systems and through doors — derive those rules from business and security needs, and then apply them. Usually that means a topic-specific access control policy setting out the principles: need-to-know and need-to-use, least privilege, deny unless expressly permitted, segregation of duties, the access model you use (role-based, attribute-based or a mix), the approval route, review frequency and how access is removed. Asset owners decide who needs access to their information; IT implements the decision. Physical access to premises and secure areas is covered as well as systems. The common misunderstanding is that this control is the password policy, or that it belongs to IT alone. In South Africa, access control sits at the centre of POPIA section 19's 'appropriate, reasonable technical and organisational measures', and the Information Regulator's work after breaches has focused on basic access failures, so this is where a reasonable-measures argument is won or lost.

What auditors look for

Auditors ask for the access control policy and check it states principles they can test. They then pick a sensitive system and a sensitive area — the payroll system, the server room — and compare who has access with who should, according to roles and the policy. They ask asset owners how they decide who gets access. They look for deny-by-default settings on shared drives and cloud storage, and for broad permissions such as 'Everyone' or all-staff groups. They check physical access follows the same principles. The hard question: show me how the least-privilege rule in your policy is enforced on your most sensitive information.

Typical evidence

Access control policy covering principles, access model, approval, review and removal; role definitions or access matrices for key systems; access request and approval records; folder and system permission reports; physical access lists for secure areas; access review records; exception register with approvals; asset owner sign-offs.

How to comply — recommendations

Write a two- to three-page access control policy stating your principles (least privilege, need-to-know, deny by default), the access model, who approves access, review frequency and removal rules, covering both physical and logical access. With the asset owners, build role-based access matrices for your key systems, starting with finance, HR and anything holding personal information. Remove 'Everyone' and other broad group permissions from shared drives and cloud storage. Route all access through a request-and-approval workflow. Review the policy annually and after significant system changes, and make sure the access reviews it promises actually happen.

Common nonconformities

No access control policy, or one with no testable rules; access granted on request without owner approval; broad permissions such as 'Everyone' on sensitive folders; no role definitions for key systems; physical access left out of scope; least privilege stated but not applied; access reviews promised in policy but not performed; exceptions undocumented.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.