Access rights

Plain-language summary

Granting, reviewing, changing and removing people's access to information and systems in line with the access control policy — approved by the right owner, checked regularly, adjusted when roles change and taken away promptly when no longer needed.

What the clause is really asking

This is the operational heart of access control. The control asks that every stage of a person's access — granting it, checking it is still right, changing it and taking it away — follows the rules in your access control policy. Granting means the asset owner authorises the access, the approver is not the person implementing it, and the rights match the role; a record is kept of who has access to what and why. Temporary access carries an end date. When someone moves role, old access goes as new access arrives. On termination, rights are removed or adjusted, ideally on or before the last day. Reviews happen at planned intervals, more often for privileged and sensitive access, and after organisational changes. The common misunderstanding is treating reviews as an IT exercise: IT exports a list, ticks it, nothing changes. Reviews must be done by owners who know whether the access is needed, and must lead to removals. Under POPIA section 19, prompt removal of access that is no longer needed is one of the most basic reasonable measures.

What auditors look for

Auditors sample recent starters, movers and leavers and trace each one through the access records: request, owner approval, implementation and, for leavers, removal date against the HR leaving date. Movers are where they find the most — rights from the old role still active. They ask for the last access review of two or three key systems and check who performed it, what was found and whether removals actually happened. They compare current access lists with the review records and look for temporary access past its end date. The hard question: show me an access review that resulted in access being removed.

Typical evidence

Access request and approval records; provisioning and removal logs; starter, mover and leaver records reconciled with HR; access review schedule; completed reviews signed by asset owners; evidence that removals identified in reviews were carried out; temporary access register with expiry dates; privileged access review records; access matrices or role definitions.

How to comply — recommendations

Route every access change through one request-and-approval workflow in which the asset owner approves and IT implements. Link it to HR so movers and leavers trigger changes automatically. For movers, remove old-role access when new-role access is granted, unless the owner approves a defined overlap. Give temporary access an expiry date. Schedule access reviews — quarterly for privileged accounts and for systems holding sensitive or personal information, at least annually for the rest — carried out by the asset owner, with every removal tracked to completion. Keep the review records showing what was removed.

Common nonconformities

Access granted without owner approval; leavers' access removed weeks after departure; movers keeping rights from previous roles; access reviews not performed, or performed by IT without owner input; reviews completed but no access ever removed; temporary access with no expiry; privileged access reviewed no more often than ordinary access; no record of who has access and why.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.