Information access restriction

Plain-language summary

Enforcing your access rules inside systems and applications so that people can reach only the information their role needs — set through permissions on file shares, SharePoint and Drive sites, application roles and sharing links rather than left to trust.

What the clause is really asking

Control 5.15 sets the access control policy and 5.18 grants rights to people; this control is about the system settings that make those decisions real. It asks you to restrict access to information and other assets in line with the policy: no anonymous access to anything sensitive; permissions that distinguish read, write, delete and execute; configuration so that a user sees only the records, folders, menus or functions their role requires; and control over what can be done with information once shared, such as blocking download or forwarding where the classification calls for it. The guidance also points to dynamic techniques, such as rights management and sensitivity labels, for information that leaves your systems. The common misunderstanding is that a tidy access policy means access is restricted. In practice the risk sits in 'Everyone' groups on old file shares, sites shared with the whole tenant and 'anyone with the link' sharing. Under POPIA section 19, an HR folder open to all staff is a failed safeguard even if nobody has misused it yet.

What auditors look for

Auditors pick sensitive information — payroll, HR files, customer personal information, pricing — and ask to see who can access it, then ask why each person needs to. They open the permissions on the folder or site themselves, or ask you to run a sharing report from Microsoft 365 or Google Workspace, and look for 'Everyone', 'All users' and anonymous links. In the ERP they ask for the role matrix and test whether a sample user's actual rights match it. They check tenant-level external sharing settings. The hard question: how would you know if someone shared the salary spreadsheet outside the organisation yesterday?

Typical evidence

Access control policy and role-to-information matrix; permission reports for file shares and for SharePoint or Drive sites holding sensitive information; external and anonymous sharing reports; application role definitions and user-to-role assignments; tenant sharing settings; sensitivity label or rights management configuration; records of permission reviews by information owners and the corrections made.

How to comply — recommendations

List the ten places where your most sensitive information lives and who owns each. For each, define in a simple matrix which roles need read, edit or no access, and set permissions through groups, not individuals. Remove 'Everyone' and all-staff permissions from sensitive locations. In your cloud tenant, restrict external sharing to named guests, switch off or time-limit anonymous links, and default new links to people in your organisation. Apply sensitivity labels to the highest-classification documents so restrictions travel with the file. Ask owners to review permissions on their locations twice a year and sign off. Run a sharing report quarterly and chase anything shared outside the organisation without a reason.

Common nonconformities

Sensitive folders or sites open to all staff; anonymous or 'anyone with the link' sharing of confidential documents; permissions granted to individuals ad hoc with no matrix; application roles that do not reflect the access policy; external sharing unrestricted at tenant level; information owners unaware of who can access their information; no periodic permission review.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.