ISO 27001 Annex A 8.3 Audit Checklist

The ultimate audit guide to ISO 27001 Annex A 8.3 Information Access Restriction

1. Access Control Policy Enforcement Verified

Verification Criteria: A documented policy exists defining the rules for restricting access to information and system functions based on business and security requirements.

Required Evidence: Approved Access Control Policy with specific mentions of the “Need to Know” and “Need to Use” principles.

Pass/Fail Test: If there is no formalised policy governing the restriction of information access at the application or database level, mark as Non-Compliant.

2. Role-Based Access Control (RBAC) Alignment Confirmed

Verification Criteria: User access is assigned to logical roles rather than individuals, ensuring consistency and preventing “permission creep.”

Required Evidence: System role definitions and membership logs from Active Directory (AD) or IAM providers (e.g., Okta, Azure AD).

Pass/Fail Test: If users are found with direct, individual permissions that bypass established group roles, mark as Non-Compliant.

3. Database-Level Access Restrictions Validated

Verification Criteria: Access to sensitive databases is restricted to authorised applications or specific administrative users, preventing direct access by general personnel.

Required Evidence: Database user permission reports and firewall rules restricting SQL/NoSQL port access to authorised application IP ranges.

Pass/Fail Test: If general users or non-DBA IT staff possess direct “read” or “write” access to production database schemas, mark as Non-Compliant.

4. Sensitive System Function Segregation Verified

Verification Criteria: High-risk system functions (e.g., user deletion, log clearing, configuration changes) are restricted to a subset of privileged users.

Required Evidence: Application-level permission matrices showing the restriction of “Administrator” or “Superuser” functions.

Pass/Fail Test: If a standard business user account has the technical ability to modify system-level configurations or security logs, mark as Non-Compliant.

5. Dynamic Access Control (Conditional Access) Confirmed

Verification Criteria: Access is restricted based on dynamic factors such as geographic location, device health, and network origin.

Required Evidence: Configuration logs from Conditional Access policies (e.g., Microsoft Entra ID) showing blocks for non-compliant or unmanaged devices.

Pass/Fail Test: If sensitive systems are accessible from unmanaged personal devices or high-risk IP ranges without additional verification, mark as Non-Compliant.

6. Information Classification Masking Implementation Validated

Verification Criteria: Highly sensitive information (e.g., PII or card data) is masked or obscured for users who do not require the full data set for their role.

Required Evidence: System screenshots or API response logs demonstrating Data Masking (e.g., showing only the last 4 digits of a card or ID number).

Pass/Fail Test: If customer support staff can view unmasked sensitive PII (e.g., full SSN/Tax IDs) that is not required for identity verification, mark as Non-Compliant.

7. Source Code Access Restriction Verified

Verification Criteria: Access to program source code is restricted to authorised developers and protected against unauthorised modification or extraction.

Required Evidence: Repository access logs (GitHub/GitLab/Bitbucket) cross-referenced against the current developer list and active project teams.

Pass/Fail Test: If non-development personnel (e.g., Sales or Marketing) have “Read” access to production source code repositories, mark as Non-Compliant.

8. Physical Media Access Control Confirmed

Verification Criteria: Access to physical media containing sensitive information (e.g., backup tapes, removable drives) is restricted to authorised personnel only.

Required Evidence: Access logs for the media safe or off-site storage facility and a signed “Authorised Media Handler” list.

Pass/Fail Test: If sensitive physical media is stored in an unlocked or general-access cabinet, mark as Non-Compliant.

9. Shared Account Usage Restrictions Validated

Verification Criteria: Generic or shared accounts are prohibited or strictly controlled to ensure individual accountability for information access.

Required Evidence: Identity provider reports showing unique accounts for all human users; PAM (Privileged Access Management) logs for any required shared service accounts.

Pass/Fail Test: If multiple staff members share a single login for a sensitive application or server, mark as Non-Compliant.

10. Access Termination Timeliness Verified

Verification Criteria: Access to information and systems is revoked immediately upon termination of employment or change in role.

Required Evidence: HR leavers’ logs compared against IAM “Account Disabled” timestamps for the previous 90 days.

Pass/Fail Test: If a terminated employee retains active access to any sensitive system more than 24 hours post-exit, mark as Non-Compliant.

About the author