ISO 27001 Annex A 8.3 Information Access Restriction

Home / ISO 27001 Annex A Controls / ISO 27001 Annex A 8.3 Information Access Restriction

ISO 27001 Information Access Restrictions

I am going to show you what ISO 27001 Annex A 8.3 Information Access Restriction is, what’s new, give you ISO 27001 templates, an ISO 27001 toolkit, show you examples, do a walkthrough and show you how to implement it.

I am Stuart Barker the ISO 27001 Ninja and using over two decades of experience on hundreds of ISO 27001 audits and ISO 27001 certifications I show you exactly what changed in the ISO 27001:2022 update and exactly what you need to do for ISO 27001 certification.

What is ISO 27001 Annex A 8.3 Information Access Restriction?

ISO 27001 Annex A 8.3 Information Access Restriction is an ISO 27001 control that looks to make sure you have controls in place to restrict access to information based on risk and organisation need.

ISO 27001 Annex A 8.3 Purpose

The purpose of Annex A 8.3 Information Access Restriction is to ensure only authorised access and to prevent unauthorised access to information and other associated assets.

ISO 27001 Annex A 8.3 Definition

The ISO 27001 standard defines Annex A 8.3 as:

Access to information and other associated assets should be restricted in accordance with the established topic-specific policy on access control.

ISO27001:2022 Annex A 8.3 Information Access Restriction

DO IT YOURSELF ISO27001

Stop Spanking £10,000’s on Consultants and Platforms

ISO 27001 Toolkit Business Edition

ISO 27001 Annex A 8.3 Implementation Guide

This is not the Wild West so we do not allow everyone to have access to everything. A basic premise of information security is access. We protect what is important to us and only allow those that we want to have access to it, to have access to it.

Topic Specific Policy

Your starting point for this control is to implement a topic specific policy on access control and include in that policy your approach to access. The ISO 27001 Access Control Policy Template is already written for you and ready to go and includes a great free Access Control Policy Example PDF. There is a lot more information on the Access Control Policy including how to write your own is covered in ISO 27001 Access Control Policy Ultimate Guide.

We are not talking here about privilege access which we covered in 8.2 Privilege Access but we are looking more general.

Relevant Controls

Relevant Annex A controls here include:

ISO 27001 Access Rights – Annex A 5.18

ISO 27001 Access Control – Annex A 5.15

Dynamic Access

The control is not particularly hard. It is mainly common sense. The standard talks a lot about dynamic access management techniques, which I think is phrase they are hoping catches on. It is mainly about second guessing dynamic changes that require access control considerations. Situations like sharing externally, or when investigations occur, or sharing externally.

Information Classification

You can take into account the information classification scheme when you are working out what your access requirements are.

Technical Controls

The controls are mainly technical once you have the policy and the requirements. Authentication technology, credentials, or certificates to access information. Time based access that allows access for or in set times. The encryption for protecting information either at the device or information level. Setting out what the printing permissions are if appropriate.

Records

There will be consideration for recording access, monitoring, reporting and alerting.

Information access restrictions have been around a long time and there is nothing to worry about here.

ISO 27001 Templates

ISO 27001 templates have the advantage of being a massive boost that can save time and money so before we get into the implementation guide we consider these pre written templates that will sky rocket your implementation. This ISO 27001 Toolkit has been specifically designed so you can DIY your ISO 27001 certification, build your ISMS in a week and be ISO 27001 certification ready in 30 days.

DO IT YOURSELF ISO27001

Stop Spanking £10,000’s on Consultants and Platforms

ISO 27001 Toolkit Business Edition

How to pass an audit of ISO 27001 Annex A 8.3

Time needed: 1 day

How to comply with ISO 27001 Annex A 8.3

  1. Have policies and procedures in place

    Write, approve, implement and communicate the documentation required for information access restriction.

  2. Assess your access requirements and perform a risk assessment

    Have an asset management process that includes an asset register. For each asset type perform a risk assessment and access requirements review.

  3. Implement controls proportionate to the risk posed

    Based on the risk assessment implement the appropriate controls to mitigate the risk.

  4. Keep records

    For audit purposes you will keep records. Examples of the records to keep include changes, updates, monitoring, review and audits.

  5. Test the controls that you have to make sure they are working

    Perform internal audits that include the testing of the controls to ensure that they are working.

Top 3 Mistakes People Make for ISO 27001 Annex A 8.3

The top 3 mistakes people make for ISO 27001 Annex A 8.3 are

1. Not restricting access when people leave

Having a robust starter, leaver, mover process that accounts for leavers and considers the access restrictions during the notice period as well as when the person leaves is key. This is often overlooked with people having full access during notice and often the access still being in place when they leave.

2. Not matching your classification policy

The access policy and the classification policy set out what you do, not how you do it. Often there is an mis match with what actually happens. Consider approaches like role based access that allow you to define the access restriction requirements and then monitor, report and audit against it.

3. Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

Get the Help of the ISO 27001 Ninja

Book your FREE 30 Minute ISO 27001 Strategy Call and let me show you how you can do it 30x cheaper and 10x faster that you ever thought possible.

Stuart - High Table - ISO 27001 Strategy Call
Stuart and Fay - Directors at High Table

Controls and Attribute Values

Control typeInformation
security properties
Cybersecurity
concepts
Operational
capabilities
Security domains
PreventiveConfidentialityProtectIdentity and access managementProtection
Integrity
Availability

ISO 27001:2022 requirements

Organisational Controls - A5

ISO 27001 Annex A 5.1 Policies for information security

ISO 27001 Annex A 5.2 Information Security Roles and Responsibilities

ISO 27001 Annex A 5.3 Segregation of duties

ISO 27001 Annex A 5.4 Management responsibilities

ISO 27001 Annex A 5.5 Contact with authorities

ISO 27001 Annex A 5.6 Contact with special interest groups

ISO 27001 Annex A 5.7 Threat intelligence – new

ISO 27001 Annex A 5.8 Information security in project management

ISO 27001 Annex A 5.9 Inventory of information and other associated assets – change

ISO 27001 Annex A 5.10 Acceptable use of information and other associated assets – change

ISO 27001 Annex A 5.11 Return of assets

ISO 27001 Annex A 5.11 Return of assets

ISO 27001 Annex A 5.13 Labelling of information

ISO 27001 Annex A 5.14 Information transfer

ISO 27001 Annex A 5.15 Access control

ISO 27001 Annex A 5.16 Identity management

ISO 27001 Annex A 5.17 Authentication information – new

ISO 27001 Annex A 5.18 Access rights – change

ISO 27001 Annex A 5.19 Information security in supplier relationships

ISO 27001 Annex A 5.20 Addressing information security within supplier agreements

ISO 27001 Annex A 5.21 Managing information security in the ICT supply chain – new

ISO 27001 Annex A 5.22 Monitoring, review and change management of supplier services – change

ISO 27001 Annex A 5.23 Information security for use of cloud services – new

ISO 27001 Annex A 5.24 Information security incident management planning and preparation – change

ISO 27001 Annex A 5.25 Assessment and decision on information security events 

ISO 27001 Annex A 5.26 Response to information security incidents

ISO 27001 Annex A 5.27 Learning from information security incidents

ISO 27001 Annex A 5.28 Collection of evidence

ISO 27001 Annex A 5.29 Information security during disruption – change

ISO 27001 Annex A 5.31 Identification of legal, statutory, regulatory and contractual requirements

ISO 27001 Annex A 5.32 Intellectual property rights

ISO 27001 Annex A 5.33 Protection of records

ISO 27001 Annex A 5.34 Privacy and protection of PII

ISO 27001 Annex A 5.35 Independent review of information security

ISO 27001 Annex A 5.36 Compliance with policies and standards for information security

ISO 27001 Annex A 5.37 Documented operating procedures 

Technology Controls - A8

ISO 27001 Annex A 8.1 User Endpoint Devices

ISO 27001 Annex A 8.2 Privileged Access Rights

ISO 27001 Annex A 8.3 Information Access Restriction

ISO 27001 Annex A 8.4 Access To Source Code

ISO 27001 Annex A 8.5 Secure Authentication

ISO 27001 Annex A 8.6 Capacity Management

ISO 27001 Annex A 8.7 Protection Against Malware

ISO 27001 Annex A 8.8 Management of Technical Vulnerabilities

ISO 27001 Annex A 8.9 Configuration Management 

ISO 27001 Annex A 8.10 Information Deletion

ISO 27001 Annex A 8.11 Data Masking

ISO 27001 Annex A 8.12 Data Leakage Prevention

ISO 27001 Annex A 8.13 Information Backup

ISO 27001 Annex A 8.14 Redundancy of Information Processing Facilities

ISO 27001 Annex A 8.15 Logging

ISO 27001 Annex A 8.16 Monitoring Activities

ISO 27001 Annex A 8.17 Clock Synchronisation

ISO 27001 Annex A 8.18 Use of Privileged Utility Programs

ISO 27001 Annex A 8.19 Installation of Software on Operational Systems

ISO 27001 Annex A 8.20 Network Security

ISO 27001 Annex A 8.21 Security of Network Services

ISO 27001 Annex A 8.22 Segregation of Networks

ISO 27001 Annex A 8.23 Web Filtering

ISO 27001 Annex A 8.24 Use of CryptographyISO27001 Annex A 8.25 Secure Development Life Cycle

ISO 27001 Annex A 8.26 Application Security Requirements

ISO 27001 Annex A 8.27 Secure Systems Architecture and Engineering Principles

ISO 27001 Annex A 8.28 Secure Coding

ISO 27001 Annex A 8.29 Security Testing in Development and Acceptance

ISO 27001 Annex A 8.30 Outsourced Development

ISO 27001 Annex A 8.31 Separation of Development, Test and Production Environments

ISO 27001 Annex A 8.32 Change Management

ISO 27001 Annex A 8.33 Test Information

ISO 27001 Annex A 8.34 Protection of information systems during audit testing