High Table Logo Website

Home / ISO 27001 Glossary of Terms / Access control

Access control

11/09/2025

Author: Stuart Barker | ISO 27001 Expert and Thought Leader

Access Control Definition - ISO 27001 Glossary

The process of ensuring that only authorised users, systems, or processes are able to access information and other assets. This is a fundamental security principle that involves limiting access based on the need-to-know or least privilege principles. It applies to both physical and logical access.

Types & Examples

  • Physical Access Control: Restricting access to physical locations.
    • Example: Requiring an employee to use a keycard or biometric scan to enter a server room.
  • Logical Access Control: Restricting access to digital information and systems.
    • Example: Using a user ID and password, multi-factor authentication (MFA), or role-based access control (RBAC) to ensure a user can only access the files and applications required for their job.

Context

Access Control is a major topic in the ISO 27001 standard, particularly in ISO 27001 Annex A 5.15 Access Control. It’s a preventive control designed to stop unauthorised access before it happens, thereby protecting the confidentiality, integrity, and availability of information.

Tags:
Stuart Barker, ISO 27001 expert

Stuart Barker
ISO 27001 Expert and Thought Leader

ISO 27001 Toolkit Business Edition
ISO 27001 Jumpstart Kit
ISO 27001 Consultant Toolkit
Stuart Barker, ISO 27001 expert

About the author

Stuart Barker is an information security practitioner of over 30 years. He holds an MSc in Software and Systems Security and an undergraduate degree in Software Engineering. He is an ISO 27001 expert and thought leader holding both ISO 27001 Lead Implementer and ISO 27001 Lead Auditor qualifications. In 2010 he started his first cyber security consulting business that he sold in 2018. He worked for over a decade for GE, leading a data governance team across Europe and since then has gone on to deliver hundreds of client engagements and audits.

He regularly mentors and trains professionals on information security and runs a successful ISO 27001 YouTube channel where he shows people how they can implement ISO 27001 themselves. He is passionate that knowledge should not be hoarded and brought to market the first of its kind online ISO 27001 store for all the tools and templates people need when they want to do it themselves.

In his personal life he is an active and a hobbyist kickboxer.

His specialisms are ISO 27001 and SOC 2 and his niche is start up and early stage business.