Access Control is the fundamental security safeguard that dictates exactly who, or what, is permitted to view, use, or modify your organization’s resources, systems, and data. For early-stage tech companies, granting blanket admin rights to all developers, sharing generic passwords, or failing to immediately revoke access for off boarded employees are fatal vulnerabilities. If an auditor discovers you are violating the Principle of Least Privilege, lacking strict Role-Based Access Control (RBAC), or operating without a clear access lifecycle, it will trigger an immediate major non-conformity during your certification audit under Annex A 5.15.
Table of contents
Definition
Access control is an information security safeguard that restricts and manages who or what can view, use, or modify organisational resources, systems, and data. Under ISO/IEC 27001:2022, it is primarily governed by Organisational Control A.5.15.
In simple terms it is a security measure that limits who can view or use information. It’s like having a special key or password to get into a room or use a computer file. This helps keep important data safe from people who shouldn’t see it.
Examples
- Passwords: You need a password to log into your email. This password is a form of access control.
- Keycards: A keycard to enter an office building is another example. Only people with the right card can get in.
- Permissions: On a computer, you might have permission to read a document but not to change it. This controls what you can do with the file.
Context
Access control is a key part of information security. It makes sure that confidentiality, integrity, and availability of information are protected. It’s not just about stopping bad guys; it’s also about making sure people can’t accidentally mess up data. Organizations use this to meet rules and keep their info safe.
Relevant ISO 27001 Controls
The following controls from the ISO/IEC 27001:2022 standard are related to access control:
- ISO 27001 Annex A 5.15 Access control: This is the main control for managing access rights.
- ISO 27001 Annex A 5.16 Identity Management: This covers the process of giving, changing, and removing user access.
- ISO 27001 Annex A 5.17 Authentication Information: This control deals with how users prove who they are (e.g., with passwords or keycards)
- ISO 27001 Annex A 5.18 Access rights: This control focuses on setting up and reviewing user access to systems.
- ISO 27001 Annex A 8.2 Privileged Access Rights This is about controlling access for powerful accounts, like system administrators.
Stuart Barker
Stuart Barker is a qualified ISO 27001 Lead Auditor and veteran practitioner with over 30 years of experience in systems security and risk management. Holding an MSc in Software and Systems Security, he combines academic rigour with extensive operational experience, including a decade leading Data Governance for General Electric (GE).
He is the founder of High Table and the Lead Consultant driving the world’s number 1 dedicated ISO 27001 Consultancy.
