Access rights (also referred to as permissions or privileges) are the specific authorisations granted to users, processes, or devices to view, create, modify, or delete organisational information and systems. Under ISO/IEC 27001:2022, access rights are managed and reviewed under Organisational Control A.5.18.
Examples
Imagine a shared school computer. The teacher has full access rights, so they can add or remove student accounts and change grades. Students have limited access rights. They can open and save their own homework files but can’t change the teacher’s files or install new programs. A company’s HR department might have access to employee salary data, but regular employees don’t.
Context
Access rights are a core part of computer security. They ensure that only authorised people can see or change important information. This is crucial for protecting against data theft, accidental changes, and misuse of systems. By assigning specific rights to users or groups, an organisation can maintain control and accountability.
Relevant ISO 27001 Controls
The following controls from the ISO/IEC 27001:2022 standard are related to access rights:
- ISO 27001 Annex A 5.15: Access control: This is the main control for managing access rights.
- ISO 27001 Annex A 5.16:Identity Management: This covers the process of giving, changing, and removing user access.
- ISO 27001 Annex A 5.17: Authentication Information: This control deals with how users prove who they are (e.g., with passwords or keycards)
- ISO 27001 Annex A 5.18: Access rights: This control focuses on setting up and reviewing user access to systems.
- ISO 27001 Annex A 8.2: Privileged Access Rights This is about controlling access for powerful accounts, like system administrators.
About the author
