Control A.5.15Access control
What it means in practice
Rules to control physical and logical access to information and other associated assets must be established and implemented, based on business and information security requirements.
This is the parent control of the access family — identity in A.5.16, credentials in A.5.17, rights in A.5.18, restriction in A.8.3, privileged access in A.8.2 — and what it asks for is the policy: on what basis access is granted at all.
The basis is business and security requirements, not convenience and not history. In practice that means deciding between role-based, attribute-based or another model, deciding where need-to-know applies, and deciding how access is authorised and by whom.
The recurring failure is an access model that exists in a document and not in the systems. Where rights are granted by copying an existing user, the model degrades with every joiner, and each new person inherits an accumulation that nobody has ever justified — which A.5.18’s review then has to unpick without knowing what was intended.
How to put this in place
Access decisions made case by case drift into inconsistency and excess. A written rule based on need-to-know gives approvers and administrators the same starting point.
- Decide the principles: need-to-know and least privilege.
- Define standard role-based access for common jobs, so most requests are routine.
- Write the request, approval, review and removal steps into an access control policy.
- Make sure the approver is never the person who grants the access.
- Apply it to a sample of systems and review it yearly; see also A.5.16 and A.5.18.
Evidence an auditor usually looks for: the approved access control policy, role definitions, and a sample of access grants traced to approvals.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Excel
Mandatory ISMS Documentation Checklist
in ISO 27001 Implementation & Certification ReadinessAnnex A Documents sheet: lists rules for access control among the documents auditors commonly expect for this control. - Word
Stage 1 and Stage 2 Audit Preparation Guide
in ISO 27001 Implementation & Certification ReadinessListed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge. - Excel
Segregation of Duties Conflict Matrix
in Security Exception, Waiver & Segregation of DutiesIts Framework References list this control. Supported by: Access conflicts (SOD-IT-01 to SOD-IT-03, SOD-SO-01), checking access against the grid (SD-03). - Word
SoD Conflict Review & Compensating Control Procedure
in Security Exception, Waiver & Segregation of DutiesIts Framework References list this control. Supported by: Stage 1: checks before access is granted. - Word
Access Review Methodology
in User Access ReviewIts Framework References list this control. Supported by: Whole methodology: the review part of the access control rules. - Word
Access Control Policy
in Joiner-Mover-Leaver & Access ProvisioningIts Framework References list this control. Supported by: Whole policy; access principles; who approves access. - Word
Joiner-Mover-Leaver Operating Procedure
in Joiner-Mover-Leaver & Access ProvisioningIts Framework References list this control. Supported by: Checking resulting access; building role profiles. - Excel
Role-Based Access Profile Matrix
in Joiner-Mover-Leaver & Access ProvisioningIts Framework References list this control. Supported by: Profiles and Rules: access granted from approved profiles on business need, with the base profile and non-standard access kept apart. - Word
Access Request & Approval Form
in Joiner-Mover-Leaver & Access ProvisioningIts Framework References list this control. Supported by: When to use the form: access outside the profiles approved each time. - Word
Privileged Access Standard
in Privileged Access ManagementIts Framework References list this control. Supported by: Principles; administrative tiers. - Excel
AI Agent Permission & Tool-Access Review Checklist
in Generative AI SecurityIts Framework References list this control. Supported by: Checklist sheet, AP-04 and AP-05: the agent's access rights are allocated and limited to the task.