Control A.5.15Access control
Rules to control physical and logical access to information and other associated assets must be established and implemented, based on business and information security requirements.
This is the parent control of the access family — identity in A.5.16, credentials in A.5.17, rights in A.5.18, restriction in A.8.3, privileged access in A.8.2 — and what it asks for is the policy: on what basis access is granted at all.
The basis is business and security requirements, not convenience and not history. In practice that means deciding between role-based, attribute-based or another model, deciding where need-to-know applies, and deciding how access is authorised and by whom.
The recurring failure is an access model that exists in a document and not in the systems. Where rights are granted by copying an existing user, the model degrades with every joiner, and each new person inherits an accumulation that nobody has ever justified — which A.5.18’s review then has to unpick without knowing what was intended.
How to put this in place
Access decisions made case by case drift into inconsistency and excess. A written rule based on need-to-know gives approvers and administrators the same starting point.
- Decide the principles: need-to-know and least privilege.
- Define standard role-based access for common jobs, so most requests are routine.
- Write the request, approval, review and removal steps into an access control policy.
- Make sure the approver is never the person who grants the access.
- Apply it to a sample of systems and review it yearly; see also A.5.16 and A.5.18.
Evidence an auditor usually looks for: the approved access control policy, role definitions, and a sample of access grants traced to approvals.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists rules for access control among the documents auditors commonly expect for this control.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge.