Control A.5.18Access rights
Access rights to information and other associated assets must be provisioned, reviewed, modified and removed in accordance with the organisation’s topic-specific policy on, and rules for, access control.
The operational half of A.5.15, and the one auditors sample hardest because the evidence is unambiguous: a leaver with live access, or a mover holding rights from a previous role, is a finding with no explanation available.
Review is the requirement that distinguishes a functioning process. Provisioning is driven by demand and therefore happens; removal is driven by nothing unless a process drives it. Periodic review is what finds the accumulation, and it works only when the reviewer is the person who understands the business need — an owner approving rights they cannot evaluate produces a signed record and no assurance.
Timeliness for removal is the other half. Rights removed at the next review cycle rather than at the point of departure leave a window whose length is the review interval.
How to put this in place
People change roles and leave, and access that is not adjusted piles up. Running joiner, mover and leaver steps plus reviews keeps access matching today's need.
- Trigger joiner, mover and leaver steps from HR events.
- Require approval from the line manager or system owner for each grant.
- Remove old access when someone moves, not only when they leave.
- Review privileged access more often than ordinary access, for example every 3 months for privileged, 6 months for critical systems and 12 months for the rest.
- Record the changes each review led to.
Evidence an auditor usually looks for: approval records for a sample of grants, leaver removals with dates, and completed access reviews with the changes they led to.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists records of access rights granted, changed, reviewed and removed among the documents auditors commonly expect for this control.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge.