ISO 27001 A.5.15 - Access Control

Requirement

“Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.”

Plain-language meaning

The organization must define and enforce rules for who can access information, systems, services, networks, applications, repositories, and physical locations.

Access should be based on business need, information security requirements, classification, legal requirements, and asset owner approval. Anything not needed should be denied. That is least privilege.

Why this matters

Access control is one of the core protections for confidentiality, integrity, and availability. Weak access control gives people more access than their job requires, lets old access persist after role changes, and makes sensitive information available to people who do not need it.

Access control applies to:

• business applications;
• file shares and collaboration spaces;
• databases and repositories;
• networks and cloud platforms;
• privileged administration;
• physical areas containing information;
• business systems such as calendars, HR systems, finance systems, and ticketing tools.

Implementation guidance

1. Define an access control policy

The policy should define:

• access control principles;
• least privilege;
• need-to-know and need-to-use;
• asset owner approval;
• role-based access profiles;
• treatment of privileged access;
• physical access rules;
• access review frequency;
• access removal and change triggers;
• exceptions and emergency access;
• monitoring and logging expectations.

2. Base access on business need

Access should be justified by role, task, asset sensitivity, and business requirement.

Weak justification:

• “Senior manager.”
• “Might need it someday.”
• “Everyone in the department has it.”

Better justification:

• “Payroll specialist needs payroll system write access to process monthly payroll.”
• “Incident responder needs temporary read access to logs during incident IR-2026-04.”
• “Facilities team needs badge access to server room only for escorted maintenance windows.”

3. Use role-based access where practical

Standard role profiles reduce inconsistent individual decisions.

Example:

Role profiles still need review. Bad role profiles just automate excessive access.

4. Link access to classification and asset ownership

Sensitive information needs stronger access rules.

Asset owners should approve access to assets they own or approve standard access models for roles.

Access should align with:

• A.5.9 Inventory of Information and Other Associated Assets;
• A.5.12 Classification of Information;
• A.5.13 Labelling of Information;
• legal and regulatory requirements;
• contractual requirements.

5. Review and remove access

Access rights decay over time.

Review triggers:

• periodic access reviews;
• role change;
• termination;
• project closure;
• supplier contract end;
• classification change;
• incident or misuse;
• system migration;
• privilege elevation.

Managers and asset owners should review whether access remains necessary, not merely whether the user still exists.

Audit guidance

Auditors should verify that access control rules are defined, implemented, traceable, reviewed, and consistent with business and security requirements.

Audit tests:

• review the access control policy;
• sample access rights for sensitive systems;
• trace access to approval and business need;
• check asset owner involvement;
• check access against classification;
• review leavers and movers;
• review privileged access;
• review role-based access profiles;
• check physical access to sensitive locations;
• verify that access reviews lead to removals or corrections.

Auditors should challenge unjustified access, especially for senior roles. Seniority is not a control objective.

Evidence examples

Strong evidence

• Access policy defines least privilege, need-to-know, approval, review, and removal rules.
• Access is traceable to business need and owner approval.
• Role-based profiles are used and reviewed.
• Sensitive assets have tighter access rules.
• Access reviews are completed and result in removals where needed.
• Leavers and movers are promptly updated.
• Privileged and senior-user access is justified and monitored.
• Physical and logical access are both addressed.

Weak evidence

• Access granted because someone asked.
• Senior users have broad access without justification.
• Access review confirms users still exist but not whether access is needed.
• Asset owners do not approve access.
• Role profiles grant excessive access.
• Sensitive repositories are open to broad groups.
• Physical access is not reviewed.
• Access rights remain after job changes.

Common failures

Exam traps

• Access control covers physical and logical access.
• Least privilege means deny access that is not needed for assigned activities.
• Need-to-know and need-to-use both matter.
• Seniority does not justify broad access.
• Role-based access helps manage access, but roles must be designed and reviewed.
• Access rights should be approved and reviewed by asset owners or authorized owners of access profiles.
• Access reviews must test business need, not just account existence.

Related controls and concepts

• A.5.16 Identity Management
• A.5.9 Inventory of Information and Other Associated Assets
• A.5.12 Classification of Information
• A.5.13 Labelling of Information
• A.5.11 Return of Assets
• A.5.2 Information Security Roles and Responsibilities
• Risk Assessment
• Internal Audit

KB-ready summary

A.5.15 requires physical and logical access control rules based on business and security requirements. Access should follow least privilege, need-to-know, need-to-use, classification, asset ownership, role-based profiles where practical, regular review, and prompt update after role or employment changes.

Templates and checklists

• Access Control Matrix
• Access Review Checklist
• A.5.15 Audit Checklist
• Control Owner Register