ISO 27001 A.5.18 - Access Rights

Requirement

“Access rights to information and other associated assets shall be provisioned, reviewed, modified and removed in accordance with the organization’s topic-specific policy on and rules for access control.”

Plain-language meaning

Access rights must be granted, changed, reviewed, and removed through a controlled process.

This is where the access control policy becomes operational. A.5.15 defines access control rules. A.5.16 manages identities. A.5.18 manages the actual access rights assigned to those identities.

Why this matters

Access rights drift. People change roles, join projects, leave teams, become promoted, inherit group membership, or retain access after contract end. If rights are not reviewed and removed, the organization accumulates hidden exposure.

The risk is higher for:

• sensitive information;
• privileged access;
• shared credentials;
• long-tenured staff;
• promoted staff;
• contractors;
• third-party users;
• physical access cards and keys;
• subscriptions, distribution lists, and specialist groups.

Implementation guidance

1. Use formal access requests

Access should be requested and approved before provisioning.

Useful request fields:

2. Provision access based on policy

Provisioning should follow A.5.15 Access Control, A.5.16 Identity Management, and role-based access profiles where practical.

Avoid “special cases” unless they are justified, approved, time-bound, and visible.

3. Review access regularly

Access reviews should compare actual access to authorized access.

Reviewers should check:

• does the person still need access?
• does the access match their current role?
• is privileged access still justified?
• is access consistent with classification?
• should old project or role access be removed?
• are shared credentials still needed?
• are contractors and third parties still active?

The review must result in action. A review that never removes anything is suspect.

4. Modify and remove access promptly

Access should be updated when:

• someone leaves;
• someone changes role;
• a project ends;
• a contract ends;
• a supplier relationship changes;
• an asset classification changes;
• a risk assessment changes;
• an access review finds excess rights.

Removal should cover both physical and logical access: accounts, groups, email, applications, networks, badges, keys, tokens, subscriptions, and interest groups.

5. Handle high-risk terminations carefully

When termination is initiated by management or involves a disaffected employee, contractor, or third-party user, access removal may need to be immediate or pre-coordinated.

The goal is to prevent information collection, disclosure, modification, or destruction during the period between notification and loss of access.

6. Avoid shared credentials

If shared credentials are used, change them whenever any user no longer requires access.

Individual credentials are preferable because they preserve accountability.

Audit guidance

Auditors should sample access registrations, authorizations, actual system permissions, movers, leavers, long-tenured staff, promoted staff, privileged users, and shared credentials.

Audit tests:

• compare access request records to actual access;
• verify asset owner approval;
• check access granted after role changes;
• check old access removed after role changes;
• review leaver access removal timing;
• test physical and logical access removal;
• inspect access review records;
• confirm actual access was compared to authorized access;
• verify changes identified in reviews were completed.

Auditors should interview staff who changed roles. The direct question is: “Do you still have access from your old role?”

Evidence examples

Strong evidence

• Access rights are traceable from request to approval to implementation.
• Actual access is compared against authorized access.
• Reviews include physical, logical, privileged, group, subscription, and third-party access where relevant.
• Mover access is both added and removed promptly.
• Leaver access removal is evidenced.
• Shared credentials are changed when a user leaves the group.
• Review findings lead to completed removals.

Weak evidence

• Access is granted informally.
• Access reviews are just screenshots with no decisions.
• Movers keep old privileges.
• Leavers retain accounts or group memberships.
• Shared credentials are unchanged after users leave.
• Physical access cards and keys are not reviewed.
• Delayed provisioning causes staff to share accounts as a workaround.

Common failures

Exam traps

• A.5.18 is about provisioning, reviewing, modifying, and removing access rights, not merely defining access rules.
• Movers matter as much as leavers.
• Physical access rights are in scope.
• Access reviews should compare actual access to authorized access.
• Senior, long-tenured, and promoted staff are high-risk samples for accumulated access.
• Shared credentials require credential change when a user no longer needs access.

Related controls and concepts

• A.5.15 Access Control
• A.5.16 Identity Management
• A.5.17 Authentication Information
• A.5.11 Return of Assets
• Access Review Checklist
• Access Control Matrix
• Identity Lifecycle Register
• Internal Audit

KB-ready summary

A.5.18 requires access rights to be provisioned, reviewed, modified, and removed according to access control rules. The practical control is traceability: request, approval, implementation, review, correction, and removal should all be evidenced.

Templates and checklists

• Access Rights Request and Review Register
• Access Review Checklist
• A.5.18 Audit Checklist
• Access Control Matrix