A.5.15
Access control
Organizational controlsCheckpoints 6Evidence 6Cases 6
Control objective
This control requires the organization to establish and implement rules that grant or restrict physical and logical access to information and associated assets on the basis of business needs and information security requirements. The intent is to grant only the minimum rights required according to need-to-know and need-to-use, and to block unauthorized access, thereby reducing the risk of exposure, alteration, or damage of information and of service misuse. The organization should document an access control policy and apply access rules consistently in line with asset classification and risk level, managing access across users, systems, and network services.
Key checkpoints
- Is an access control policy (rules) documented on the basis of business and information security requirements, reflecting least privilege and segregation of duties?
- Are access rules defined according to asset classification/criticality and user roles, covering both physical and logical access?
- Is access to networks and network services restricted to the scope explicitly authorized for business needs?
- Are the granting, modification, and revocation of access rights performed through an approval procedure and recorded?
- Is the adequacy of access rules reviewed periodically and updated to reflect organizational and risk changes?
- Is the access control policy communicated to relevant employees and external parties and applied consistently?
Implementation guidance
- Document the access control policy and state its core principles, including need-to-know/need-to-use, least privilege, and consideration of segregation of duties.
- Define access rules according to asset classification level and risk assessment results, and choose an authorization model suited to the organization, such as role-based (RBAC) or attribute-based (ABAC).
- Manage physical access (protected areas/facilities) and logical access (systems/applications/databases/networks) consistently under one policy framework.
- Limit access to networks and network services to the explicitly authorized scope, and set the baseline policy to deny by default.
- Define procedures for requesting, approving, granting, modifying, and revoking access rights, and designate the owner and required records for each step.
- Review access rights periodically to prevent excessive accumulation, and promptly adjust or revoke rights upon role change, resignation, or contract termination.
- Check the consistency between access rules and actual granted results (whether policy matches real configuration) and retain the history.
Evidence
- Access control policy/guideline documents (including principles, scope, and authorization model)
- Access rule definitions linked to asset classification/criticality (such as a role-based permission matrix)
- Records of requesting/approving/granting/modifying/revoking access rights
- Network and network service access approvals and configurations (firewall/access control lists, and so on)
- Results of periodic access rights reviews and records of resulting actions
- Records of access control policy communication/training
Nonconformity examples
- No documented access control policy exists, or one exists but does not reflect core principles such as least privilege and segregation of duties.
- The same access rights are granted uniformly regardless of asset classification or risk level, leaving access uncontrolled.
- Network service access is open by default, allowing access beyond the scope authorized for business needs.
- Rights are granted, modified, or revoked arbitrarily without an approval procedure or records.
- Existing access rights are not revoked after a role change or resignation, so unnecessary rights remain.
- Access rights reviews are not performed, so the policy and the actual system configuration are inconsistent.