A.5.18
Access rights
Organizational controlsCheckpoints 6Evidence 7Cases 6
Control objective
This control requires that access rights to information and other associated assets be provisioned, modified, and revoked based on business need and authorization, and that already-granted rights be reviewed periodically to confirm they remain valid over time. Where the access control policy (A.5.15) sets the rules, this control focuses on the operational activity of assigning actual rights to individual subjects and keeping them current across the whole lifecycle. When provisioning happens without approval, or when rights are not revoked and instead accumulate after a job change or departure, the least-privilege principle breaks down and the risk of privilege misuse and insider threat rises; preventing that is the objective.
Key checkpoints
- Are access rights provisioned/modified/revoked based on business need and the approval of the asset owner (or responsible party), and are these actions recorded?
- Are rights granted only to the minimum scope matching the role/job, in line with the least-privilege and need-to-know principles?
- Are privileged (administrator) rights and rights over sensitive assets treated separately from ordinary rights, with stricter approval, recording, and restriction applied?
- When a subject's status changes (job change/transfer/departure/contract termination), are the associated access rights adjusted or revoked without delay?
- Does the asset owner periodically review the validity of granted access rights, and are unnecessary or excessive rights actually acted upon as a result?
- Are the approved access-right records reconciled against the rights actually configured in systems, and are discrepancies handled?
Implementation guidance
- Standardize the request/approval/execution/recording procedure for access rights, and clearly designate the approver (asset owner/department head) and the recorded fields at each step.
- Define role-based access profiles (RBAC) in line with least-privilege and need-to-know principles, and assign rights only to the minimum scope needed to perform the job.
- Apply a separate, stronger approval process, use-justification records, and time limits (automatic expiry for temporary grants) to privileged accounts and access to sensitive assets.
- Build a workflow linked to HR/contract management so that onboarding/job-change/departure/contract-termination events automatically drive the adjustment or revocation of access rights.
- Define the cycle/scope/reviewer (asset owner) for periodic access-right review (recertification), and keep records of review outcomes and actions taken (revoke/reduce/retain with justification).
- Periodically reconcile the approved access-right records against actual system configuration to detect and clean up unauthorized and residual rights.
- Log the key events for provisioning/modification/revocation of rights so that accountability and after-the-fact verification are possible.
Evidence
- Access-right management procedure (including provisioning/modification/revocation/review steps and approver definitions)
- Per-role access profiles and privilege matrix (RBAC definition document)
- Records of access-right provisioning/modification/revocation requests and approvals
- Approval forms for privileged-account/sensitive-asset rights, with use-justification and grant-period records
- Results of periodic access-right review (recertification) and records of actions taken (revoke/reduce)
- Reconciliation results between the approved access-right records and actual system configuration, with discrepancy-handling records
- HR-linked processing records (rights adjustment and revocation on job change/departure)
Nonconformity examples
- Access rights are provisioned/modified at the operator's discretion without the asset owner's approval.
- On a job change, the rights of the previous role are not revoked and accumulate alongside the new rights, leaving excessive rights in place.
- The access rights of a leaver/contract-terminated party are not revoked, so access remains possible after the status change.
- Periodic access-right review is not performed, or the review is a formality (signature only) that leaves unnecessary rights untouched.
- Privileged (administrator) rights are over-granted to many users and managed without separate approval or records.
- The approved access-right records and actual system configuration are not reconciled, so unauthorized rights exist.