ISO 27001 Annex A 5.18 Access Rights (The Unofficial Zero BS Guide)

ISO 27001 Annex A 5.18 Access rights requires organisations to grant, modify, and revoke access permissions according to business needs. Documented rules ensure staff and third parties receive only the minimum access necessary, stopping data leaks and unapproved use.

Key Takeaways

• Control access lifecycles: Create formal processes to grant, adjust, review, and remove user access rights across all business systems.
• Store rules centrally: Keep access management policies, approval trails, and role profiles in a central document repository.
• Apply least privilege: Ensure users receive only the exact permissions needed to perform their daily job duties.
• Enforce formal approvals: Require asset owners or line managers to authorise every access request before provisioning.
• Conduct periodic access reviews: Check active user privileges on a regular schedule to identify and remove unnecessary permissions.
• Modify rights during role changes: Update and adjust permissions immediately whenever an employee moves to a new internal team.
• Revoke access upon departure: Remove all physical and digital permissions on or before a worker leaves the organisation.
• Restrict administrative privileges: Limit privileged and master access rights to authorised technical staff with strict management oversight.

How to Implement ISO 27001 Annex A 5.18

• Draft an access rights policy: Write a clear access control procedure and store it in your central document repository.
• Define role-based profiles: Group standard permissions into pre-approved job roles to simplify provisioning and prevent privilege creep.
• Establish a formal request process: Use a central ticketing system to log, review, and approve every permission request.
• Implement role change workflows: Set automatic triggers to review and adjust permissions when human resources logs an internal transfer.
• Set prompt offboarding steps: Build an exit checklist to revoke all digital logins, tokens, and physical passes on the worker’s last day.
• Schedule routine access recertifications: Require asset owners to review and re-approve user lists at least once every six months.
• Separate conflicting duties: Prevent fraud by ensuring single users cannot request, approve, and execute sensitive business transactions alone.
• Audit privileged accounts: Keep a dedicated register of administrator accounts and re-verify their necessity quarterly.
• Train managers on access governance: Teach team leaders how to evaluate access requests and conduct thorough access reviews.

---

When you’re ready to bring compliance into one place

---

How to Audit ISO 27001 Annex A 5.18

• Review access policies: Inspect written procedures to verify clear criteria exist for provisioning, modifying, and revoking user permissions.
• Sample access request tickets: Check recent user creations to ensure documented approvals from asset owners exist before access was granted.
• Audit internal mover accounts: Sample records of employees who changed roles to confirm teams removed old, unneeded permissions.
• Check leaver revocation timing: Compare termination dates against account closure logs to confirm timely removal of access rights.
• Verify periodic review records: Inspect completed access review sheets to confirm managers evaluated and signed off user lists on schedule.
• Inspect privileged access lists: Verify that administrative accounts have explicit justification, strict access limits, and regular manager reviews.
• Check segregation of duties: Test critical workflows to ensure system permissions prevent individuals from performing conflicting tasks.
• Review dormant account reports: Confirm teams regularly identify and disable accounts that remain inactive for extended periods.

Audit Evidence Checklist

• Access control policy: Maintain a documented access rights policy with complete version history in your central repository.
• Approved access request forms: Supply signed tickets and authorization logs showing manager approval for granted permissions.
• Periodic access review sign-offs: Provide signed records and action logs from regular user permission reviews.
• Role change adjustment records: Supply audit tickets showing modified permissions during internal departmental transfers.
• Completed leaver checklists: Provide records showing the prompt revocation of physical and digital access for departed workers.
• Privileged access register: Maintain an active inventory of all administrator accounts and elevated permission holders.
• Segregation of duties matrix: Supply documented rules showing how conflicting roles and permissions stay separated across systems.

What to Teach Employees

• Request only necessary access: Teach workers to ask only for the specific file and system permissions needed for current work tasks.
• Never share login credentials: Instruct staff that passwords and multi-factor codes must stay private and never be shared with colleagues.
• Report excess permissions: Encourage employees to notify administrators if they retain access to files or tools from previous roles.
• Lock screens when away: Instruct workers to lock computer displays whenever stepping away from desks to prevent unauthorised use.
• Understand approval steps: Teach managers that signing off access requests requires checking business justification, not just rubber-stamping.
• Protect elevated privileges: Remind administrators to use privileged accounts only for technical maintenance, using standard accounts for everyday work.

Common Implementation Challenges

• Accumulating privilege creep: Staff change departments and keep old permissions. Require a complete access reset during internal role changes.
• Delayed leaver deprovisioning: Human resources notifies IT days after workers depart. Integrate HR records with access management to automate removal.
• Rubber-stamp access reviews: Managers approve review lists without checking actual needs. Provide concise, high-risk user summaries to focus reviews.
• Excessive administrative rights: Too many users hold permanent administrative access. Implement temporary, just-in-time elevation workflows.
• Orphaned shared accounts: Generic team logins bypass individual accountability. Replace shared logins with named individual user accounts.
• Informal access requests: Managers request permissions via casual chat messages. Mandate formal tickets for all access changes.

How to Measure Effectiveness (KPIs)

• Timely access revocation rate: Track the percentage of departing workers whose accounts are disabled within target operational deadlines.
• Access review completion rate: Measure the proportion of scheduled periodic user access reviews completed and signed off on time.
• Dormant account count: Monitor the number of active accounts showing no user login activity for over ninety days.
• Privileged account ratio: Track the percentage of total user accounts holding administrative or elevated privileges across systems.
• Mover permission cleanup speed: Measure the average time taken to remove obsolete permissions following an internal job transfer.
• Access rights audit finding count: Monitor the number of non-conformities raised against user permissions during internal audits.

Related ISO 27001 Controls

ISO 27001 Control A 5.18 connects to several other ISO 27001 requirements:

Annex A 5.18 depends on Clause 5.15 (Access Control) for its policy foundation. It supports Clause 5.16 (Identity Management) by linking rights to verified identities. This control also interacts with Clause 8.2 (Privileged Access Rights). Each permission granted must also satisfy the “need-to-know” principle defined in Clause 5.10.