ISO 27001 Annex A 5.15 Access control policies and procedures
What it says
Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSet and apply rules for who can access information and systems based on their security needs.
This control is about setting clear rules for who can enter a company's systems and access its information. It matters because if these rules aren't in place, unauthorised people could get access to sensitive information, potentially leading to data breaches or misuse of data.
Free. Save your status, tasks and notes.
Why it matters
Without defined and implemented access control policies and procedures, logical and physical access may be granted inappropriately, enabling unauthorised access and data breaches.
How to implement
The IT manager should identify which staff members or positions need access to specific systems and information.
This can be done by reviewing job descriptions and understanding the tasks employees need to perform. Once understood, set access permissions based strictly on these needs, ensuring that no unnecessary access is granted.
The HR team should work with the IT department to ensure that physical access to facilities is appropriately restricted.
This involves issuing and maintaining a record of access cards or keys and ensuring visitors sign in and are escorted. Australian regulations, such as the Privacy Act 1988, require safeguarding private information, which includes controlling who physically accesses areas where data is stored.
The board or management should create a written access control policy that outlines the rules for accessing both physical and digital assets.
This policy should be communicated to all employees and include principles like 'need-to-know' and 'least privilege'. It should also reference relevant guidance from ISO 27002:2022.
IT administrators should establish a process for regularly reviewing and updating access rights.
This means checking at intervals that only current employees have access and that their access levels match their roles. Annual reviews or whenever an employee changes jobs or leaves the organisation ensure compliance with Australian standards like CPS 234.
Security and IT staff should set up systems for logging access attempts to sensitive systems.
This involves using tools that can record who accessed what, and when, and setting alerts for unusual access attempts. This aligns with the ASD Essential Eight strategies for improving cyber security resilience.
Keep it running
Regularly review access permissions to align with role changes and prevent privilege creep across the organisation.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The organisation's access control policy document.
Look at
Whether the policy specifies who can access what systems and information.
Good evidence
A detailed document that matches access levels to business needs and includes statements of security principles such as 'need-to-know'.
- Check 2 of 5What an auditor asks for
Ask for
To see a list of current system access permissions and compare this with an employee list.
Look at
How permissions are assigned and if there are any inconsistencies. GOOD is ensuring everyone listed should have the access they do, based on their role.
- Check 3 of 5What an auditor asks for
Ask for
A demonstration of the physical access control system (such as card swipe records).
Look at
Entries and exits recorded over a period to see if any anomalies exist. GOOD means records are consistently logged and can be correlated with employee work schedules.
- Check 4 of 5What an auditor asks for
Ask for
Records of access reviews and adjustments.
Look at
The dates and outcomes of these reviews. GOOD is shown by regular, documented reviews that have led to adjustments in access permissions as needed.
- Check 5 of 5What an auditor asks for
Ask for
Logs of system access over the past month.
Look at
Attempts to access sensitive systems, especially any unsuccessful or unusual attempts. GOOD is when there are documented actions taken for any anomalies found in these logs.
Mappings
Closest match in ASD Essential Eight: E8-MF-ML1.3, Use multi-factor authentication for non-sensitive third-party services, which this control covers in full and more.
ASD Essential Eight: 14 mappings
This control is broader than E8-MF-ML1.3.
Annex A 5.15 requires organisations to establish rules and procedures that control logical access to information based on security requirements. E8-MF-ML1.3 specifies one such rule: using multi-factor authentication for access to non-sensitive third-party online services where available. The Essential Eight requirement is a single authentication control, while Annex A 5.15 is broader and covers policy and procedural governance for access control across assets and access types.
This control is broader than E8-RA-ML1.1.
E8-RA-ML1.1 requires organisations to validate privileged access requests upon initial request. Annex A 5.15 requires establishing and implementing access control policies and procedures based on business and security requirements. E8-RA-ML1.1 is a specific procedural requirement that would typically sit under and be driven by the broader policy framework in Annex A 5.15.
This control is broader than E8-RA-ML1.2.
Annex A 5.15 requires organisations to define and apply access control rules and procedures, including controls over privileged access. E8-RA-ML1.2 requires dedicated privileged accounts for admin tasks, which is a specific account management rule that operationalises separation and control of privileged access. The candidate is narrower because it prescribes one privileged access mechanism rather than the full set of access control policies and procedures required by Annex A 5.15.
This control is broader than E8-RA-ML1.4.
E8-RA-ML1.4 requires enforcing least privilege for privileged accounts that are authorised to access online services. ISO/IEC 27001:2022 Annex A 5.15 is broader, requiring the organisation to establish and implement access control policies and procedures based on business and security requirements, within which least privilege for privileged online access would be defined. The primary is an operational requirement that would typically be implemented under the policy framework described by Annex A 5.15.
- E8-RA-ML1.6Unprivileged user accounts restricted from logging on to privileged environmentsBroader than
This control is broader than E8-RA-ML1.6.
E8-RA-ML1.6 requires a specific access control outcome: unprivileged accounts cannot logon to privileged operating environments. ISO/IEC 27001:2022 Annex A 5.15 requires organisations to establish and implement access control policies and procedures, under which rules like those in E8-RA-ML1.6 would typically be defined. Annex A 5.15 is broader and policy-oriented, while E8-RA-ML1.6 is a concrete technical restriction targeting privileged environment logons.
- E8-RA-ML1.7Prevent privileged user accounts from logging on to unprivileged environmentsBroader than
This control is broader than E8-RA-ML1.7.
Annex A 5.15 requires rules and procedures to control logical access to systems and information based on security requirements. E8-RA-ML1.7 specifies a segregation rule preventing privileged accounts from logging on to unprivileged operating environments, reducing credential exposure and lateral movement. This is a specific access rule that would be captured under the broader access control policy framework required by Annex A 5.15.
This control is broader than E8-RA-ML2.1.
Annex A 5.15 requires access control policies and procedures that define who may access information and systems and under what conditions. E8-RA-ML2.1 sets a specific lifecycle rule for privileged access: disabling it after 12 months unless revalidated. This is a targeted access review/recertification requirement that sits within the broader access governance expectations of Annex A 5.15.
This control is broader than E8-RA-ML2.4.
Annex A 5.15 requires organisations to establish and implement access control policies and procedures for information and systems. E8-RA-ML2.4 mandates conducting administrative activities through jump servers, which is a specific procedural/architectural control for managing privileged access pathways. The candidate is narrower because it focuses on one method of administering systems rather than comprehensive access control policies spanning all users, systems, and physical/logical access contexts.
This control is broader than E8-RA-ML3.1.
Annex A 5.15 requires establishing and implementing access control policies and procedures to ensure access is appropriate to business and security needs. E8-RA-ML3.1 requires limiting privileged access to only what is necessary for duties (least privilege) across systems, applications and repositories, which is a direct access rule that would sit within an access control policy. The candidate is a subset of Annex A 5.15 because it addresses privileged access scope, not the full range of access control rules and procedures.
- E8-RA-ML3.3Just-in-time administration is used for administering systems and applications.Broader than
This control is broader than E8-RA-ML3.3.
Annex A 5.15 requires organisations to establish and implement access control policies and procedures, including governance for privileged access. E8-RA-ML3.3 requires just-in-time administration for administering systems and applications, which is a specific method for limiting the duration and scope of privileged access. The Essential Eight control is an implementation pattern for privileged access management, while Annex A 5.15 is broader and technology-agnostic.
This control is broader than E8-RB-ML1.5.
Annex A 5.15 requires access control rules and procedures governing who can access information assets. E8-RB-ML1.5 mandates that unprivileged accounts cannot access backups belonging to other accounts, restricting unauthorised access to backup data. This is a specific access restriction that fits within the broader access control policy scope of Annex A 5.15.
This control is broader than E8-RB-ML1.6.
Annex A 5.15 requires access control policies and procedures that govern who can access and change information and systems. E8-RB-ML1.6 implements a specific access rule by preventing unprivileged accounts from modifying and deleting backups. This is a subset of the broader access control policy requirements in Annex A 5.15, focused specifically on protecting backup integrity.
This control is broader than E8-RB-ML3.1.
E8-RB-ML3.1 requires that unprivileged accounts cannot access their own backups. ISO/IEC 27001:2022 Annex A 5.15 is broader, requiring the organisation to establish and implement access control policies and procedures across assets, which would include backup systems and data. E8-RB-ML3.1 represents a concrete, topic-specific rule that would be implemented under the wider policy framework required by Annex A 5.15.
This control is broader than E8-RM-ML1.1.
E8-RM-ML1.1 mandates a specific access rule: users without business need must not be able to run Office macros. Annex A 5.15 requires organisations to establish and implement access control rules based on business and security requirements, under which a 'no macros unless justified' policy would sit. Annex A 5.15 is broader and more governance-focused, while E8-RM-ML1.1 is a concrete technical restriction.
ASD Information Security Manual: 95 mappings
This control is broader than ISM-0217.
Annex A 5.15 requires organisations to define and implement physical and logical access control rules for assets. ISM-0217 provides specific physical access restrictions and conditions for cabinets housing TOP SECRET and non-TOP SECRET patch panels, including clearance requirements and authorising officer approval. ISM-0217 is a highly specific physical access control scenario, whereas Annex A 5.15 is a broad requirement to have access control policies and procedures across assets.
This control is broader than ISM-0269.
Annex A 5.15 requires organisations to define and implement rules controlling access to information based on business and security requirements. ISM-0269 applies that principle to email handling by prohibiting sending AEO/AGAO/REL data to distribution lists unless all recipients' nationalities can be confirmed. ISM-0269 is a specific logical access/disclosure rule within communications, whereas Annex A 5.15 covers access control policy and procedures across the organisation more generally.
This control is broader than ISM-0343.
Annex A 5.15 requires access control rules and procedures for controlling access to information and associated assets. ISM-0343 requires disabling write access to removable media and devices when there is no business requirement, using technical controls to enforce the rule. This is a specific access control restriction for a particular interface/asset type, while Annex A 5.15 has broader scope across physical and logical access control requirements.
- ISM-0382Prevent unprivileged human users uninstalling or disabling approved applicationsBroader than
This control is broader than ISM-0382.
ISM-0382 requires preventing standard users from uninstalling or disabling approved applications to maintain the organisation's approved software baseline. ISO/IEC 27001:2022 Annex A 5.15 requires establishing and implementing rules and procedures to control logical access to assets based on business and security requirements, which typically includes restricting local admin capabilities and software management permissions. ISM-0382 is a specific rule that would sit under the broader access control policy framework required by Annex A 5.15.
This control is broader than ISM-0405.
Annex A 5.15 requires organisations to establish and implement access control policies and procedures based on business and security requirements. ISM-0405 requires validation of requests for unprivileged access when first requested, which is an access provisioning control supporting least privilege. ISM-0405 is a specific procedural step within the wider access management rules and processes expected by Annex A 5.15.
This control is broader than ISM-0407.
ISM-0407 requires maintaining a secure lifetime access record for each human user, including who authorised access, what level was granted, and when it was reviewed/changed/removed. ISO/IEC 27001:2022 Annex A 5.15 requires the organisation to establish and implement access control rules and procedures for physical and logical access based on business and security requirements. ISM-0407 provides concrete evidentiary recordkeeping that supports and evidences those procedures, but Annex A 5.15 is broader because it covers the overall access control policy framework beyond record retention for individual users.
This control is broader than ISM-0411.
ISM-0411 requires foreign nationals (excluding seconded foreign nationals) to be prevented from accessing AGAO data on systems unless effective controls ensure the data is not accessible to them. Annex A 5.15 demands an organisation to establish and implement access control policies and procedures based on security requirements. ISM-0411 is a specific nationality-based access restriction use case typically encompassed within the broader access control policy framework described in Annex A 5.15.
This control is broader than ISM-0415.
ISM-0415 requires governance over shared accounts and ensures actions performed using them are uniquely attributable to a specific user. ISO/IEC 27001:2022 Annex A 5.15 establishes access control rules, policies and procedures, which supports ISM-0415 by providing the policy foundation to restrict when shared accounts can exist and under what conditions they may be used. Annex A 5.15 is higher-level and does not explicitly mandate traceability of shared-account usage to named individuals.
This control is broader than ISM-0418.
ISM-0418 requires a specific rule for handling physical credentials: keep them separate from the systems they authenticate to except during authentication. Annex A 5.15 requires organisations to establish and implement access control policies and procedures covering both physical and logical access based on business and security requirements. ISM-0418 is an example of a concrete procedural requirement that would typically sit under an Annex A 5.15 access control policy, but it does not by itself cover the full policy and procedural scope demanded by Annex A 5.15.
This control is broader than ISM-0428.
ISM-0428 requires services to enforce session locking after defined inactivity/maximum duration, fully block session content while locked, require re-authentication using all factors to resume, and prevent users disabling the lock. Annex A 5.15 (Access Control Policies and Procedures) requires establishing and implementing logical access rules and procedures, under which session timeout/lock rules, lock-screen content suppression, and re-authentication requirements would be specified and governed. ISM-0428 is therefore a prescriptive technical rule-set that would sit underneath and implement part of the broader policy/procedure framework required by Annex A 5.15.
This control is broader than ISM-0430.
ISM-0430 requires rapid deprovisioning by removing or suspending access the same day it is no longer legitimately required. Annex A 5.15 establishes the rules, policies, and procedures for controlling logical (and physical) access, which is the governance mechanism that typically defines when access should be removed and who authorises it. Annex A 5.15 does not itself mandate same-day revocation, but it supports implementing ISM-0430 by providing the policy basis and process triggers for timely access removal.
This control is broader than ISM-0432.
ISM-0432 requires that access requirements for each system and its resources be documented in the system's security plan. Annex A 5.15 requires the organisation to establish and implement access control rules based on business and security needs, which should be captured at a system level. The ISO control is broader as it mandates the existence and implementation of access control rules, while ISM-0432 focuses specifically on documentation of system-specific access requirements in the security plan.
This control is broader than ISM-0441.
ISM-0441 requires that temporary system access be constrained to only the data required to perform assigned duties. Annex A 5.15 establishes the overarching requirement to define and implement rules for physical and logical access based on business and information security requirements. ISM-0441 is a specific application of that policy requirement to the temporary-access scenario and emphasises restricting access to necessary data.
This control is broader than ISM-0443.
ISM-0443 prohibits granting temporary access to systems that process, store or communicate caveated or sensitive compartmented information. ISO/IEC 27001:2022 Annex A 5.15 requires an organisation to establish and implement access control policies and procedures based on business and security requirements, within which a rule like "no temporary access for SCI/caveated systems" would be defined. Annex A 5.15 is broader (policy framework), while ISM-0443 is a specific, high-assurance prohibition for a particular classification context.
This control is broader than ISM-0447.
Annex A 5.15 requires organisations to establish and implement rules and procedures to control logical and physical access to information and associated assets based on business and security requirements. ISM-0447 is a specific access control policy rule restricting privileged access for foreign nationals to systems handling AGAO data. ISM-0447 is a narrow, classification- and nationality-based constraint within the broader access control policy framework required by Annex A 5.15.
This control is broader than ISM-0487.
ISM-0487 requires organisations to harden passwordless SSH logins by disabling specific SSH capabilities such as port forwarding, agent forwarding, X11 forwarding, and restricting source IPs. This aligns with Annex A 5.15 because these SSH restrictions serve as concrete technical rules implementing an access control policy for logical access. Annex A 5.15 expects an organisation-wide access control framework beyond SSH and passwordless authentication scenarios.
This control is broader than ISM-0489.
ISM-0489 requires that where SSH-agent (or similar) key caching is used, it is only on workstations/servers with screen locks and the key cache expires within four hours of inactivity. This relates to ISO/IEC 27001:2022 Annex A 5.15 because it is a concrete access-control rule and procedure that an organisation would implement under its overarching access control policies. Annex A 5.15 is broader and does not prescribe SSH-agent use, screen lock presence, or a four-hour inactivity expiry requirement.
This control is broader than ISM-0530.
ISM-0530 requires a specific access rule: VLAN-managing network devices must be administered from the most trusted security domain. This fits within Annex A 5.15, which requires organisations to establish and implement rules for logical access based on business and security requirements. Annex A 5.15 is broader and covers access control policy and procedures across many asset types, while ISM-0530 is a specific policy requirement for the network management plane.
This control is broader than ISM-0551.
ISM-0551 mandates specific access control configuration for IP telephony, including authenticated registration, disabling auto-registration, and default-deny for unauthorised devices and functions. Annex A 5.15 requires the organisation to establish and implement access control policies and procedures based on business and security requirements. ISM-0551 is a specific technical control that would typically be required by, and sit underneath, the broader policy/procedure expectations of Annex A 5.15.
This control is broader than ISM-0611.
ISM-0611 requires that gateway administrators are assigned only the minimum privileges required for their duties. ISO/IEC 27001:2022 Annex A 5.15 requires access control policies and procedures to be established and implemented based on business and security requirements. ISM-0611 is a concrete least-privilege rule that would normally be expressed and enforced through the policies and procedures required by Annex A 5.15.
This control is broader than ISM-0622.
ISM-0622 requires IT equipment to prove its identity to networks reached through gateways, which is a specific logical access control requirement for inter-network access. Annex A 5.15 establishes rules and procedures to control physical and logical access to information assets, under which device authentication at gateways is a concrete implementation. Annex A 5.15 is broader because it covers policy and procedures for access control across all assets and access methods, not only device-to-network authentication through gateways.
- ISM-0665CISO verifies and authorises trustworthy sources for SECRET and TOP SECRET systemsBroader than
This control is broader than ISM-0665.
ISM-0665 limits trustworthy sources for SECRET/TOP SECRET systems to CISO-verified entities, which is a specific governance rule. Annex A 5.15 of ISO/IEC 27001:2022 provides general access control policies, within which ISM-0665's trust-source designations can be codified.
This control is broader than ISM-0687.
ISM-0687 requires that mobile devices used to access SECRET or TOP SECRET systems/data are on ASD-approved mobile platforms and operated per the relevant Australian Communications Security Instruction. Annex A 5.15 requires an organisation to establish and implement access control policies and procedures for physical and logical access based on business and security requirements. ISM-0687 is a specific, high-assurance implementation constraint for a particular access scenario (secure mobile access to classified systems) that would typically be expressed within an Annex A 5.15 access control policy framework.
This control is broader than ISM-0694.
ISM-0694 mandates that privately-owned devices are not permitted to access SECRET and TOP SECRET systems or data. Annex A 5.15 requires organisations to establish and implement rules for physical and logical access based on business and security requirements, which would include defining BYOD and classified network access rules. ISM-0694 is a specific rule within the broader policy/procedure framework required by Annex A 5.15.
This control is broader than ISM-0854.
ISM-0854 sets a strict rule about where and on what systems AUSTEO and AGAO data may be accessed (Australian Government solely controlled systems in authorised facilities). Annex A 5.15 requires organisations to define and implement access control policies and procedures for physical and logical access based on business and security requirements. ISM-0854 can be implemented as a specific access control policy rule under Annex A 5.15, while Annex A 5.15 covers a much wider scope of access control governance and procedures beyond these datasets.
This control is broader than ISM-1006.
ISM-1006 requires security measures to prevent unauthorised access to network management traffic. ISO/IEC 27001:2022 Annex A 5.15 requires access control policies and procedures for controlling physical and logical access to information assets, which would include governing access to network management systems and their management traffic. ISM-1006 is a specific requirement within that broader access control policy framework.
This control is broader than ISM-1014.
ISM-1014 requires individual logins for IP phones used for SECRET or TOP SECRET conversations to ensure user-specific access and accountability. Annex A 5.15 requires the organisation to establish and implement access control rules and procedures for both physical and logical access based on business and security requirements, under which per-user phone logins would be one concrete control. ISM-1014 is narrower, focusing on a particular asset type (IP phones) and use case (classified conversations), while Annex A 5.15 covers access control more generally across assets and environments.
This control is broader than ISM-1182.
Annex A 5.15 requires rules to control logical and physical access to information and assets based on business need. ISM-1182 mandates network access controls to restrict traffic flows between segments to what is required for business purposes, which is a specific form of logical access restriction. Annex A 5.15 is broader because it covers all access control policy/procedure domains (users, systems, data, physical entry), not only network segmentation and traffic flow.
This control is broader than ISM-1250.
ISM-1250 requires organisations to implement least-privilege file system permissions for server application accounts. Annex A 5.15 requires establishing and implementing access control rules and procedures based on business and information security requirements, under which server application account permissions would be defined. ISM-1250 is narrower, focusing on a specific control outcome rather than the full policy/procedure framework in Annex A 5.15.
This control is broader than ISM-1255.
ISM-1255 requires restricting what database users can do to database contents based on their duties or functions. Annex A 5.15 requires establishing and implementing access control rules for physical and logical access to information and associated assets based on business and security requirements. ISM-1255 fits within Annex A 5.15 as a specific logical access rule for database-level permissions and actions.
This control is broader than ISM-1256.
ISM-1256 requires applying file permissions to database files to protect them from unauthorised access. Annex A 5.15 requires organisations to establish and implement access control rules and procedures for physical and logical access based on business and security requirements. ISM-1256 fits as a concrete database-file control that would be defined and governed under the broader policy/procedure framework in Annex A 5.15.
This control is broader than ISM-1392.
ISM-1392 requires a concrete access restriction outcome: only approved users can modify approved files and write to approved folders when path-based application control is used. Annex A 5.15 requires establishing and implementing access control rules (physical and logical) based on business and security requirements. ISM-1392 is one specific logical access rule implementation (file system write/modify restrictions) within the broader policy/procedure requirements of Annex A 5.15.
This control is broader than ISM-1403.
ISM-1403 requires user accounts (except break glass accounts) to be locked after a maximum of five failed logon attempts, addressing specific risks like brute-force attacks. Annex A 5.15 requires organisations to develop and apply access control policies and procedures, under which account lockout thresholds and exceptions are specified. ISM-1403 acts as a specific technical measure within this broader policy framework.
This control is broader than ISM-1404.
ISM-1404 mandates a specific access control rule: disabling unprivileged access after 45 days of inactivity. Annex A 5.15 requires organisations to establish and implement access control policies and procedures based on business and security requirements. ISM-1404 can be implemented as a specific procedure/rule under the policy framework described by Annex A 5.15, but Annex A 5.15 is broader and does not prescribe a 45-day inactivity threshold.
This control is broader than ISM-1418.
ISM-1418 requires disabling unnecessary removable media and device reading via device access control or disabling external interfaces. Annex A 5.15 requires establishing and implementing access control policies and procedures for physical and logical access to information and associated assets based on business requirements. ISM-1418 is a specific access control rule for a particular asset/interface class (removable media), while Annex A 5.15 is a broader control framework that would include such rules among many others.
This control is broader than ISM-1432.
ISM-1432 requires organisations to protect online service domain names by using registrar locking and confirming domain registration details are correct. Annex A 5.15 requires establishing and implementing rules to control logical access to information and associated assets, which can include controlling access to domain registrar accounts and DNS management portals. ISM-1432 is a specific, domain-hijacking-focused implementation, whereas Annex A 5.15 is a broader access control policy and procedure requirement.
This control is broader than ISM-1487.
ISM-1487 requires that only privileged macro-vetting users can write to and modify Microsoft Office Trusted Locations, with other users effectively limited to read-only access. ISO/IEC 27001:2022 Annex A 5.15 establishes the broader requirement to define and implement access control rules and procedures based on business and security needs, under which this Trusted Locations restriction would be one concrete rule. Annex A 5.15 spans all assets and access scenarios, whereas ISM-1487 is a specific, technology- and threat-focused access rule for macro-related risk.
This control is broader than ISM-1505.
ISM-1505 requires MFA to be used to authenticate users of data repositories. ISO/IEC 27001:2022 Annex A 5.15 requires establishing and implementing access control policies and procedures for controlling logical and physical access to information and associated assets. ISM-1505 is a specific logical access control mechanism that would typically be mandated within, and is therefore a subset of, the broader policy/procedural requirements in Annex A 5.15.
This control is broader than ISM-1508.
ISM-1508 requires that privileged access is limited to only what is required for duties or functions. ISO/IEC 27001:2022 Annex A 5.15 is broader because it requires establishing and implementing overall physical and logical access control rules based on business and security requirements. ISM-1508 is one specific rule (least privilege for privileged access) that should be embedded within the wider policy and procedure framework of Annex A 5.15.
This control is broader than ISM-1530.
ISM-1530 requires classified servers, network devices and cryptographic equipment to be physically secured in security containers appropriate to their classification and the security zones they are located within. ISO/IEC 27001:2022 Annex A 5.15 requires the organisation to establish and implement rules for controlling both physical and logical access to information and associated assets. ISM-1530 is a specific physical protection mechanism that sits within the broader access control policy and procedures expected by Annex A 5.15.
This control is broader than ISM-1604.
ISM-1604 requires hardening of the virtual server isolation mechanism and restricting access to the administrative interface used to manage it. Annex A 5.15 sets the overarching requirement to establish and implement access control rules and procedures for logical access to assets, which includes hypervisor management interfaces. ISM-1604 is a specific technical application of access control policy to virtualisation administration rather than a full access control policy framework.
This control is broader than ISM-1611.
ISM-1611 requires break glass accounts to be used only when normal authentication processes cannot be used (i.e., emergency-only use). Annex A 5.15 requires organisations to establish and implement access control policies and procedures, within which break glass account conditions would be defined. ISM-1611 is a specific access-control rule, while Annex A 5.15 is a broader governance requirement covering many access scenarios beyond emergency access.
This control is broader than ISM-1612.
Annex A 5.15 requires defined access control policies and procedures, including rules governing elevated access. ISM-1612 mandates that break glass accounts are only used for specific authorised activities, which is a concrete procedural rule for exceptional privileged access. Annex A 5.15 covers the broader set of access control rules (including provisioning, review, and enforcement) beyond emergency account usage.
This control is broader than ISM-1649.
ISM-1649 requires organisations to use just-in-time administration to control when administrative access is granted for system administration. Annex A 5.15 requires organisations to establish and implement access control policies and procedures governing logical (and physical) access based on business and security requirements. ISM-1649 is a specific privileged-access pattern that can sit under the broader ISO requirement for access control governance.
This control is broader than ISM-1746.
ISM-1746 requires a specific access restriction: only approved users can change file system permissions for approved files and folders used in path-based application control. Annex A 5.15 is broader, requiring organisations to establish and implement access control policies and procedures for logical and physical access based on business and security requirements. ISM-1746 is an implementation-level rule that would typically sit under the access control policy framework mandated by Annex A 5.15.
This control is broader than ISM-1813.
Annex A 5.15 requires rules and procedures to control logical access to information assets. ISM-1813 mandates a specific rule that unprivileged user accounts cannot access their own backups, restricting read access to backup data. The ISM control is a narrow access restriction for a particular asset class (backups), while Annex A 5.15 covers broader access control policy across all assets and access scenarios.
This control is broader than ISM-1816.
ISM-1816 requires controls to prevent unauthorised changes to the authoritative source for software. Annex A 5.15 complements this by requiring documented access control policies and procedures, essential for managing roles and approvals for who can change software sources. While Annex A 5.15 applies broadly, ISM-1816 specifically targets software source integrity.
This control is broader than ISM-1832.
ISM-1832 requires that SPNs are only set on service and computer accounts to reduce unnecessary exposure in Active Directory. This aligns with Annex A 5.15 because limiting SPN assignment is an access control rule for a sensitive authentication-related attribute that can affect how identities are used in the environment. Annex A 5.15 is broader as it requires access control policies and procedures across information assets, not a specific AD attribute control.
This control is broader than ISM-1839.
ISM-1839 requires that Active Directory account properties visible to unprivileged users are not used to store passwords. Annex A 5.15 requires organisations to establish and implement access control policies and procedures governing logical access more broadly, within which prohibiting password storage in visible directory attributes is a specific rule. ISM-1839 is a concrete, directory-specific implementation detail, while Annex A 5.15 is policy/procedure-level and technology-agnostic.
This control is broader than ISM-1841.
ISM-1841 requires restricting the ability to join computers to a domain so that unprivileged users cannot perform domain joins. Annex A 5.15 requires organisations to define and implement access control policies and procedures for logical (and physical) access based on business and security requirements. ISM-1841 is a specific technical/policy rule that would typically be implemented under the broader access control policy framework required by Annex A 5.15.
This control is broader than ISM-1844.
Annex A 5.15 requires rules and procedures that control logical access to systems and associated services. ISM-1844 enforces a specific Active Directory trust/authorisation rule by preventing non-domain controller computer accounts from being trusted for delegation to services. This is a narrow technical access/authorisation restriction that would be governed under the broader access control policy and procedural requirements of Annex A 5.15.
This control is broader than ISM-1852.
ISM-1852 requires that unprivileged users only have access to systems and resources needed for their duties. Annex A 5.15 requires establishing and implementing rules and procedures to control physical and logical access based on business and information security requirements. ISM-1852 is a specific rule outcome (least privilege for unprivileged access) that would typically be implemented under the broader access control policy and procedures of Annex A 5.15.
This control is broader than ISM-1854.
ISM-1854 mandates user authentication at MFDs before use. Annex A 5.15 involves governing access to information assets based on security requirements. ISM-1854 implements this for MFDs specifically but doesn't cover the complete policy framework.
This control is broader than ISM-1888.
ISM-1888 requires mobile devices to have secure password-based lock screens to prevent unauthorised access. ISO/IEC 27001:2022 Annex A 5.15 requires organisations to establish and implement rules for logical access control based on business and security requirements. While Annex A 5.15 encompasses a wider range of access control measures, mobile device lock screens are a typical implementation of such controls.
This control is broader than ISM-1920.
ISM-1920 requires that users are prevented from self-enrolling MFA from untrustworthy devices when accessing services handling sensitive data. ISO/IEC 27001:2022 Annex A 5.15 requires establishing and implementing logical access control rules and procedures based on security requirements, which can include policies restricting MFA enrolment to trusted devices. Annex A 5.15 is broader (overall access control governance), while ISM-1920 is a specific access-control rule focused on MFA enrolment context and device trust.
This control is broader than ISM-1927.
ISM-1927 requires limiting access to specific identity systems (domain controllers, AD CS/AD FS servers, and Entra Connect) to only privileged users who require it. ISO/IEC 27001:2022 Annex A 5.15 requires an organisation-wide set of access control policies and procedures governing physical and logical access based on business and security requirements. ISM-1927 is a specific, technical access-control restriction that would typically be implemented under the broader policy framework required by Annex A 5.15.
This control is broader than ISM-1928.
ISM-1928 requires strict logical access control for AD/Entra Connect server backups, limiting access to backup administrator accounts and applying ASD-approved encryption to protect confidentiality. ISO/IEC 27001:2022 Annex A 5.15 requires establishing and implementing access control policies and procedures for information and associated assets, which would include defining who can access backups and under what conditions. ISM-1928 is a specific access-control application to a particular asset class (identity-server backups) and adds an explicit cryptography requirement beyond generic access policy expectations.
This control is broader than ISM-1933.
ISM-1933 requires an explicit logical access restriction: SPN service accounts must not have DCSync (directory replication) permissions. Annex A 5.15 requires establishing and implementing access control policies and procedures, which would include rules governing assignment of highly privileged directory rights and prohibiting risky privilege combinations on service identities. ISM-1933 is a specific technical policy outcome for Active Directory, whereas Annex A 5.15 is a high-level requirement covering policy and procedural controls for access more generally.
This control is broader than ISM-1934.
ISM-1934 requires periodic governance over a specific privileged permission (DCSync) by reviewing authorised accounts and removing access that is no longer required. Annex A 5.15 requires establishing and implementing access control policies and procedures based on business and information security requirements, under which review-and-removal processes for privileged rights would be defined. ISM-1934 is narrower because it prescribes a particular control activity for one permission rather than the broader policy and procedural framework.
This control is broader than ISM-1936.
ISM-1936 addresses a specific logical access control weakness by requiring organisations not to use the sIDHistory attribute on user accounts. This aligns with Annex A 5.15 because prohibiting sIDHistory use is an implementation-level rule that would sit under an organisation's logical access control policies and procedures. Annex A 5.15 is broader, requiring establishment of access control rules generally, whereas ISM-1936 prescribes one particular rule for AD identity security.
This control is broader than ISM-1946.
ISM-1946 requires organisations to enforce a specific logical access rule: unprivileged users must not be able to write to certificate templates. This aligns with Annex A 5.15 as certificate template permissions are an access control rule that should be defined and implemented based on information security requirements. Annex A 5.15 is broader because it addresses organisation-wide access control policies and procedures, whereas ISM-1946 is a targeted technical restriction for PKI template objects.
This control is broader than ISM-1948.
ISM-1948 requires certificate manager approval for certificate templates that allow a requester-supplied SAN, constraining how certificates (and thus authentication/identity assertions) can be issued. Annex A 5.15 requires organisations to establish and implement access control policies and procedures based on business and security requirements, which can include controls over certificate-based access and identity assertions. ISM-1948 is a specific access/identity control within the broader policy and procedure requirements of Annex A 5.15.
This control is broader than ISM-1958.
ISM-1958 requires that accounts with DCSync permissions are technically prevented from logging on to unprivileged operating environments. Annex A 5.15 requires organisations to establish and implement rules for logical access based on business and security requirements, which would include defining where highly privileged identities may authenticate. ISM-1958 is a specific, Active Directory-centric enforcement of an access control policy rule that Annex A 5.15 expects at a higher level.
This control is broader than ISM-1985.
ISM-1985 requires restricting who can access event logs to authorised individuals. Annex A 5.15 relates by requiring access control rules and procedures to be established and implemented across information assets, which would govern access to log repositories and log management systems. ISM-1985 is a specific, log-focused instance of the broader access control governance required by Annex A 5.15.
This control is broader than ISM-2014.
ISM-2014 focuses on enforcing client authentication and authorisation when internal network APIs are called to access non-public data. ISO/IEC 27001:2022 Annex A 5.15 requires establishing and implementing rules for logical (and physical) access control, which would typically include API access rules and identity/authorisation mechanisms. Annex A 5.15 is broader policy/procedure coverage across all access scenarios, while ISM-2014 is a concrete requirement for API client access decisions.
This control is broader than ISM-2048.
ISM-2048 requires a specific access control outcome: non-admin users are blocked from changing their own permissions or privileges in role-based systems. ISO/IEC 27001:2022 Annex A 5.15 relates by requiring organisations to establish and implement access control policies and procedures that would define who is authorised to change permissions and how changes are approved. Annex A 5.15 is broader because it addresses policy and procedural controls across physical and logical access, while ISM-2048 is a targeted technical restriction within applications.
This control is broader than ISM-2092.
ISM-2092 requires organisations to implement access control policies that enforce fine-grained permissions specifically for artificial intelligence applications. ISO/IEC 27001:2022 Annex A 5.15 requires establishing and implementing general rules and procedures for logical and physical access based on business and security requirements. ISM-2092 is effectively a specific, AI-focused instantiation of the broader access control policy requirement in Annex A 5.15.
This control is broader than ISM-2093.
ISM-2093 requires organisations to implement RBAC in AI applications to prevent unauthorised access to sensitive AI data. Annex A 5.15 requires establishing and implementing rules and procedures to control logical (and physical) access to information assets based on business and security requirements. ISM-2093 fits within these broader access control rules as a specific procedural/technical requirement for AI systems.
This control is broader than ISM-2095.
ISM-2095 prohibits personnel using privately owned devices to access OFFICIAL: Sensitive or PROTECTED systems or data from granting access to unapproved AI agents. ISO/IEC 27001:2022 Annex A 5.15 requires the organisation to establish and implement access control policies and procedures for physical and logical access based on security requirements, which is the broader governance mechanism that would include rules about AI agent access from BYOD contexts. ISM-2095 is a specific access-control policy constraint (AI agents + personal devices + sensitive systems) within the wider access control policy framework mandated by Annex A 5.15.
This control is broader than ISM-2098.
ISM-2098 requires mobile devices to be configured so data cannot be transferred over USB connections. This is an access/usage restriction on an interface that fits within Annex A 5.15, which requires establishing and implementing rules to control physical and logical access to information and associated assets. Annex A 5.15 is broader because it covers policy-driven access control across systems, networks, and physical environments, whereas ISM-2098 is a single technical enforcement point for one channel on one asset class (mobile devices).
This control is broader than ISM-2100.
ISM-2100 requires a situational handling restriction: sensitive or classified data must not be viewed on mobile devices within or near connected vehicles due to heightened likelihood of compromise (e.g., shoulder-surfing, device-to-vehicle connectivity exposure, opportunistic capture in a confined space). Annex A 5.15 (Access control policies and procedures) is where an organisation defines and enforces the specific rules that govern when/where access is permitted, including context-based prohibitions for high-risk physical environments and device types. ISM-2100 is therefore a concrete, scenario-specific rule that would be implemented as part of the broader access-control rule set mandated by Annex A 5.15.
This control is broader than ISM-2112.
ISM-2112 requires a specific logical access restriction: AI applications processing classified data must not directly access external public data sources. ISO/IEC 27001:2022 Annex A 5.15 relates by requiring access control policies and procedures that can define and mandate such outbound access prohibitions for systems and services. Annex A 5.15 is broader and policy-oriented, while ISM-2112 is a concrete, technology-enforceable restriction scoped to AI and classified data.
- ISM-2124Restricting service provider access to approved tools, addresses and time WindowsBroader than
This control is broader than ISM-2124.
ISM-2124 requires that service provider access to an organisation's systems is limited to explicitly approved remote management tools, source network addresses and time windows. Annex A 5.15 requires the organisation to establish and implement rules and procedures to control logical (and physical) access based on business and security requirements, within which third-party remote access restrictions can be defined. ISM-2124 is a specific, prescriptive access-control rule for supplier remote access, whereas Annex A 5.15 is a broader policy/procedure control covering access control generally.
This control is broader than ISM-2128.
ISM-2128 requires an explicit access rule that limits kernel-mode code installation/loading/modification to authorised privileged users with a duty-based need. ISO/IEC 27001:2022 Annex A 5.15 requires organisations to establish and implement access control rules and procedures based on business and security requirements, under which restrictions for kernel-mode changes would be defined and enforced. ISM-2128 is a specific access-control rule, while Annex A 5.15 is the broader policy/procedure framework for many access rules.
This control is broader than ISM-2133.
ISM-2133 mandates a specific access-control design rule: every AI agent must have a distinct identity, separated from personnel and other agents for accountability. ISO/IEC 27001:2022 Annex A 5.15 requires an organisation to establish and implement access control rules and procedures based on business and security requirements, including how identities are used in access decisions. ISM-2133 fits as a concrete policy rule under the broader access control policy framework required by Annex A 5.15.
- ISM-2135Recording identifier, owner, identities, credentials and access for each AI agentBroader than
This control is broader than ISM-2135.
ISM-2135 requires maintaining an AI agent register that records identifiers, ownership, assigned identities, credentials, and the tools/permissions/data repositories each agent can access. Annex A 5.15 requires establishing access control policies for physical and logical access based on business and security requirements. ISM-2135 is a specific record-keeping mechanism within the broader access control policy framework of Annex A 5.15.
This control is broader than ISM-2136.
ISM-2136 requires enforcing risk-based access decisions using contextual signals (e.g. user, device, location, behaviour) to grant, step up, or deny access. Annex A 5.15 requires the organisation to establish and implement access control policies and procedures for physical and logical access based on business and security requirements. Annex A 5.15 provides the governance and rules framework within which a risk-based/conditional access approach in ISM-2136 can be defined and enforced, but it does not specifically mandate contextual, per-request risk evaluation.
This control is broader than ISM-2137.
ISM-2137 requires that human users are prevented from granting OAuth consent to third-party applications, reserving approval to an authorised administrator. Annex A 5.15 requires the organisation to establish and implement rules and procedures to control logical access based on business and security requirements, which is the broader governance mechanism that would include an OAuth-consent restriction rule. ISM-2137 is a specific access-control policy enforcement use case, while Annex A 5.15 covers access control policy/procedure across many assets and access methods beyond OAuth.
This control is broader than ISM-2138.
ISM-2138 requires a specific access control procedure of reviewing OAuth application consents and granted permissions at least every six months and revoking unused or excessive permissions. This procedure is a specific instantiation of Annex A 5.15, which broadly covers establishing and implementing access control rules, policies, and procedures based on business and security requirements.
This control is broader than ISM-2140.
ISM-2140 requires a defined logical access rule: the OAuth device code flow must be disabled by default and only permitted for authorised accounts on managed devices when required. This aligns with ISO/IEC 27001:2022 Annex A 5.15, which requires establishing and implementing access control rules and procedures based on business and information security requirements. Annex A 5.15 sets the overarching requirement for access control governance, whereas ISM-2140 is one concrete rule within that broader access control framework.
This control is broader than ISM-2156.
ISM-2156 requires agentic AI applications to be restricted to the minimum tools, functions and permissions necessary for their intended purpose. Annex A 5.15 requires the organisation to establish and implement access control policies and procedures governing logical and physical access based on business and security requirements. Annex A 5.15 is broader because it applies to all assets and access scenarios, whereas ISM-2156 is a specific least-privilege constraint for agentic AI tooling and permissions.
This control is broader than ISM-2157.
ISM-2157 requires dual-bounding of permissions for agent tool calls (user permissions plus task-scoped agent authorisation) so actions cannot exceed the minimum permitted. This aligns with Annex A 5.15 because implementing access control rules and procedures is the governance basis for defining and enforcing those permission boundaries. Annex A 5.15 covers policy and procedures across all access scenarios, whereas ISM-2157 focuses specifically on agentic delegation and task scoping.
This control is broader than ISM-2165.
ISM-2165 mandates that EAP-TLS sessions are not reused for CAK establishment by requiring a fresh EAP-TLS authentication whenever a new CAK is needed. ISO/IEC 27001:2022 Annex A 5.15 requires organisations to establish and implement access control rules and procedures, under which network access controls can specify when re-authentication is required and how session/key renegotiation is handled. Annex A 5.15 provides the governance mechanism to mandate such rules, whereas ISM-2165 specifies one particular technical rule that would sit under those procedures.
This control partially overlaps ISM-0258.
ISM-0258 requires organisations to develop, implement and maintain a web usage policy governing web access and use. Annex A 5.15 requires establishing and implementing access control policies and procedures for logical (and physical) access based on business and security requirements, which can include rules for web access. ISM-0258 is topic-specific to web usage, while Annex A 5.15 is broader and covers access control across all information assets and access methods, not just web browsing.
- ISM-1327Access controls, encryption and user authentication for X.509 certificatesPartially overlaps
This control partially overlaps ISM-1327.
Annex A 5.15 requires rules and procedures to control physical and logical access to information and associated assets. ISM-1327 requires certificates used for network authentication to be protected using access controls, encryption, and user authentication, which is an access-related safeguard for a specific credential type. They overlap where Annex A 5.15's access control rules must cover protection and handling of authentication material, but ISM-1327 goes deeper into technical protections (e.g. encryption) that are not explicit in Annex A 5.15.
This control partially overlaps ISM-2080.
ISM-2080 states that password complexity requirements are not imposed for passwords. Annex A 5.15 requires an organisation to establish and implement access control policies and procedures, within which password composition rules (or the deliberate choice not to enforce them) would typically be defined. Annex A 5.15 is broader because it covers access control governance across physical and logical access, not just password complexity decisions.
This control supports ISM-0409.
ISM-0409 requires that foreign nationals do not have access to systems processing AUSTEO or REL data unless controls ensure the data is not accessible to them. ISO/IEC 27001:2022 Annex A 5.15 establishes the organisation's access control rules and policies necessary to encode nationality-based restrictions and the requirement for data to be inaccessible.
This control supports ISM-1420.
ISM-1420 requires organisations to ensure non-production environments meet production-equivalent security before using production data in them. Annex A 5.15 establishes the access control policies and procedures that define and enforce who can access systems and data across environments. ISM-1420 typically depends on these policies to define what 'same level as production' means and to implement the necessary logical access restrictions in non-production.
This control supports ISM-1439.
ISM-1439 requires a defined approach to preventing origin IP disclosure and restricting origin server access to CDNs and authorised management networks. ISO/IEC 27001 Annex A 5.15 provides the overarching access control rules and procedures that set the basis for defining which networks (CDN egress and management) are permitted to access origin servers. Without Annex A 5.15-style policy and procedures, implementing and consistently enforcing ISM-1439's network restrictions is less defensible and repeatable.
This control depends on ISM-0434.
ISM-0434 requires employment screening and, where necessary, security clearance before personnel are granted access to systems and resources. Annex A 5.15 supports this by requiring the organisation to define and implement rules and procedures to control physical and logical access based on business and security requirements, which is where screening/clearance outcomes are operationalised. Annex A 5.15 is broader across access policy design and enforcement, while ISM-0434 is specifically about personnel vetting/clearance as an access precondition.
This control depends on ISM-0484.
ISM-0484 ensures secure remote access behaviour for SSH by disabling insecure options like direct root login and empty passwords. Annex A 5.15 requires rules for logical access control aligned with business needs, such as SSH restrictions. ISM-0484 strengthens technical enforcement of these policies, contributing to, but not wholly defining, access control measures required by Annex A 5.15.
This control depends on ISM-0610.
ISM-0610 requires that users are trained on secure CDS use before being granted access, reducing the likelihood of policy breaches during cross-domain transfers. ISO/IEC 27001:2022 Annex A 5.15 requires establishing and implementing access control policies and procedures, which is where an organisation would define prerequisites such as required training for high-risk systems. ISM-0610 operationalises part of those access procedures for CDSs, but Annex A 5.15 is broader and covers both physical and logical access rules across all information assets.
This control depends on ISM-1773.
ISM-1773 mandates national eligibility for administering specific gateways. Annex A 5.15 supports this by requiring organisational policy and procedural frameworks that translate these mandates into manageable access control rules that prevent ineligible individuals from gaining the gateway administration rights.
This control depends on ISM-1865.
ISM-1865 requires a precondition for access: personnel must agree to comply with system usage policies before being granted access. Annex A 5.15 requires rules and procedures to control physical and logical access to information assets, which commonly includes user obligations and prerequisites embedded in access control procedures (e.g., account provisioning conditions). Annex A 5.15 is broader in covering the design and implementation of access control rules, while ISM-1865 is a single procedural control point within that lifecycle.
This control depends on ISM-2149.
ISM-2149 requires the organisation to control which RMM and remote access tools are permitted, effectively limiting which mechanisms can be used to gain remote logical access. This supports Annex A 5.15 because an authorised remote tool list is one way of implementing access control rules and procedures for remote administration pathways. Annex A 5.15 is broader, covering the full set of access control policies and rules (including authentication, authorisation models, and scope of access) beyond tool allow-listing.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-12.3Provision user, administrative and non-person accounts with minimum required privilegesBroader than
This control is broader than IT.PRO-12.3.
IT.PRO-12.3 requires user, administrative and non-person accounts to be provisioned with only the minimum access and privileges needed for defined operational functions. This puts into practice least privilege, a core principle of the access control rules required by Annex A 5.15. Annex A 5.15 is broader, requiring rules for both physical and logical access to be established and implemented based on business and information security requirements.
- IT.PRO-01.1Design systems with telemetry, least privilege, data protection and minimal attack surfacePartially overlaps
This control partially overlaps IT.PRO-01.1.
IT.PRO-01.1 requires systems to be designed securely, including enforcing authorised access, protecting data and minimising privileges. Building enforcement of authorised access into system design overlaps with the implementation of the access control rules required by ISO/IEC 27001 Annex A 5.15. Annex A 5.15 also requires the rules to be established from business and information security requirements and covers physical access, while IT.PRO-01.1 addresses wider secure design outcomes such as visibility and attack surface reduction.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.
Need this as a written policy?
PolicyMint drafts the ISO 27001 documentation this control expects, customised to your business and checked by three independent verifiers before you see it. Not a boilerplate template you have to fight into shape. First document free.
Draft your ISO 27001 documentation