verifiedISO/IEC 27001:2022
ISO 27001 Annex A 5.15Access Control Policies and Procedures
Official control statement
Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.
verifiedISO/IEC 27001:2022Annex A 5.15
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Set and apply rules for who can access information and systems based on their security needs.
Organisational controlsISO/IEC 27001:2022
record_voice_over
What this means in practice
This control is about setting clear rules for who can enter a company's systems and access its information. It matters because if these rules aren't in place, unauthorised people could get access to sensitive information, potentially leading to data breaches or misuse of data.
01 - Overview
Framework
ISO/IEC 27001:2022
Control effect (Control Stack)
Preventative
ISO 27001 domain
Organisational controls
Classifications
N/A
Official last update
24 Oct 2022
Control Stack last updated
29 Sept 2026
priority_high
Why it matters
Without defined and implemented access control policies and procedures, logical and physical access may be granted inappropriately, enabling unauthorised access and data breaches.
settings
Operational notes
Regularly review access permissions to align with role changes and prevent privilege creep across the organisation.
02 - Implement
build
Implementation tips
- The IT manager should identify which staff members or positions need access to specific systems and information. This can be done by reviewing job descriptions and understanding the tasks employees need to perform. Once understood, set access permissions based strictly on these needs, ensuring that no unnecessary access is granted.
- The HR team should work with the IT department to ensure that physical access to facilities is appropriately restricted. This involves issuing and maintaining a record of access cards or keys and ensuring visitors sign in and are escorted. Australian regulations, such as the Privacy Act 1988, require safeguarding private information, which includes controlling who physically accesses areas where data is stored.
- The board or management should create a written access control policy that outlines the rules for accessing both physical and digital assets. This policy should be communicated to all employees and include principles like 'need-to-know' and 'least privilege'. It should also reference relevant guidance from ISO 27002:2022.
- IT administrators should establish a process for regularly reviewing and updating access rights. This means checking at intervals that only current employees have access and that their access levels match their roles. Annual reviews or whenever an employee changes jobs or leaves the organisation ensure compliance with Australian standards like CPS 234.
- Security and IT staff should set up systems for logging access attempts to sensitive systems. This involves using tools that can record who accessed what, and when, and setting alerts for unusual access attempts. This aligns with the ASD Essential Eight strategies for improving cyber security resilience.
03 - Audit
fact_check
Audit / evidence tips
- AskThe organisation's access control policy documentLook atWhether the policy specifies who can access what systems and informationGoodA detailed document that matches access levels to business needs and includes statements of security principles such as 'need-to-know'
- AskTo see a list of current system access permissions and compare this with an employee listLook atHow permissions are assigned and if there are any inconsistencies. GOOD is ensuring everyone listed should have the access they do, based on their role
- AskA demonstration of the physical access control system (such as card swipe records)Look atEntries and exits recorded over a period to see if any anomalies exist. GOOD means records are consistently logged and can be correlated with employee work schedules
- AskRecords of access reviews and adjustmentsLook atThe dates and outcomes of these reviews. GOOD is shown by regular, documented reviews that have led to adjustments in access permissions as needed
- AskLogs of system access over the past monthLook atAttempts to access sensitive systems, especially any unsuccessful or unusual attempts. GOOD is when there are documented actions taken for any anomalies found in these logs
04 - Mappings
link
Cross-framework mappings
How Annex A 5.15 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
E8
| Control | Notes | Details |
|---|---|---|
open_in_fullBroader than(14)expand_less | ||
ASD ISM
| Control | Notes | Details |
|---|---|---|
open_in_fullBroader than(83)expand_less | ||
| ISM-0217 | Annex A 5.15 requires organisations to define and implement physical and logical access control rules for assets | |
| ISM-0269 | Annex A 5.15 requires organisations to define and implement rules controlling access to information based on business and security requir... | |
| ISM-0343 | Annex A 5.15 requires access control rules and procedures for controlling access to information and associated assets | |
| ISM-0382 | ISM-0382 requires preventing standard users from uninstalling or disabling approved applications to maintain the organisation's approved ... | |
| ISM-0405 | Annex A 5.15 requires organisations to establish and implement access control policies and procedures based on business and security requ... | |
| ISM-0407 | ISM-0407 requires maintaining a secure lifetime access record for each human user, including who authorised access, what level was grante... | |
| ISM-0411 | ISM-0411 requires foreign nationals (excluding seconded foreign nationals) to be prevented from accessing AGAO data on systems unless eff... | |
| ISM-0415 | ISM-0415 requires governance over shared accounts and ensures actions performed using them are uniquely attributable to a specific user | |
| ISM-0418 | ISM-0418 requires a specific rule for handling physical credentials: keep them separate from the systems they authenticate to except duri... | |
| ISM-0428 | ISM-0428 requires services to enforce session locking after defined inactivity/maximum duration, fully block session content while locked... | |
| ISM-0430 | ISM-0430 requires rapid deprovisioning by removing or suspending access the same day it is no longer legitimately required | |
| ISM-0432 | ISM-0432 requires that access requirements for each system and its resources be documented in the system's security plan | |
| ISM-0441 | ISM-0441 requires that temporary system access be constrained to only the data required to perform assigned duties | |
| ISM-0443 | ISM-0443 prohibits granting temporary access to systems that process, store or communicate caveated or sensitive compartmented information | |
| ISM-0447 | Annex A 5.15 requires organisations to establish and implement rules and procedures to control logical and physical access to information... | |
| ISM-0487 | ISM-0487 requires organisations to harden passwordless SSH logins by disabling specific SSH capabilities such as port forwarding, agent f... | |
| ISM-0489 | ISM-0489 requires that where SSH-agent (or similar) key caching is used, it is only on workstations/servers with screen locks and the key... | |
| ISM-0530 | ISM-0530 requires a specific access rule: VLAN-managing network devices must be administered from the most trusted security domain | |
| ISM-0551 | ISM-0551 mandates specific access control configuration for IP telephony, including authenticated registration, disabling auto-registrati... | |
| ISM-0611 | ISM-0611 requires that gateway administrators are assigned only the minimum privileges required for their duties | |
| ISM-0622 | ISM-0622 requires IT equipment to prove its identity to networks reached through gateways, which is a specific logical access control req... | |
| ISM-0665 | ISM-0665 limits trustworthy sources for SECRET/TOP SECRET systems to CISO-verified entities, which is a specific governance rule | |
| ISM-0687 | ISM-0687 requires that mobile devices used to access SECRET or TOP SECRET systems/data are on ASD-approved mobile platforms and operated ... | |
| ISM-0694 | ISM-0694 mandates that privately-owned devices are not permitted to access SECRET and TOP SECRET systems or data | |
| ISM-0854 | ISM-0854 sets a strict rule about where and on what systems AUSTEO and AGAO data may be accessed (Australian Government solely controlled... | |
| ISM-1006 | ISM-1006 requires security measures to prevent unauthorised access to network management traffic | |
| ISM-1014 | ISM-1014 requires individual logins for IP phones used for SECRET or TOP SECRET conversations to ensure user-specific access and accounta... | |
| ISM-1182 | Annex A 5.15 requires rules to control logical and physical access to information and assets based on business need | |
| ISM-1250 | ISM-1250 requires organisations to implement least-privilege file system permissions for server application accounts | |
| ISM-1255 | ISM-1255 requires restricting what database users can do to database contents based on their duties or functions | |
| ISM-1256 | ISM-1256 requires applying file permissions to database files to protect them from unauthorised access | |
| ISM-1392 | ISM-1392 requires a concrete access restriction outcome: only approved users can modify approved files and write to approved folders when... | |
| ISM-1403 | ISM-1403 requires user accounts (except break glass accounts) to be locked after a maximum of five failed logon attempts, addressing spec... | |
| ISM-1404 | ISM-1404 mandates a specific access control rule: disabling unprivileged access after 45 days of inactivity | |
| ISM-1418 | ISM-1418 requires disabling unnecessary removable media and device reading via device access control or disabling external interfaces | |
| ISM-1432 | ISM-1432 requires organisations to protect online service domain names by using registrar locking and confirming domain registration deta... | |
| ISM-1487 | ISM-1487 requires that only privileged macro-vetting users can write to and modify Microsoft Office Trusted Locations, with other users e... | |
| ISM-1505 | ISM-1505 requires MFA to be used to authenticate users of data repositories | |
| ISM-1508 | ISM-1508 requires that privileged access is limited to only what is required for duties or functions | |
| ISM-1530 | ISM-1530 requires classified servers, network devices and cryptographic equipment to be physically secured in security containers appropr... | |
| ISM-1604 | ISM-1604 requires hardening of the virtual server isolation mechanism and restricting access to the administrative interface used to mana... | |
| ISM-1611 | ISM-1611 requires break glass accounts to be used only when normal authentication processes cannot be used (i.e., emergency-only use) | |
| ISM-1612 | Annex A 5.15 requires defined access control policies and procedures, including rules governing elevated access | |
| ISM-1649 | ISM-1649 requires organisations to use just-in-time administration to control when administrative access is granted for system administra... | |
| ISM-1746 | ISM-1746 requires a specific access restriction: only approved users can change file system permissions for approved files and folders us... | |
| ISM-1813 | Annex A 5.15 requires rules and procedures to control logical access to information assets | |
| ISM-1816 | ISM-1816 requires controls to prevent unauthorised changes to the authoritative source for software | |
| ISM-1832 | ISM-1832 requires that SPNs are only set on service and computer accounts to reduce unnecessary exposure in Active Directory | |
| ISM-1839 | ISM-1839 requires that Active Directory account properties visible to unprivileged users are not used to store passwords | |
| ISM-1841 | ISM-1841 requires restricting the ability to join computers to a domain so that unprivileged users cannot perform domain joins | |
| ISM-1844 | Annex A 5.15 requires rules and procedures that control logical access to systems and associated services | |
| ISM-1852 | ISM-1852 requires that unprivileged users only have access to systems and resources needed for their duties | |
| ISM-1854 | ISM-1854 mandates user authentication at MFDs before use | |
| ISM-1888 | ISM-1888 requires mobile devices to have secure password-based lock screens to prevent unauthorised access | |
| ISM-1920 | ISM-1920 requires that users are prevented from self-enrolling MFA from untrustworthy devices when accessing services handling sensitive ... | |
| ISM-1927 | ISM-1927 requires limiting access to specific identity systems (domain controllers, AD CS/AD FS servers, and Entra Connect) to only privi... | |
| ISM-1928 | ISM-1928 requires strict logical access control for AD/Entra Connect server backups, limiting access to backup administrator accounts and... | |
| ISM-1933 | ISM-1933 requires an explicit logical access restriction: SPN service accounts must not have DCSync (directory replication) permissions | |
| ISM-1934 | ISM-1934 requires periodic governance over a specific privileged permission (DCSync) by reviewing authorised accounts and removing access... | |
| ISM-1936 | ISM-1936 addresses a specific logical access control weakness by requiring organisations not to use the sIDHistory attribute on user acco... | |
| ISM-1946 | ISM-1946 requires organisations to enforce a specific logical access rule: unprivileged users must not be able to write to certificate te... | |
| ISM-1948 | ISM-1948 requires certificate manager approval for certificate templates that allow a requester-supplied SAN, constraining how certificat... | |
| ISM-1958 | ISM-1958 requires that accounts with DCSync permissions are technically prevented from logging on to unprivileged operating environments | |
| ISM-1985 | ISM-1985 requires restricting who can access event logs to authorised individuals | |
| ISM-2014 | ISM-2014 focuses on enforcing client authentication and authorisation when internal network APIs are called to access non-public data | |
| ISM-2048 | ISM-2048 requires a specific access control outcome: non-admin users are blocked from changing their own permissions or privileges in rol... | |
| ISM-2092 | ISM-2092 requires organisations to implement access control policies that enforce fine-grained permissions specifically for artificial in... | |
| ISM-2093 | ISM-2093 requires organisations to implement RBAC in AI applications to prevent unauthorised access to sensitive AI data | |
| ISM-2095 | ISM-2095 prohibits personnel using privately owned devices to access OFFICIAL: Sensitive or PROTECTED systems or data from granting acces... | |
| ISM-2098 | ISM-2098 requires mobile devices to be configured so data cannot be transferred over USB connections | |
| ISM-2100 | ISM-2100 requires a situational handling restriction: sensitive or classified data must not be viewed on mobile devices within or near co... | |
| ISM-2112 | ISM-2112 requires a specific logical access restriction: AI applications processing classified data must not directly access external pub... | |
| ISM-2124 | ISM-2124 requires that service provider access to an organisation's systems is limited to explicitly approved remote management tools, so... | |
| ISM-2128 | ISM-2128 requires an explicit access rule that limits kernel-mode code installation/loading/modification to authorised privileged users w... | |
| ISM-2133 | ISM-2133 mandates a specific access-control design rule: every AI agent must have a distinct identity, separated from personnel and other... | |
| ISM-2135 | ISM-2135 requires maintaining an AI agent register that records identifiers, ownership, assigned identities, credentials, and the tools/p... | |
| ISM-2136 | ISM-2136 requires enforcing risk-based access decisions using contextual signals (e.g | |
| ISM-2137 | ISM-2137 requires that human users are prevented from granting OAuth consent to third-party applications, reserving approval to an author... | |
| ISM-2138 | ISM-2138 requires a specific access control procedure of reviewing OAuth application consents and granted permissions at least every six ... | |
| ISM-2140 | ISM-2140 requires a defined logical access rule: the OAuth device code flow must be disabled by default and only permitted for authorised... | |
| ISM-2156 | ISM-2156 requires agentic AI applications to be restricted to the minimum tools, functions and permissions necessary for their intended p... | |
| ISM-2157 | ISM-2157 requires dual-bounding of permissions for agent tool calls (user permissions plus task-scoped agent authorisation) so actions ca... | |
| ISM-2165 | ISM-2165 mandates that EAP-TLS sessions are not reused for CAK establishment by requiring a fresh EAP-TLS authentication whenever a new C... | |
sync_altPartially overlaps(3)expand_less | ||
| ISM-0258 | ISM-0258 requires organisations to develop, implement and maintain a web usage policy governing web access and use | |
| ISM-1327 | Annex A 5.15 requires rules and procedures to control physical and logical access to information and associated assets | |
| ISM-2080 | ISM-2080 states that password complexity requirements are not imposed for passwords | |
handshakeSupports(3)expand_less | ||
| ISM-0409 | ISM-0409 requires that foreign nationals do not have access to systems processing AUSTEO or REL data unless controls ensure the data is n... | |
| ISM-1420 | ISM-1420 requires organisations to ensure non-production environments meet production-equivalent security before using production data in... | |
| ISM-1439 | ISM-1439 requires a defined approach to preventing origin IP disclosure and restricting origin server access to CDNs and authorised manag... | |
extensionDepends on(6)expand_less | ||
| ISM-0434 | ISM-0434 requires employment screening and, where necessary, security clearance before personnel are granted access to systems and resources | |
| ISM-0484 | ISM-0484 ensures secure remote access behaviour for SSH by disabling insecure options like direct root login and empty passwords | |
| ISM-0610 | ISM-0610 requires that users are trained on secure CDS use before being granted access, reducing the likelihood of policy breaches during... | |
| ISM-1773 | ISM-1773 mandates national eligibility for administering specific gateways | |
| ISM-1865 | ISM-1865 requires a precondition for access: personnel must agree to comply with system usage policies before being granted access | |
| ISM-2149 | ISM-2149 requires the organisation to control which RMM and remote access tools are permitted, effectively limiting which mechanisms can ... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ISO 27001 controls in Organisational controls
Annex A 5.12
Information Classification Policy and Practices
Annex A 5.13
Labelling of Information
Annex A 5.14
Information Transfer Policies and Procedures
Annex A 5.16
Identity life cycle management
Annex A 5.17
Management of Authentication Information
Annex A 5.18
Managing Access Rights to Information Assets
See all Organisational controls controls, or browse the full ISO 27001 library. You can also track all 93 controls with the free ISO 27001 Annex A checklist.
school
Want to implement this control?
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.
Need this as a written policy?
PolicyMint drafts the ISO 27001 documentation this control expects, customised to your business and checked by three independent verifiers before you see it. Not a boilerplate template you have to fight into shape. First document free.