ISO 27001 Annex A 5.18 Managing access rights to information assets
What it says
Access rights to information and other associated assets shall be provisioned, reviewed, modified and removed in accordance with the organization's topic-specific policy on and rules for access control.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRegularly check and adjust who can access sensitive information based on business rules.
This control is about making sure that only the right people have access to sensitive information in your business. If you don't manage who can see or use important data correctly, unauthorised people might access, misuse, or even damage your information, harming your business and violating privacy laws.
Free. Save your status, tasks and notes.
Why it matters
Unchecked access rights can enable unauthorised access to information assets, causing data breaches, insider misuse, privacy breaches, and financial loss.
How to implement
The IT manager should create a clear policy for managing access to information.
This involves defining who can access specific types of data and under what conditions, referencing ISO 27002:2022 guidance for best practices.
Human Resources should coordinate access rights adjustments when employees change roles.
This can be achieved by regularly updating lists of staff roles and access permissions to ensure they match current job duties.
Department heads should perform regular reviews of who has access to sensitive data.
These reviews can be done quarterly by checking the list of current access rights against roles and responsibilities, removing access where it is no longer necessary.
The security team should establish a process for granting temporary access rights.
This includes creating a system for logging access requests, having them reviewed by management, and automatically revoking them after the expiration date.
Procurement should ensure that any third-party service agreements include clauses about correctly managing access to sensitive data, according to Australian Privacy Principles and OAIC guidelines.
Keep it running
Review access rights regularly against role requirements; promptly provision, modify or remove access for joiners, movers and leavers, and keep approvals recorded.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the organisation's access control policy document.
Look at
Check that the policy includes procedures for granting, reviewing, and revoking access to data.
Good evidence
A comprehensive policy that aligns with both business needs and regulatory standards, with clear roles and responsibilities.
- Check 2 of 5What an auditor asks for
Ask for
Ask for records of recent access rights reviews.
Look at
Ensure the reviews are completed regularly and any changes in roles resulted in updated access rights.
Good evidence
Records show reviews conducted quarterly, with documented changes to access rights where necessary.
- Check 3 of 5What an auditor asks for
Ask for
Request evidence of training sessions for employees on access control policies.
Look at
Verify that training includes details on policies, access rights procedures, and consequences of misuse.
Good evidence
Training logs show regular sessions with high staff attendance and clear content outlines.
- Check 4 of 5What an auditor asks for
Ask for
Ask for logs of temporary access rights granted in the past six months.
Look at
Ensure logs include dates, who authorised the access, and when rights were revoked.
Good evidence
Logs are detailed, complete, and show timely revocation of temporary access.
- Check 5 of 5What an auditor asks for
Ask for
Request any access control agreement clauses in third-party contracts.
Look at
Check clauses for compliance with Australian privacy requirements and management of third-party access.
Good evidence
Contracts include clear access management responsibilities and align with Privacy Act 1988 requirements.
Mappings
Closest match in ASD Information Security Manual: ISM-2138, Six-monthly review of OAuth application consents and granted permissions, which asks for the same thing.
ASD Essential Eight: 5 mappings
This control is broader than E8-RA-ML1.1.
E8-RA-ML1.1 requires organisations to validate privileged access requests when first requested, prior to provisioning. Annex A 5.18 addresses the broader lifecycle of access rights provisioning, review, modification and removal in line with access control rules. E8-RA-ML1.1 maps to the initial provisioning/authorisation component, while Annex A 5.18 extends beyond initial request validation into ongoing management.
This control is broader than E8-RA-ML1.4.
E8-RA-ML1.4 requires limiting authorised privileged account access to online services to what is necessary for duties. ISO/IEC 27001:2022 Annex A 5.18 addresses the broader lifecycle management of access rights (provision, review, modification, removal) for information assets, which would include managing privileged access to online services.
- E8-RA-ML3.3Just-in-time administration is used for administering systems and applications.Broader than
This control is broader than E8-RA-ML3.3.
E8-RA-ML3.3 requires implementing just-in-time administration so privileged access is only granted when required and expires after a limited period. ISO/IEC 27001:2022 Annex A 5.18 covers provisioning, reviewing, modifying and removing access rights throughout the access lifecycle. JIT administration is a targeted technique within that lifecycle (temporary provisioning/removal), while Annex A 5.18 is broader and includes periodic reviews and general access-rights governance beyond administration scenarios.
This control is broader than E8-RM-ML3.3.
E8-RM-ML3.3 involves controlling who can modify content in trusted macro locations. Annex A 5.18 encompasses provisioning, reviewing, and modifying access rights to information assets according to an access control policy. The primary control presents a specific use case of rights assignment, whereas Annex A 5.18 is broader and includes the complete access-right lifecycle.
This control partially overlaps E8-RA-ML2.1.
Annex A 5.18 requires access rights to be provisioned, reviewed, modified and removed in accordance with access control rules. E8-RA-ML2.1 relates by requiring privileged access to be disabled after 12 months unless revalidated, which is a concrete periodic review and removal trigger for privileged access. Annex A 5.18 is broader because it applies to all access rights (not only privileged) and does not prescribe a specific revalidation interval.
ASD Information Security Manual: 56 mappings
This control is equivalent to ISM-2138.
ISM-2138 requires reviewing OAuth consents and permissions every six months, revoking unused permissions, directly aligning with Annex A 5.18, which requires provisioning, reviewing, modifying, and removing access rights per access control rules. Annex A 5.18 covers information assets generically; ISM-2138 provides specific, measurable OAuth consent review targets.
This control is broader than ISM-0269.
ISM-0269 requires restricting dissemination of specific sensitive information in email by ensuring only verified-nationality recipients in distribution lists can receive it. Annex A 5.18 covers provisioning, reviewing, modifying and removing access rights to information assets, which can include controlling membership of groups/distribution lists and who is authorised to receive sensitive information. Annex A 5.18 is broader across the access-rights lifecycle for all assets, whereas ISM-0269 is a specific rule for email distribution list use based on nationality confirmation.
This control is broader than ISM-0405.
ISM-0405 requires that requests for unprivileged access to systems and resources are validated when first requested. This aligns with Annex A 5.18 because initial validation is a key part of provisioning access rights in a controlled way. However, Annex A 5.18 is broader as it also requires ongoing review, modification and removal of access rights beyond the initial request stage.
This control is broader than ISM-0407.
ISM-0407 requires a secure, tamper-resistant record for each human user covering the full access lifecycle (authorisation, grant date, access level, reviews, changes, and withdrawal) for the lifetime of systems/resources. ISO/IEC 27001:2022 Annex A 5.18 requires access rights to be provisioned, reviewed, modified and removed in accordance with access control policy, which implies maintaining records/evidence of those actions. ISM-0407 is more specific and prescriptive about exactly what must be recorded and retained for life, whereas Annex A 5.18 is broader and policy/process-oriented and does not mandate the same record content or lifetime retention.
This control is broader than ISM-0409.
ISM-0409 mandates preventing foreign nationals from accessing AUSTEO or REL data unless effective controls eliminate access. Annex A 5.18 addresses the lifecycle management of access rights in line with access control policy, providing a mechanism that could enforce ISM-0409's requirements. ISM-0409 is focused on specific prohibition based on nationality and data type, while Annex A 5.18 applies broadly to all users.
This control is broader than ISM-0411.
ISM-0411 requires blocking foreign nationals from accessing AGAO data on relevant systems unless controls ensure the data is not accessible to them. Annex A 5.18 demands that access rights be provisioned, reviewed, modified and removed according to access control rules, covering the access lifecycle for all users and assets. ISM-0411 is a specific rule for a defined user cohort that aligns with the broader lifecycle processes in Annex A 5.18.
This control is broader than ISM-0430.
ISM-0430 requires organisations to remove or suspend system access the same day a person no longer has a legitimate need for it. Annex A 5.18 covers the broader access-rights lifecycle (provisioning, review, modification and removal) under access control rules and policies. ISM-0430 is a specific, time-bound leavers/movers requirement within that broader access rights management process.
This control is broader than ISM-0443.
ISM-0443 mandates that organisations do not grant temporary access to systems processing, storing or communicating caveated or sensitive compartmented information. ISO/IEC 27001:2022 Annex A 5.18 covers provisioning, reviewing, modifying and removing access rights across the access lifecycle, which is where rules about temporary or time-limited access are implemented and enforced. Annex A 5.18 is broader lifecycle governance, while ISM-0443 is a specific rule constraining one access mechanism for a particular sensitivity tier.
This control is broader than ISM-1255.
Annex A 5.18 requires access rights to be provisioned and maintained based on organisational access control policy and business rules. ISM-1255 implements this principle in a database context by restricting database users' ability to access and change data based on their duties. The ISO control is broader because it applies to all information assets and explicitly includes review, modification, and removal across the access lifecycle.
This control is broader than ISM-1327.
ISM-1327 requires X.509 certificates and their private keys to be protected with logical and physical access controls and encryption and requires authentication before human-user certificates can be used. Annex A 5.18 covers provisioning, review, modification and removal of access rights to information assets, which would include controlling access to certificate stores, HSMs and key material used with certificates. ISM-1327 is a technology-specific application of access-rights management focused on certificates and key protection, while Annex A 5.18 applies broadly across all information assets and the access-rights lifecycle.
This control is broader than ISM-1392.
ISM-1392 requires that when application control uses path rules, only approved users can modify approved files and write to approved folders. Annex A 5.18 requires organisations to provision, review, modify and remove access rights to information assets in line with access control policy. ISM-1392 is a specific technical enforcement of write/modify permissions in defined paths, whereas Annex A 5.18 is broader lifecycle governance across all access rights.
This control is broader than ISM-1404.
Annex A 5.18 requires organisations to remove or adjust access rights in line with policy and business rules, including when access is no longer needed. ISM-1404 is a specific rule for disabling unprivileged access after 45 days of inactivity, which is one concrete removal/adjustment trigger within an access management program. Annex A 5.18 is broader because it does not prescribe a single inactivity threshold and applies to all access types and assets.
This control is broader than ISM-1487.
ISM-1487 requires organisations to tightly control and limit write/modify permissions on Microsoft Office Trusted Locations to privileged macro-vetting users. ISO/IEC 27001:2022 Annex A 5.18 is broader, requiring provisioning, review, modification and removal of access rights to information assets in line with access control policy-Trusted Locations permissions are one example of such access rights. Annex A 5.18 covers the full access-rights management lifecycle across assets, while ISM-1487 specifies a particular access restriction for a common malware ingress mechanism.
- ISM-1590Changing user account credentials after compromise, exposure or shared membership changeBroader than
This control is broader than ISM-1590.
ISM-1590 requires changing credentials when compromise/exposure is suspected or confirmed, or when membership of a shared account changes. Annex A 5.18 covers provisioning, reviewing, modifying, and removing access rights in line with access control rules and policy. ISM-1590 fits within Annex A 5.18 as a specific modification action (credential reset) triggered by incident/exposure or shared-account lifecycle change, whereas Annex A 5.18 spans the full access-rights lifecycle beyond credentials.
This control is broader than ISM-1591.
ISM-1591 requires user access to systems and resources to be removed or suspended as soon as practicable when malicious activity is detected. Annex A 5.18 requires access rights to be provisioned, reviewed, modified and removed in accordance with access control rules and policies, which includes removal/adjustment of access when warranted. ISM-1591 is a specific removal/suspension trigger (malicious behaviour) and emphasises timeliness, while Annex A 5.18 is broader lifecycle governance across many triggers and scenarios.
This control is broader than ISM-1647.
ISM-1647 requires privileged access to be disabled after 12 months unless revalidated, which is an access-rights review and removal mechanism. ISO/IEC 27001:2022 Annex A 5.18 requires access rights to be provisioned, reviewed, modified and removed in accordance with policy, covering the full access-rights lifecycle. ISM-1647 is a specific review/removal rule for privileged access within the broader lifecycle processes mandated by Annex A 5.18.
This control is broader than ISM-1648.
ISM-1648 requires disabling privileged access after 45 days of inactivity as part of keeping access current and reducing unnecessary elevated access. Annex A 5.18 addresses the broader lifecycle of access rights, including provisioning, reviewing, modifying and removing access in line with an access control policy. ISM-1648 is a specific removal/disablement rule that would typically be implemented as one mechanism under Annex A 5.18's wider access-rights management framework.
This control is broader than ISM-1649.
ISM-1649 requires just-in-time administration to control the granting and use of administrative access for systems and resources. Annex A 5.18 requires access rights to be provisioned, reviewed, modified and removed in accordance with access control policy, covering the full access rights lifecycle. ISM-1649 is a specific technique that fits within Annex A 5.18's broader lifecycle management expectations, particularly for privileged rights activation and revocation.
This control is broader than ISM-1812.
ISM-1812 requires preventing unprivileged accounts from accessing other users' backups. Annex A 5.18 addresses the broader lifecycle of access rights (provisioning, review, modification and removal) for information and associated assets, which would be used to implement and maintain restrictions over backup access. ISM-1812 is narrower because it specifies one access-right outcome for backups rather than the full access-right management process.
This control is broader than ISM-1843.
ISM-1843 requires organisations to review Active Directory (AD) user accounts with unconstrained delegation at least annually and remove it where there is no SPN or demonstrated business requirement. Annex A 5.18 requires access rights to be provisioned, reviewed, modified and removed in line with access control policy, which includes periodic reviews of high-risk directory permissions. ISM-1843 is a specific, technical access-rights review case (unconstrained delegation) within the broader access-rights lifecycle management expected by Annex A 5.18.
This control is broader than ISM-1845.
ISM-1845 mandates automatic removal of security group memberships when a user account is disabled to ensure access rights are promptly revoked. Annex A 5.18 requires access rights to be provisioned, reviewed, modified and removed in accordance with access control rules and policies. ISM-1845 is one concrete mechanism for the 'removed/modified' part of access-rights management, while Annex A 5.18 applies to all systems and access types, not just AD security groups.
This control is broader than ISM-1846.
ISM-1846 requires organisations to ensure the Pre-Windows 2000 Compatible Access group does not include user accounts, effectively enforcing a specific access-rights removal for a legacy group. This aligns with Annex A 5.18, which requires access rights to be provisioned, reviewed, modified and removed under defined rules. Annex A 5.18 governs the full access-rights lifecycle broadly, while ISM-1846 is a focused technical rule for one Active Directory security group.
This control is broader than ISM-1852.
ISM-1852 requires limiting unprivileged access to systems and resources to what duties require. Annex A 5.18 requires access rights to be provisioned, reviewed, modified and removed in line with access control policy, covering the full access-rights lifecycle for information assets. ISM-1852 is one specific access-right outcome (least privilege for unprivileged users) within the broader governance and lifecycle management demanded by Annex A 5.18.
This control is broader than ISM-1927.
Annex A 5.18 requires organisations to manage access rights across their lifecycle in line with access control rules. ISM-1927 relates by mandating that access to critical identity infrastructure (AD DS/CS/FS and Entra Connect servers) is limited to privileged users who require it, which is an access provisioning and restriction decision. Annex A 5.18 is broader because it also requires periodic review, modification and removal processes for all assets and roles, not only these servers.
This control is broader than ISM-1933.
ISM-1933 requires removing/avoiding DCSync permissions for SPN-configured service accounts to prevent directory replication abuse. Annex A 5.18 covers provisioning, reviewing, modifying and removing access rights, which directly includes governance over who is granted AD replication rights and periodic review to ensure service accounts do not retain them. ISM-1933 is a specific control outcome for one dangerous permission set, while Annex A 5.18 addresses the full access-rights lifecycle across the organisation.
This control is broader than ISM-1934.
ISM-1934 requires organisations to review user accounts with DCSync permissions at least every six months and remove those permissions where there is no ongoing business requirement. Annex A 5.18 requires access rights to be provisioned, reviewed, modified and removed in accordance with access control rules, which directly encompasses periodic privileged-permission reviews and removals. ISM-1934 is a specific, technology-focused instance (Active Directory DCSync replication rights) of the broader access-rights lifecycle requirement in Annex A 5.18.
This control is broader than ISM-1940.
ISM-1940 requires that service accounts are not members of Domain Admins, Enterprise Admins, or other highly privileged AD security groups. This is a specific application of ISO/IEC 27001:2022 Annex A 5.18, which requires access rights to be provisioned, reviewed, modified, and removed in line with access control rules across information assets. Annex A 5.18 covers the full access-rights lifecycle and many asset types, while ISM-1940 is focused on a particular access-right (privileged AD group membership) for service accounts.
This control is broader than ISM-1946.
Annex A 5.18 requires access rights to be provisioned, reviewed, modified, and removed according to access control policy across information assets. ISM-1946 is a specific access-rights restriction ensuring unprivileged users cannot write to certificate templates, which is an instance of appropriate provisioning and restriction. The ISO control is broader because it covers the full access-rights lifecycle and all assets, not just certificate template permissions.
This control is broader than ISM-1958.
ISM-1958 requires a specific access restriction: accounts granted DCSync permissions must be blocked from logging on to unprivileged environments. Annex A 5.18 requires provisioning, reviewing, modifying and removing access rights to information assets in accordance with access control rules, which includes managing high-risk directory replication permissions like DCSync. ISM-1958 is a concrete technical enforcement for a particular privilege, whereas Annex A 5.18 covers the broader access-rights lifecycle.
This control is broader than ISM-2049.
ISM-2049 requires that when user permissions or credentials change, all impacted users are forced to re-authenticate so existing sessions/tokens cannot retain outdated access. Annex A 5.18 requires access rights to be provisioned, reviewed, modified and removed under an access control policy, which includes ensuring changes take effect appropriately. ISM-2049 is a specific technical enforcement mechanism that supports correct application of modified access rights, whereas Annex A 5.18 is broader across the full access-rights management lifecycle.
This control is broader than ISM-2092.
ISM-2092 requires fine-grained permissioning for AI applications, ensuring only authorised users can use AI capabilities in line with policy. ISO/IEC 27001:2022 Annex A 5.18 covers the broader lifecycle management of access rights across information assets. ISM-2092 aligns with Annex A 5.18 where those lifecycle processes are applied to AI application permissions but does not itself require the full access-rights lifecycle detail.
This control is broader than ISM-2095.
ISM-2095 requires that unapproved AI agents are not permitted access via privately-owned devices used to access OFFICIAL: Sensitive or PROTECTED systems/data. Annex A 5.18 covers provisioning, reviewing, modifying, and removing access rights to information assets, which is a core mechanism for ensuring only approved services/tools (including AI agents, where implemented as an identity/app authorisation) can access data. Annex A 5.18 is broader lifecycle governance of access rights, whereas ISM-2095 is a specific access prohibition scenario.
This control is broader than ISM-2137.
ISM-2137 requires restricting the ability to grant OAuth consent so that only an authorised administrator can approve third-party application access. Annex A 5.18 covers provisioning, reviewing, modifying, and removing access rights to information assets in line with access control rules, which would include controlling who can grant and revoke third-party application access. ISM-2137 is a specific rule about the consent-grant mechanism, while Annex A 5.18 is broader across the full access-rights lifecycle and many access types.
This control is broader than ISM-2146.
ISM-2146 requires organisations to promptly revoke static application/workload credentials when they are no longer needed. ISO/IEC 27001:2022 Annex A 5.18 requires access rights to be provisioned, reviewed, modified and removed in accordance with access control rules, which includes removing access/credentials when no longer authorised. ISM-2146 is a narrower, concrete requirement focused on revoking static credentials, whereas Annex A 5.18 spans all access rights and assets.
This control is broader than ISM-2156.
ISM-2156 requires agentic AI applications to have only the minimum tools, functions and permissions necessary for their purpose. Annex A 5.18 governs the provisioning, review, modification and removal of access rights to information and assets, which is the broader access-rights lifecycle process enforcing least-privilege for all identities, including AI agent identities.
This control partially overlaps ISM-0415.
ISM-0415 requires strict control of shared accounts and unique identification of the individuals who use them. ISO/IEC 27001:2022 Annex A 5.18 requires provisioning, reviewing, modifying and removing access rights, which overlaps with ISM-0415 where shared accounts (if permitted) must be carefully provisioned and reviewed to ensure use remains justified and controlled. Annex A 5.18 focuses on access-rights lifecycle management generally and does not specifically require per-use attribution mechanisms for shared credentials.
This control partially overlaps ISM-0441.
ISM-0441 requires technical restriction so temporary access only permits access to the data needed for assigned duties or functions. Annex A 5.18 requires access rights to be provisioned, reviewed, modified, and removed in line with access control rules, which includes ensuring granted access matches job needs and can be time-limited. Annex A 5.18 covers the full potential life cycle broadly, while ISM-0441 is focused on the temporary-access case and the requirement for effective technical limitation.
This control partially overlaps ISM-0446.
ISM-0446 prohibits foreign nationals from having privileged access to AUSTEO/REL systems. Annex A 5.18 covers provisioning, review, modification and removal of access rights to information assets, which would be used to ensure privileged access is not granted (or is removed) for foreign nationals on those systems. Annex A 5.18 is broader across all access rights and assets, whereas ISM-0446 is a specific rule about who must not receive privileged access for specific data classifications.
This control partially overlaps ISM-0555.
ISM-0555 requires authentication and authorisation for IP telephony actions such as user registration, setting changes, and voicemail access. Annex A 5.18 requires provisioning, reviewing, and removal of access rights, including telephony roles, aligning with ISM-0555's enforcement at the point of action.
This control partially overlaps ISM-1199.
ISM-1199 requires Bluetooth pairings to be removed from relevant mobile devices once there is no longer a business requirement. This overlaps with Annex A 5.18 because a Bluetooth pairing effectively grants an external device an ongoing connection capability, which should be reviewed and removed when no longer authorised. Annex A 5.18 is about the full lifecycle of access rights for information assets generally, whereas ISM-1199 is a specific technical requirement focused on Bluetooth pairings on mobile devices.
This control partially overlaps ISM-1268.
ISM-1268 requires enforcing need-to-know for database contents using minimum privileges, database roles/views, and tokenisation. ISO/IEC 27001:2022 Annex A 5.18 covers provisioning, reviewing, modifying and removing access rights, which is the access-rights lifecycle needed to keep database roles and privileges aligned to need-to-know. ISM-1268 provides concrete database enforcement mechanisms, while Annex A 5.18 focuses on governance and ongoing management of those rights.
This control partially overlaps ISM-1612.
ISM-1612 requires that break glass accounts are only used for specific authorised activities. This overlaps with Annex A 5.18 because Annex A 5.18 requires access rights to be provisioned, reviewed, modified, and removed according to access control rules, which commonly includes defining conditions for emergency account access and use. Annex A 5.18 is broader across the full access-rights lifecycle, while ISM-1612 is specifically a usage constraint (purpose/authorisation) for break glass accounts once they exist.
This control partially overlaps ISM-1833.
Annex A 5.18 requires access rights to be provisioned and maintained according to business rules and access control policy, which typically includes least-privilege principles. ISM-1833 relates by explicitly requiring user accounts to be provisioned with the minimum privileges required, influencing provisioning and subsequent modification decisions. ISM-1833 focuses on least privilege for account provisioning, while Annex A 5.18 covers the entire access-rights lifecycle including periodic reviews and removal.
This control partially overlaps ISM-2093.
ISM-2093 requires RBAC enforcement in AI applications so only authorised roles can access sensitive AI data. Annex A 5.18 addresses the access rights lifecycle (provisioning, review, modification and removal) for information assets, which is how RBAC entitlements for AI data are administered. They overlap on controlling who has access, but Annex A 5.18 emphasises governance and ongoing reviews whereas ISM-2093 emphasises implementing RBAC restrictions in the AI application itself.
- ISM-2124Restricting service provider access to approved tools, addresses and time WindowsPartially overlaps
This control partially overlaps ISM-2124.
ISM-2124 requires that service provider remote access is constrained to approved tools, source network addresses, and time windows. Annex A 5.18 focuses on provisioning, reviewing, modifying and removing access rights to information assets, which is the governance process used to authorise and maintain those supplier access constraints over time. ISM-2124 emphasises connection conditions (how/where/when access occurs), while Annex A 5.18 emphasises lifecycle management of the underlying entitlements.
- ISM-2126Positively identify requestors before actioning account, banking or payment requestsPartially overlaps
This control partially overlaps ISM-2126.
ISM-2126 requires personnel to confirm who is requesting changes before modifying user account details, banking details, or conducting financial transactions. ISO/IEC 27001:2022 Annex A 5.18 overlaps because it governs how access rights are provisioned, reviewed, modified and removed, which includes the act of modifying account details and entitlements. The overlap is on securely actioning changes to accounts/access, but Annex A 5.18 does not specifically require out-of-band or trusted-channel identity verification for banking/payment requests as ISM-2126 does.
This control partially overlaps ISM-2136.
ISM-2136 requires enforcing access decisions per request based on contextual signals and risk, including granting, stepping up, or denying access. Annex A 5.18 requires provisioning, reviewing, modifying, and removing access rights according to access control policy and rules. Both influence whether access is granted, but Annex A 5.18 focuses on administrative access-rights lifecycle, while ISM-2136 focuses on runtime, context-aware enforcement even for correctly provisioned users.
This control supports ISM-1841.
ISM-1841 requires that only authorised users can join devices to the domain, which is an access right that must be tightly controlled. Annex A 5.18 requires provisioning, reviewing, modifying, and removing access rights in line with access control rules, which is the process used to ensure only the correct admin accounts retain domain join rights. ISM-1841 defines the specific restriction outcome, while Annex A 5.18 focuses on the lifecycle management processes that keep that restriction accurate over time.
This control supports ISM-2048.
Annex A 5.18 requires controlled provisioning and modification of access rights in accordance with access control rules. ISM-2048 supports this by preventing non-administrative users from altering their own permissions or privileges, ensuring changes occur through authorised access-rights management processes. ISM-2048 is a preventative technical control, while Annex A 5.18 is the overarching requirement for lifecycle management and governance of access rights.
This control depends on ISM-0414.
Annex A 5.18 requires organisations to provision, review, modify and remove access rights based on defined access control rules. ISM-0414 supports this by ensuring each person with system access is uniquely identifiable, enabling accountable provisioning and reliable access reviews/removals for specific users. ISM-0414 focuses on identity uniqueness, while Annex A 5.18 focuses on the access-rights lifecycle decisions and governance.
This control depends on ISM-0432.
ISM-0432 requires that system access requirements be documented in the system security plan. Annex A 5.18 governs how access rights are provisioned, reviewed, modified, and removed against access control rules. This lifecycle activity is strengthened when the system's required access rules and roles are clearly documented. ISM-0432 does not itself require provisioning/review execution, but it provides the authoritative system-specific baseline that Annex A 5.18 processes should follow.
This control depends on ISM-0610.
ISM-0610 requires completion of secure CDS use training before a person is granted access to a CDS. ISO/IEC 27001:2022 Annex A 5.18 requires access rights to be provisioned and managed according to access control rules, which can include prerequisites and approval conditions. ISM-0610 strengthens Annex A 5.18 by defining a concrete pre-provisioning condition (training completion) specific to CDS access, while Annex A 5.18 remains broader across all assets and the full access rights lifecycle.
This control depends on ISM-1422.
ISM-1422 depends on correctly provisioning and maintaining authorisations to the authoritative software source. ISO/IEC 27001:2022 Annex A 5.18 mandates access rights lifecycle management, ensuring proper authorisation exists over time, crucial to maintaining controlled access to the repository.
This control depends on ISM-2131.
ISM-2131 requires routine review and remediation of certificate template settings to prevent unauthorised certificate enrolment and escalation paths created through misconfiguration. This supports ISO/IEC 27001:2022 Annex A 5.18 because tightening template security descriptors, enrolment permissions and EKU/issuance controls helps ensure access rights to certificate-based capabilities are correctly provisioned and reviewed. Annex A 5.18 is broader across all information assets and access rights lifecycles, while ISM-2131 is a technical control focused on AD CS template configuration integrity.
This control depends on ISM-2133.
ISM-2133 requires a unique identity per AI agent so access and actions can be attributed to the correct non-human actor. ISO/IEC 27001:2022 Annex A 5.18 governs provisioning, review, modification, and removal of access rights in line with access control rules. Unique per-agent identities under ISM-2133 make Annex A 5.18 practically enforceable for agents (rights can be granted/revoked per agent rather than via shared or human accounts), but Annex A 5.18 does not itself require identity uniqueness.
This control depends on ISM-2135.
ISM-2135 requires recording identities, accounts, credentials, and access scope for each AI agent. Annex A 5.18 requires provision, review, modification and removal of access rights per access control rules. The ISM-2135 register offers the necessary inventory for reviewing and governing an agent's access rights lifecycle, although it does not itself mandate the provisioning processes.
ASD Essentials for enterprise IT: 4 mappings
- IT.PRO-12.1Periodically review and update access privileges to match current roles and dutiesBroader than
This control is broader than IT.PRO-12.1.
IT.PRO-12.1 requires access privileges to be periodically reviewed and updated so they stay aligned with current roles, duties and business requirements. This directly implements the review and modification of access rights required by Annex A 5.18. Annex A 5.18 is broader, also covering the provisioning and removal of access rights in line with the access control policy and rules.
- IT.PRO-12.2Restrict account and role management and privileged functions to authorised administrative rolesBroader than
This control is broader than IT.PRO-12.2.
IT.PRO-12.2 requires that only authorised administrative roles can create, modify or delete accounts and roles, or access privileged functions or applications. By limiting who can change accounts and roles, it protects the integrity of the provisioning, modification and removal of access rights required by Annex A 5.18. Annex A 5.18 defines the access rights process itself, while IT.PRO-12.2 restricts who is able to carry it out.
- IT.PRO-12.3Provision user, administrative and non-person accounts with minimum required privilegesBroader than
This control is broader than IT.PRO-12.3.
IT.PRO-12.3 requires user, administrative and non-person accounts to be provisioned with only the minimum access and privileges needed for defined operational functions. This applies least privilege at the provisioning stage of the access rights process required by Annex A 5.18. Annex A 5.18 is broader, also covering the review, modification and removal of access rights.
This control is broader than IT.PRO-13.1.
IT.PRO-13.1 requires default and unused accounts to be identified and disabled or removed regularly, with exceptions only where an account is documented, justified, hardened and monitored. Regularly identifying and removing these accounts is a specific case of the review and removal of access rights required by ISO/IEC 27001 Annex A 5.18. Annex A 5.18 also covers provisioning and modifying access rights for all users, while IT.PRO-13.1 targets only default and unused accounts.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.