ISO 27001 Annex A 8.3 Restrict access to information and assets

This control is broader than E8-RA-ML1.4.

Annex A 8.3 requires access to information and associated assets to be restricted in accordance with an access control policy. E8-RA-ML1.4 relates by constraining privileged accounts that are authorised for online services to only the minimum access required, applying least privilege to a high-risk access class. Annex A 8.3 is broader because it applies to all access to information/assets and is not limited to privileged accounts or online services.

This control is broader than E8-RA-ML3.1.

Annex A 8.3 requires restricting access to information and other assets according to a topic-specific access control policy. E8-RA-ML3.1 directly implements this by requiring privileged access to systems, applications and data repositories to be limited to what is necessary for duties (least privilege). Annex A 8.3 is broader because it includes non-privileged access and wider asset types, while E8-RA-ML3.1 focuses on privileged access hardening.

This control is broader than E8-RB-ML1.5.

Annex A 8.3 requires access to information and associated assets to be restricted in accordance with an access control policy. E8-RB-ML1.5 relates by restricting unprivileged accounts from accessing backups belonging to other accounts, treating backups as protected information assets subject to access limits. Annex A 8.3 is broader because it applies to all information and asset types, not just backup repositories and cross-account access.

This control is broader than E8-RB-ML3.1.

E8-RB-ML3.1 requires that unprivileged accounts cannot access their own backups. ISO/IEC 27001:2022 Annex A 8.3 broadly requires restricting access to information and associated assets in accordance with the access control policy, which encompasses backup data and backup repositories. E8-RB-ML3.1 is a specific restriction for one asset class (backups) and one user class (unprivileged users).

This control is broader than E8-RM-ML3.3.

E8-RM-ML3.3 restricts modification rights to Trusted Locations to authorised privileged users for macro-related content. Annex A 8.3 involves general restrictions on access to assets per access control policy, with E8-RM-ML3.3 being a specific instance for one high-risk asset class concerning write/modify access.

This control is broader than ISM-0343.

ISM-0343 requires organisations to disable write access to removable media and devices where there is no business requirement, implemented through device access control or disabling interfaces. Annex A 8.3 requires restricting access to information and associated assets in accordance with an access control policy, which encompasses controlling who can access and use removable media capabilities. ISM-0343 is a specific subset of Annex A 8.3 focused on removable media write restrictions rather than access restriction in general.

This control is broader than ISM-0382.

ISM-0382 requires that unprivileged users cannot uninstall or disable approved applications. Annex A 8.3 is a broader access control requirement to restrict access to information and associated assets based on policy, which would include restricting access to application management functions. ISM-0382 represents a specific application of that broader principle to software management permissions for approved applications.

This control is broader than ISM-0409.

ISM-0409 requires restrictions on access by foreign nationals to systems handling AUSTEO or REL data. Annex A 8.3 outlines restricting access to information and assets in line with policy requirements, a relevant overarching control. While ISM-0409 is narrowly focused on nationality and data type, Annex A 8.3 addresses broader access control policies without specific cohort considerations.

This control is broader than ISM-0411.

ISM-0411 requires that foreign nationals are not granted access to AGAO data on systems unless effective controls prevent their access to that data. Annex A 8.3 requires restricting access to information and assets in line with an access control policy, applied broadly across users, systems and information types. ISM-0411 is a specific restriction within the broader access restriction requirement of Annex A 8.3.

This control is broader than ISM-0441.

ISM-0441 requires technical controls that restrict temporary access so personnel can only access the data needed for their duties. Annex A 8.3 requires restricting access to information and associated assets based on least-privilege principles. ISM-0441 is narrower because it focuses on temporary access grants specifically, while Annex A 8.3 applies to access restriction generally.

This control is broader than ISM-0443.

ISM-0443 prohibits temporary access to secure systems that handle caveated or sensitive compartmented information. ISO/IEC 27001:2022 Annex A 8.3 requires restricting access to information and associated assets in line with an access control policy, which can include banning temporary access for certain systems. Annex A 8.3 is a general restriction requirement, whereas ISM-0443 is a specific, classification-driven prohibition that sets a stricter rule for a defined set of systems.

This control is broader than ISM-0488.

ISM-0488 requires restricting SSH key-based remote access by enforcing a specific command and validating parameters to prevent unauthorised or unintended actions. Annex A 8.3 requires restricting access to information and associated assets according to the organisation's access control policy. This policy-driven approach can include constraining what actions a remote access method permits. While Annex A 8.3 is higher-level and broader, ISM-0488 is a concrete SSH configuration pattern implementing the least privilege for remote access actions.

This control is broader than ISM-0520.

Annex A 8.3 requires restricting access to information and associated assets according to an access control policy. ISM-0520 supports this by mandating network access controls to prevent unauthorised network devices connecting, thereby limiting who/what can gain network-based access to assets. Annex A 8.3 is broader because it also covers logical access to applications/data and physical access, not only device admission to networks.

This control is broader than ISM-0551.

ISM-0551 requires only authorised IP phones to be permitted to register and access the telephony network, with unauthorised devices blocked by default and unnecessary functions disabled. This maps to Annex A 8.3 because it is a concrete access restriction applied to a specific class of assets (IP telephony endpoints and call control infrastructure). Annex A 8.3 is broader, covering restriction of access to all information and associated assets, not just IP telephony device admission and feature hardening.

This control is broader than ISM-0555.

ISM-0555 mandates authentication and authorisation for IP telephony actions such as device registration and voicemail access. Annex A 8.3 globally enforces access restrictions in line with organisational policies, encompassing IP telephony systems like those in ISM-0555.

This control is broader than ISM-0558.

ISM-0558 requires that public area IP phones are restricted from accessing organisational data networks and telephony services such as voicemail and directories. Annex A 8.3 requires access to information and associated assets to be restricted according to the organisation's access control policy, which can be implemented via network access controls and service authorisation rules for IP phones. ISM-0558 is a specific, technology/location-focused application of access restriction, while Annex A 8.3 is a broad access control requirement across many asset types and access paths.

This control is broader than ISM-0611.

ISM-0611 requires gateway administrators to have only the minimum privileges necessary for their duties. ISO/IEC 27001:2022 Annex A 8.3 requires access to information and associated assets to be restricted in accordance with the organisation's access control policy. ISM-0611 is a specific application of access restriction (least privilege) to a defined privileged role, while Annex A 8.3 applies broadly to all access types and assets.

This control is broader than ISM-0622.

ISM-0622 requires IT equipment authentication to other networks accessed via gateways, ensuring only identified devices can traverse the gateway into another network. Annex A 8.3 requires restricting access to information and assets in line with access control policy, which can be achieved in part by authenticating devices before permitting network connectivity. Annex A 8.3 is broader because it covers access restriction outcomes for information and assets generally, whereas ISM-0622 is focused on device authentication for network access via gateways.

This control is broader than ISM-0694.

ISM-0694 requires an explicit prohibition on privately-owned devices accessing SECRET and TOP SECRET systems or data. Annex A 8.3 is a broader access control requirement to restrict access to information and assets in accordance with policy, under which a 'no BYOD to SECRET/TOP SECRET' rule would be implemented. ISM-0694 is therefore a specific, classification-driven access restriction within the wider access restriction intent of Annex A 8.3.

This control is broader than ISM-0854.

ISM-0854 requires that access to AUSTEO and AGAO data is restricted to Australian Government solely controlled systems located in authorised facilities. Annex A 8.3 establishes the broader requirement that access to information and associated assets is restricted in line with an access control policy. ISM-0854 is a highly specific access restriction (system ownership/control and physical location) that would sit under, and be one rule within, the wider ISO access restriction regime.

This control is broader than ISM-1006.

ISM-1006 requires security measures to prevent unauthorised access to network management traffic. ISO/IEC 27001:2022 Annex A 8.3 requires organisations to restrict access to information and associated assets in accordance with access control policy, which would include restricting access to network management systems and the management traffic they generate. ISM-1006 is a specific application of access restriction to the network management plane, while Annex A 8.3 applies across all information assets.

This control is broader than ISM-1175.

Annex A 8.3 requires restricting access to information and assets per an established access control policy. ISM-1175 is a specific restriction applied to privileged accounts, preventing them from accessing internet, email and web services to reduce exposure and misuse. Annex A 8.3 is broader as it covers access restrictions for all users and assets, not just constraining privileged account use of online services.

This control is broader than ISM-1249.

ISM-1249 requires that server applications run under separate accounts with only the permissions they need. Annex A 8.3 requires access to information and associated assets to be restricted in line with an access control policy, which includes controlling service and application access rights. ISM-1249 is focused on how server applications are configured at run time, whereas Annex A 8.3 is policy-driven and applies to all asset access.

This control is broader than ISM-1250.

ISM-1250 addresses access control by limiting what server application user accounts can do on the server's file system. Annex A 8.3 requires access to information and associated assets to be restricted in accordance with an access control policy, which would include file system access controls for service accounts. ISM-1250 is a specific technical application of the broader access restriction principle in Annex A 8.3.

This control is broader than ISM-1255.

Annex A 8.3 requires access to information and associated assets to be restricted in line with access control policy. ISM-1255 relates by requiring database user permissions (access/insert/modify/remove) to be restricted according to work duties, which is a concrete least-privilege application. Annex A 8.3 is broader as it applies to all asset types and is not limited to database CRUD permissions.

This control is broader than ISM-1256.

ISM-1256 requires file-based access controls (e.g. OS-level permissions/ACLs) to be applied directly to database files to prevent unauthorised access. Annex A 8.3 requires restricting access to information and associated assets in accordance with an access control policy, which can include controlling access to database files. ISM-1256 is a specific technical implementation detail within the broader access restriction requirement of Annex A 8.3.

This control is broader than ISM-1268.

Annex A 8.3 requires restricting access to information and assets based on an established access control policy. ISM-1268 implements this for databases by enforcing need-to-know via minimum privileges, views, roles and tokenisation to constrain access to database contents. Annex A 8.3 is broader because it covers all information assets and access mechanisms, not just database-layer controls.

This control is broader than ISM-1327.

Annex A 8.3 requires access to information and associated assets to be restricted in accordance with an established access control policy. ISM-1327 relates by requiring certificates used for network authentication to be protected using access controls, encryption and user authentication, which is a specific asset-protection implementation of access restriction. Annex A 8.3 is broader because it applies to all information/assets and access scenarios, not just certificate material.

This control is broader than ISM-1392.

ISM-1392 requires enforcing that only approved users can modify approved files and write to approved folders under application control path rules. Annex A 8.3 requires restricting access to information and associated assets in accordance with an access control policy. ISM-1392 is a specific access restriction for write/modify actions in defined paths, whereas Annex A 8.3 is broader and covers access restrictions for all asset types and access modes.

This control is broader than ISM-1422.

ISM-1422 requires that unauthorised access to the authoritative source for software, such as the source code repository, is prevented. ISO/IEC 27001:2022 Annex A 8.3 requires restricting access to information and associated assets according to an access control policy, which includes controlling access to source repositories. Annex A 8.3 is broader as it applies to all information assets, not specifically the authoritative software source.

This control is broader than ISM-1439.

ISM-1439 requires restricting access to origin web servers so only CDNs and authorised management networks can reach them, and avoiding disclosure of the origin IPs. ISO/IEC 27001 Annex A 8.3 is broader, requiring access to information and associated assets to be restricted according to policy, which would include network-layer restrictions protecting origin servers. ISM-1439 adds CDN-specific exposure and network allow-list requirements that are not explicitly called out in Annex A 8.3.

This control is broader than ISM-1487.

ISM-1487 requires restricting write access to Office Trusted Locations so only privileged macro-vetting users can add or change content there. ISO/IEC 27001:2022 Annex A 8.3 is a general control requiring access to information and assets to be restricted according to the organisation's access control policy, which would include restricting write permissions on sensitive directories or configuration locations. Annex A 8.3 applies broadly to all information and assets, whereas ISM-1487 is a specific implementation targeting macro execution trust boundaries.

This control is broader than ISM-1508.

ISM-1508 requires limiting privileged access to what duties require, focusing on elevated permissions. ISO/IEC 27001:2022 Annex A 8.3 is broader by requiring restriction of access to information and associated assets generally in accordance with access control policy, covering both privileged and standard access. ISM-1508 is a specific least-privilege requirement within the broader access restriction expectations of Annex A 8.3.

This control is broader than ISM-1612.

ISM-1612 requires that break glass accounts are only used for specific authorised activities. This is narrower than Annex A 8.3 because Annex A 8.3 requires access to information and associated assets to be restricted in accordance with an access control policy, covering all users and assets. ISM-1612 applies that policy concept to a particular high-risk mechanism (break glass accounts) by limiting their use to authorised emergency actions only.

This control is broader than ISM-1649.

ISM-1649 requires just-in-time administration to restrict administrative access temporally for systems and resources. Annex A 8.3 requires access to information and other associated assets to be restricted in accordance with the organisation's access control policy. JIT administration is one specific method of restricting access (especially privileged access), so ISM-1649 is a more specific subset of the broader access restriction requirement in Annex A 8.3.

This control is broader than ISM-1705.

ISM-1705 requires that privileged user accounts (excluding backup administrator accounts) cannot access backups belonging to other user accounts. Annex A 8.3 is broader, requiring access to information and associated assets to be restricted in line with an access control policy, which would include backups as an asset class. ISM-1705 is a specific, prescriptive access restriction for backups and privileged identities, representing a concrete subset of the general ISO requirement.

This control is broader than ISM-1812.

ISM-1812 requires a specific access restriction: unprivileged users must not be able to access backups belonging to other users. Annex A 8.3 requires that access to information and associated assets be restricted in line with an access control policy, which would include backups as information assets. ISM-1812 is a concrete, backup-specific instance of the broader access restriction principle in Annex A 8.3.

This control is broader than ISM-1813.

ISM-1813 requires that unprivileged user accounts cannot access their own backup data. ISO/IEC 27001:2022 Annex A 8.3 requires restricting access to information and associated assets in accordance with an access control policy, which would include backup data as an information asset. ISM-1813 is a specific, backup-focused access restriction that fits within the broader access restriction requirement of Annex A 8.3.

This control is broader than ISM-1814.

ISM-1814 requires that unprivileged user accounts are prevented from modifying and deleting backups. ISO/IEC 27001:2022 Annex A 8.3 requires restricting access to information and assets in line with access control policy, which includes controlling write/delete permissions to backup repositories. ISM-1814 is a specific application of access restriction focused on backups and unprivileged users, while Annex A 8.3 is broader across all information assets and access types.

This control is broader than ISM-1815.

ISM-1815 requires that event logs are protected from unauthorised modification and deletion. Annex A 8.3 requires restricting access to information and associated assets in accordance with an access control policy, which would include log data and log storage systems. ISM-1815 is a specific application of access restriction focused on log integrity, whereas Annex A 8.3 is broader across all information assets.

This control is broader than ISM-1816.

ISM-1816 requires that the authoritative software source, such as source code repositories and release artefacts, is protected to prevent unauthorised modifications. Annex A 8.3 supports this by mandating access restrictions to information and associated assets, which is essential for preventing unauthorised write access to software sources. While Annex A 8.3 is more general, ISM-1816 specifically concerns the integrity of software sources.

This control is broader than ISM-1817.

ISM-1817 requires that API clients are authenticated and authorised when calling internet-accessible APIs that expose non-public data. Annex A 8.3 requires restricting access to information and associated assets in accordance with an access control policy, regardless of whether access occurs via an API, UI, or other channel. ISM-1817 is a specific implementation of Annex A 8.3 for the internet API access path, emphasising both authentication and authorisation at the API boundary.

This control is broader than ISM-1841.

ISM-1841 requires that only authorised users can add computers to the domain, preventing unprivileged accounts from joining machines. Annex A 8.3 requires restricting access to information and associated assets in accordance with an established access control policy, which includes controlling administrative actions on directory services and endpoints. ISM-1841 is a concrete restriction on a specific administrative capability, whereas Annex A 8.3 is a general access restriction requirement across many asset types and actions.

This control is broader than ISM-1846.

ISM-1846 requires removal/prevention of user accounts in the Pre-Windows 2000 Compatible Access group to restrict unintended access arising from legacy compatibility settings. This is a specific instance of Annex A 8.3, which requires restricting access to information and assets in line with an access control policy. Annex A 8.3 is broader and policy-driven across many asset types, whereas ISM-1846 targets one well-known Windows group membership configuration.

This control is broader than ISM-1852.

ISM-1852 requires limiting unprivileged access to only what is required to perform duties. Annex A 8.3 requires restricting access to information and associated assets in accordance with an established access control policy, which applies broadly across user types and asset classes. ISM-1852 is a specific least-privilege application for ordinary users within the wider access restriction requirement of Annex A 8.3.

This control is broader than ISM-1854.

ISM-1854 requires MFD access to be restricted by user authentication. Annex A 8.3 requires restricting access to information assets per the organisation's policy, including peripherals like MFDs. ISM-1854 is a specific pattern aiding Annex A 8.3 compliance for MFDs, while Annex A 8.3 applies more broadly.

This control is broader than ISM-1862.

Annex A 8.3 requires restricting access to information and associated assets in line with an access control policy. ISM-1862 maps as a specific network access restriction: it requires origin web servers to be accessible only from the WAF and authorised management networks, reducing unauthorised access paths. Annex A 8.3 is broader because it covers access restrictions across all assets and contexts, not just WAF/origin server exposure.

This control is broader than ISM-1888.

ISM-1888 requires secure password-based lock screens to prevent unauthorised access to mobile devices. ISO/IEC 27001:2022 Annex A 8.3 encompasses broader access restrictions for information assets, within which mobile lock screens provide a fundamental layer of security.

This control is broader than ISM-1927.

ISM-1927 requires restricting access to AD DS domain controllers, AD CS CA servers, AD FS servers and Entra Connect servers to privileged users who require access. ISO/IEC 27001:2022 Annex A 8.3 requires access to information and associated assets to be restricted in accordance with the access control policy, which covers restricting access to these identity assets. ISM-1927 is a specific asset-focused application of the broader access restriction requirement in Annex A 8.3.

This control is broader than ISM-1933.

ISM-1933 requires that service accounts configured with an SPN are not granted DCSync permissions (i.e. replication rights that can simulate domain controller behaviour). Annex A 8.3 requires organisations to restrict access to information and associated assets according to an access control policy, which would include restricting high-impact directory replication privileges to only authorised principals. ISM-1933 is a very specific Active Directory access restriction, whereas Annex A 8.3 is a broad access control requirement covering many asset types and access scenarios.

This control is broader than ISM-1936.

ISM-1936 requires that sIDHistory is not used for user accounts, which helps prevent access being granted through historical identifiers rather than current authorised identities. This relates to Annex A 8.3 because removing/avoiding sIDHistory helps ensure access is restricted according to defined access control policy, not expanded through hidden SID-based paths. Annex A 8.3 is broader and applies to restricting access to information assets in general, while ISM-1936 is a targeted control for a specific AD mechanism.

This control is broader than ISM-1985.

ISM-1985 requires event logs to be protected from unauthorised access. Annex A 8.3 relates by requiring restriction of access to information and associated assets according to access control policy, which includes log data as an information asset. ISM-1985 is a specific application of this broader access restriction requirement to the particular asset class of event logs.

This control is broader than ISM-2014.

ISM-2014 requires organisations to authenticate and authorise clients calling internal network APIs that expose non-public data. ISO/IEC 27001:2022 Annex A 8.3 requires restricting access to information and associated assets in accordance with the access control policy, which includes controlling who can access data/services such as APIs. Annex A 8.3 is higher-level and broader (all assets and access methods), whereas ISM-2014 is a specific technical enforcement point for API calls.

This control is broader than ISM-2048.

ISM-2048 requires that non-administrative users cannot alter their own permissions or privileges where multiple user roles exist. ISO/IEC 27001:2022 Annex A 8.3 relates by requiring access to information and assets to be restricted in line with an access control policy, which includes preventing unauthorised privilege changes. Annex A 8.3 is broader because it covers restriction of access generally, whereas ISM-2048 focuses specifically on stopping role/permission self-modification by non-admin users.

This control is broader than ISM-2092.

ISM-2092 requires restricting AI application use through fine-grained permissions enforced by access control policies. ISO/IEC 27001:2022 Annex A 8.3 requires restricting access to information and associated assets in accordance with the access control policy. ISM-2092 is a specific case of Annex A 8.3 focused on AI application permission models and enforcement.

This control is broader than ISM-2093.

ISM-2093 requires RBAC for AI applications to restrict access to sensitive AI data. Annex A 8.3 requires restricting access to information and associated assets according to an access control policy, which includes AI data as a subset. ISM-2093 is a specific, AI-focused instantiation of the broader ISO requirement to restrict access based on policy.

This control is broader than ISM-2095.

ISM-2095 restricts granting unapproved AI agents access to OFFICIAL: Sensitive or PROTECTED systems or data when accessed via privately-owned devices. Annex A 8.3 requires access to information and associated assets to be restricted in line with an established access control policy, which would encompass restricting AI tools or integrations to approved ones only. ISM-2095 is narrower because it specifies a particular risk scenario (unapproved AI on BYOD) rather than general access restriction.

This control is broader than ISM-2124.

ISM-2124 requires service providers to access systems only via approved remote management tools, approved source addresses, and approved time windows. Annex A 8.3 requires restricting access to information and associated assets in accordance with an access control policy, which can include conditions such as allowed connection methods, IP allow-listing, and scheduled access. ISM-2124 is a specific implementation pattern for third-party remote access, while Annex A 8.3 is broader and not limited to service providers or remote management contexts.

This control is broader than ISM-2136.

ISM-2136 requires dynamic enforcement of access decisions driven by contextual risk signals at the time of each access request. Annex A 8.3 requires restricting access to information and assets in accordance with an established access control policy. Annex A 8.3 underpins the baseline restriction model (who can access what), while ISM-2136 adds conditional, context-aware decisioning and step-up/deny behaviour that is not explicit in Annex A 8.3.

This control is broader than ISM-2137.

ISM-2137 requires preventing standard users from authorising third-party OAuth applications, with only authorised administrators able to grant consent. Annex A 8.3 requires restricting access to information and other associated assets in accordance with the organisation's access control policy, which can include restricting who can authorise third-party app access to organisational data. Annex A 8.3 is broader and asset-centric, whereas ISM-2137 targets a specific consent-granting pathway (OAuth) and administrative approval model.

This control is broader than ISM-2156.

ISM-2156 requires restricting agentic AI applications to the minimum tools, functions and permissions necessary. Annex A 8.3 requires access to information and associated assets to be restricted according to the organisation's access control policy, which covers least-privilege restrictions for all actors and systems. Annex A 8.3 is broader and policy-driven, whereas ISM-2156 is a specific access restriction pattern for agentic AI.

This control is broader than ISM-2157.

ISM-2157 requires that tools invoked by an agentic AI application are constrained by both the invoking user's access and an agent-specific, task-scoped authorisation, with effective permissions being the minimum of the two. This relates to Annex A 8.3 because both enforce restricting access to assets based on defined access control rules. Annex A 8.3 is broader and technology-agnostic, while ISM-2157 is a specific least-privilege pattern for delegated/agent tool execution.

This control partially meets ISM-1604.

ISM-1604 requires hardening of the virtual isolation mechanism and restricting access to its administrative interface. Annex A 8.3 broadly requires restricting access to information and associated assets in line with access control policy, which includes restricting access to hypervisors, management consoles and configuration stores. ISM-1604 is a specific, technology-focused instance of this general access restriction requirement for virtualisation management and isolation controls.

This control partially overlaps ISM-0133.

Annex A 8.3 requires organisations to restrict access to information and associated assets in accordance with an access control policy. ISM-0133 relates by requiring access to spilled data to be restricted as an incident response containment measure. The overlap is in restricting access, but ISM-0133 is event-driven (data spill response) whereas Annex A 8.3 is a standing policy-based control for normal operations.

This control partially overlaps ISM-0462.

ISM-0462 requires that when a user authenticates to encryption on IT equipment or media, the equipment/media is treated at its original sensitivity/classification until the user deauthenticates. Annex A 8.3 requires restricting access to information and associated assets in line with an access control policy, which can include controlling who may authenticate to encryption and thereby gain access to the plaintext. However, ISM-0462 is specifically about classification handling behaviour during an encryption-authenticated session, whereas Annex A 8.3 is broader access restriction across all assets and access methods.

This control partially overlaps ISM-1833.

ISM-1833 requires Active Directory user accounts to be provisioned with the minimum privileges required. Annex A 8.3 broadly requires restricting access to information and associated assets in accordance with the access control policy, which includes least-privilege restrictions across the organisation. ISM-1833 is a narrower, technology-specific application of this principle focused on AD account privilege assignment rather than all information assets and access paths.

This control partially overlaps ISM-1866.

ISM-1866 mandates preventing the storage of OFFICIAL: Sensitive or PROTECTED data on privately owned mobile devices and desktop computers. Annex A 8.3 requires restricting access to information and assets according to an access control policy, which can restrict access paths allowing downloads onto unmanaged devices. ISM-1866 is specific to data residency concerns, while Annex A 8.3 encompasses a broader access restriction strategy.

This control partially overlaps ISM-2046.

ISM-2046 requires systems with impersonation capability to prevent sensitive data from being logged and to enforce appropriate permissions on resulting logs. Annex A 8.3 supports this by requiring access to information and associated assets to be restricted according to access control policy, directly underpinning the restriction of access to impersonation logs and features. Annex A 8.3, however, does not address the key ISM-2046 requirement to minimise sensitive content within logs.

This control is broader than IT.PRO-12.3.

IT.PRO-12.3 requires user, administrative and non-person accounts to be provisioned with only the minimum access and privileges needed for defined operational functions. Provisioning to this least privilege standard directly limits access in the way Annex A 8.3 requires, restricting access to information and other associated assets in line with the access control policy. IT.PRO-12.3 concentrates on what each account is granted, including operational privileges, while Annex A 8.3 covers the technical restriction of access to information more generally.

This control partially overlaps IT.PRO-01.1.

IT.PRO-01.1 requires systems to be designed securely to enforce authorised access and protect data, among other outcomes. These outcomes overlap with ISO/IEC 27001 Annex A 8.3, which requires access to information and other associated assets to be restricted in accordance with the topic-specific policy on access control. Annex A 8.3 focuses on restricting access according to that policy, while IT.PRO-01.1 also covers visibility, privilege minimisation and attack surface reduction.