ISO 27001 A.5.15: access control rules, explained for startups

A.5.15 Access control

People get only the access their job needs. What proves it: access rules based on job need, and a recent access request that followed them.

A certification auditor samples the access control rules and sample access requests. A file that usually does the job: a ticket showing an access request, the manager approval and the access granted.

How to put it in place

Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.5.15 walks you through it in this order.

1. Write down who approves access to each key system.
2. Route every request through one place, such as a ticket or a form.
3. Grant only what the role needs and keep the approval.

The free ISO 27001 readiness assessment asks one question that evidences it:

• How is access to company systems granted?

Policies, connectors and the SOC 2 overlap

In the ISO 27001 policy pack, the Access Control Policy covers A.5.15. An auditor reads the policy for the rule, then samples the records to see the rule was followed.

Connected systems that pull evidence for it:

• Amazon Web Services, IAM roles: privileged roles and the trust policies that grant them.
• Amazon Web Services, IAM groups: groups and their member assignments.
• GitHub, Organization teams: teams in the organization and their permissions.
• Google Cloud, IAM members: project-level IAM policy bindings, showing which roles are granted to which members.
• Google Workspace, Directory groups: all groups in the Workspace domain with member counts.

The same evidence counts toward SOC 2. The Trust Services criteria that cover this ground: CC6.1, logical access and CC6.3, least privilege.

Organizational controls

A.5.15 is one of the 37 organizational controls in Annex A. How the company runs security: policies, roles, suppliers, incidents, continuity and legal duties. Most of these are written decisions and the records that show you follow them.

Nearby controls in the same theme:

• A.5.12, classifying information
• A.5.13, labeling information
• A.5.14, sending information out
• A.5.16, identities and accounts
• A.5.17, passwords and secrets
• A.5.18, granting and removing access

Before it: A.5.14, sending information out. After it: A.5.16, identities and accounts. Every control, by theme, is on the Annex A controls page.