Most breaches involve stolen credentials or excessive access. ISO 27001 access control is therefore one of the most tested areas in any audit. It decides who can reach which information, how they prove who they are, and how you remove access when it is no longer needed.
The 2013 edition grouped these topics in Annex A.9 with 14 controls. The 2022 edition reorganised them into four organizational controls and several technological ones. This guide explains each, with practical steps.
Mapping: A.9 (2013) to ISO 27001:2022
| ISO 27001:2013 | ISO 27001:2022 |
|---|---|
| A.9.1.1 Access control policy, A.9.1.2 Access to networks and services | 5.15 Access control |
| A.9.2.1 User registration and de-registration | 5.16 Identity management |
| A.9.2.4, A.9.3.1, A.9.4.3 Secret authentication information and passwords | 5.17 Authentication information |
| A.9.2.2 Provisioning, A.9.2.5 Review, A.9.2.6 Removal of access rights | 5.18 Access rights |
| A.9.2.3 Management of privileged access rights | 8.2 Privileged access rights |
| A.9.4.1 Information access restriction | 8.3 Information access restriction |
| A.9.4.2 Secure log-on procedures | 8.5 Secure authentication |
| A.9.4.4 Use of privileged utility programs | 8.18 Use of privileged utility programs |
| A.9.4.5 Access control to program source code | 8.4 Access to source code |
5.15 Access control
First, set rules for access in a topic-specific policy. Base them on two principles:
- Need to know: people see only the information they need for their job.
- Least privilege: people get only the permissions they need, and no more.
The policy should cover both logical access (systems and data) and physical access (buildings and rooms). It should also define who approves access for each system.
5.16 Identity management
Next, manage the full life cycle of identities. Each person should have a unique ID, so actions can be traced. Shared accounts should be rare, approved and controlled. In addition, link identity creation and removal to HR events, ideally through an identity provider such as Microsoft Entra ID or Okta.
5.17 Authentication information
This control covers passwords, keys, tokens and similar secrets. In practice:
- Issue initial passwords securely and force a change at first login.
- Follow modern password guidance: long passphrases, checks against breached passwords, and no forced periodic changes without a reason.
- Use a password manager for shared secrets.
- Never send passwords by email or chat.
5.18 Access rights
Then control how you grant, review and remove access:
- A manager requests access through a ticket or workflow.
- The system or data owner approves it.
- IT provisions exactly what was approved.
- Owners review access regularly, for example every quarter for critical systems.
- IT removes access promptly when people leave or change roles.
Keep records for every step. Auditors usually sample a few users and trace them through this process.
8.2 Privileged access rights
Admin accounts are the keys to the kingdom. Therefore:
- give admins separate accounts for admin tasks;
- require MFA for all privileged access;
- use just-in-time access where possible;
- log and review privileged activity;
- review the list of admins frequently.
8.3, 8.4 and 8.5: restricting access and authenticating securely
- 8.3 Information access restriction: enforce the policy in applications, for example with role-based access control.
- 8.4 Access to source code: limit write access to repositories, protect branches and require code review.
- 8.5 Secure authentication: use MFA for remote and sensitive access, limit failed login attempts and show no helpful hints on failed logins.
8.18 Use of privileged utility programs
Some tools can bypass normal controls, such as disk editors or debugging tools. So restrict who can run them, log their use and remove them when they are not needed.
Common audit findings
- Former employees with active accounts, often in SaaS tools outside single sign-on.
- Access reviews that are “rubber-stamped” with no changes ever made.
- Shared admin accounts without MFA.
- Service accounts with passwords that never change.
FAQ
Is MFA mandatory in ISO 27001:2022?
The standard does not name MFA as mandatory. However, control 8.5 expects secure authentication based on risk, and most auditors expect MFA for remote and privileged access.
How often should we review access rights?
ISO 27001 does not set a frequency. Many organizations review critical systems quarterly and others yearly.
Related guides
- ISO 27001:2022 Annex A: all 93 controls and the 2013 mapping
- Free ISO 27001:2022 readiness checklist
- What is an ISMS? Concept, benefits and the PDCA cycle
Sources
- ISO/IEC 27001:2022, Information security management systems (ISO)
- ISO/IEC 27002:2022, Information security controls (ISO)
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. Doing it yourself? The ISO 27001:2022 Starter Kit (₹1,999) gives you the gap workbook, risk register, Statement of Applicability and 13 policy templates. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
