All 93 controls · Organizational controls
Control 5.18
Access rights
What ISO/IEC 27002:2022 control 5.18 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Granting, reviewing, changing and withdrawing access rights to information and associated assets is to comply with the rules and the access control policy of the organization. Purpose: keep access to information and assets defined and approved in line with business needs. Guidance on provisioning and revocation of physical and logical rights attached to an authenticated identity: get the asset owner's authorization (5.9), with separate management approval where suitable; weigh business need and the access control policy; apply segregation, keeping approval apart from implementation and conflicting roles apart; withdraw rights when no longer needed and promptly for leavers; consider time-limited access that expires automatically, especially for temporary staff or temporary needs; check the level granted fits the policy (5.15) and other requirements such as segregation of duties (5.3); activate rights, including by service providers, only after authorization is complete; keep a central record of rights held by each user identifier; change rights when people change job; remove or adjust rights by revoking or replacing keys, credentials, ID cards or subscriptions; and log every change to logical and physical rights. Reviews should regularly look at rights after internal moves (promotion, demotion, job change) or employment end (6.1 to 6.5) and at privileged authorizations. Before a change or termination, rights are reviewed and reduced or removed based on risk: who initiated it and why, the person's current duties and the value of what they can reach. Other information: role-based access profiles make requests and reviews easier; contracts can set sanctions for attempted unauthorized access (see 5.20 and 6.2, 6.4 and 6.6); people dismissed or resigning may sabotage systems or gather information; copying one user's access to another (cloning) is convenient but should be based on defined roles, since it tends to grant excess rights.
Purpose in the standard’s terms, in our words: Keeps access to information and assets defined and approved against what the business needs.
Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Identity and access management; Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | Protect |
| Operational capabilities | Identity and access management |
| Security domains | Protection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- Access request records showing owner authorization, and management approval where required, before rights were activated
- A central record of access rights per user identifier across logical and physical access
- Periodic access review records including privileged access, with evidence that removals identified in the review were actioned
- Leaver and mover reports showing timely removal or adjustment of rights, including keys, cards and subscriptions
- Configuration or records of time-limited access that expired automatically for temporary needs
- A change history for every user's logical and physical access
Where audits commonly find gaps
- Access is cloned from a colleague's profile, carrying over excessive rights
- Access reviews are rubber-stamped by managers without owner involvement
- Physical access badges are not revoked on the same timeline as logical accounts
- Temporary access granted for projects is never removed
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (09.2.2, 09.2.5) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.