Information access restriction

What the control asks

The organization is to limit who can reach information and associated assets, following its established access control policy. Purpose: permit authorized access and block unauthorized access to information and associated assets. Guidance: to support restriction, consider not allowing unknown or anonymous identities to reach sensitive information, granting public or anonymous access only to locations holding nothing sensitive; configuration settings that govern who reaches what inside systems, applications and services; control over which data each user can reach; control over which identities or groups hold which permissions, for example reading, writing, deleting or executing; and physical or logical isolation of sensitive applications, their data or systems. Consider dynamic access management for high-value sensitive information where the organization needs fine-grained control over who accesses it, when and how; wants to share it externally while keeping control; wants to manage its use and distribution in real time; wants to prevent unapproved alteration, copying, forwarding or printing; wants to monitor its use; or wants a record of changes for possible investigation. Such techniques should protect information throughout creation, processing, storage, transmission and disposal, with rules per use case that grant permissions by identity, device, location or application and use the classification scheme to decide what needs this protection, backed by operating, monitoring and reporting processes and technical infrastructure. Dynamic access systems protect information by requiring authentication, credentials or a certificate; limiting access to a time window; encrypting it; setting print permissions; recording who uses it and how; and alerting on attempted misuse. Other information: these techniques can protect documents, emails and files even after they leave the organization, where ordinary controls cannot reach, adapting over the life cycle; they supplement rather than replace classic controls such as access control lists by adding conditions, real-time evaluation and just-in-time data reduction; permissions can be changed or withdrawn at any time, which aids incident response; ISO/IEC 29146 provides a framework.

Purpose in the standard’s terms, in our words: Ensures only authorized access to information and associated assets and prevents unauthorized access.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Identity and access management; Protection.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• System, application and cloud storage configurations restricting access by identity or group, with granular permissions per action
• Evidence that anonymous or public access is limited to locations holding no sensitive information, for example storage bucket access reviews
• Isolation of sensitive applications, data or systems through physical or logical segmentation
• Rules and configuration for dynamic access management or rights management on high-value information (identity, device, location, time limits, printing, encryption)
• Usage logs and misuse alerts from dynamic access or rights management tooling
• Mapping of classification levels to the access restriction techniques applied

Where audits commonly find gaps

• Cloud storage or file shares allow anonymous access to sensitive data
• Permissions are granted to broad groups such as all staff
• Sensitive documents shared externally cannot be revoked or tracked
• Delete and execute permissions are granted where only read is needed

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (09.4.1) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 8.2 Privileged access rights
• 8.4 Access to source code
• 8.5 Secure authentication

Read the five attributes All 93 controls