Access and identity
Who may reach what, how they prove who they are, and how the privileged few are kept few. The clauses here are the ones an auditor tests first because the evidence is in the systems.
Policy types in this family
5- Access control policy policy
Who may access which information and systems, on what basis, how access is granted, reviewed and removed. Required by ISO 27001, ISO 27701, DORA, NIS2; owner the information security lead (CISO or ISMS manager). - Access review procedure procedure
How and how often access rights are checked against need, who signs, and what happens to what is found. Required by ISO 27001; owner the head of IT operations. - Identity and access management standard standard
How identities are created, linked to a person, changed and removed across the systems, and how shared and service accounts are handled. Required by ISO 27001, ISO 27701; owner the head of IT operations. - Password and authentication standard standard
How authentication information is issued, protected, changed and revoked, and where multi-factor authentication is required. Required by ISO 27001, ISO 27701, NIS2; owner the head of IT operations. - Privileged access management policy policy
How the accounts that can change the system are issued, separated from daily accounts, monitored, and taken back. Required by ISO 27001; owner the head of IT operations.
What reaches this family
| ISO 27001 | Expects: access control policy. Requires, by clause: ISO 27001 5.15, ISO 27001 5.18, ISO 27001 5.16, ISO 27001 5.17, ISO 27001 8.5, ISO 27001 8.2. |
|---|---|
| ISO 27701 | Expects: no document of this family on its gap list. Requires, by clause: ISO 27701 A.3.9, ISO 27701 A.3.8, ISO 27701 A.3.23. |
| DORA | Expects: access control policy. Requires, by clause: DORA Art. 9. |
| NIS2 | Expects: access control policy, password and authentication standard. Requires, by clause: NIS2 Art. 21(2)(i), NIS2 Art. 21(2)(j). |
Register the documents in this family
Paste the list; every document in this family is placed in its type, given its owner and cadence against the clauses, and the ones the regimes expect and the list does not carry are named. Eight documents free, no account.
Build a register