Access control policy

Set rules for physical and logical access based on business and security requirements.

What the ISO 27002 guidance expects the document to say: Requires rules governing access to information and the assets tied to it, covering both physical entry and logical access, to be established and implemented on the basis of business need and security requirements.

Provision, review, modify and remove access rights in line with the access control policy.

What the ISO 27002 guidance expects the document to say: Requires access rights to information and other associated assets to be provisioned, reviewed, modified and removed in accordance with the organisation's topic specific policy and rules on access control.

The organization shall maintain an accurate, up-to-date record of the user profiles created for users authorised to access information systems and the PII they contain, the profile comprising the data about the user, including the user identifier, needed to implement the technical controls that provide authorised access. Individual user identifiers shall be used so that appropriately configured systems can identify who accessed PII and what additions, deletions or changes they made, which protects users as well as the organization. Where the organization provides PII processing as a service and the customer is responsible for some or all access management, the organization shall where appropriate provide the customer the means to perform it, such as administrative rights to manage or terminate access, and document such cases.

Financial entities shall continuously monitor and control the security and functioning of ICT systems and tools, and minimise ICT risk through appropriate ICT security policies, procedures, protocols and tools ensuring resilience, continuity and availability, and preserving confidentiality, integrity and authenticity of data (incl access management, encryption, secure configuration, network security).

Three linked disciplines sit in one point because they fail together. Human resources security covers screening proportionate to the role, security terms in employment, and the leaver process. Access control policy covers how identities are created, what rights they carry, how privileged access is granted and reviewed, and how rights change when a person moves internally. Asset management covers knowing what the entity has, who owns it, how it is classified and what happens at disposal. The join between them is where evidence is usually thin: a leaver process that reclaims the laptop but not the cloud account, or an access review run against a directory that does not include the systems that matter. Internal movers are a sharper test than leavers, because accumulated rights are rarely removed.