A.5.15 Access control
Set rules for physical and logical access based on business and security requirements.
16
artefacts
3
held by a system
3
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Access revocation tickets · Identity provider / directory
- Privileged session recording logs · Identity provider / directory
- Privileged account password change logs · Identity provider / directory
periodic reviewEvidence produced at each review
- Badge issuance records · Physical access / facilities
- Physical security system configuration screenshots · Physical access / facilities
- Quarterly access rights review reports · Identity provider / directory
governing documentDocuments that govern the control
- Facility access control procedures · Policy repository / GRC workspace
- Visitor log templates · Policy repository / GRC workspace
- User account provisioning SOP · Policy repository / GRC workspace
- Password policy document · Policy repository / GRC workspace
- Network device access control lists · Policy repository / GRC workspace
- Application role matrix · Policy repository / GRC workspace
- Segregation of duties analysis · Policy repository / GRC workspace
- Exception approval forms · Policy repository / GRC workspace
- Privileged account inventory · Policy repository / GRC workspace
- Just-in-time access request forms · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 3 system-held artefacts from your Identity provider / directory on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Infrequent review of access rights
- Missing documentation for temporary access
- Overly broad role definitions
- Inadequate segregation of duties enforcement
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet