5.15 Access control
Requires rules governing access to information and the assets tied to it, covering both physical entry and logical access, to be established and implemented on the basis of business need and security requirements.
5
artefacts
1
held by a system
2
at each review
hard
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Configuration evidence showing the enforced rule set matches the documented rule, sampled across key systems · Identity provider / directory
periodic reviewEvidence produced at each review
- Evidence the rules reflect business need and the classification of the information rather than convenience · Identity provider / directory
- Records of how access rules are decided and approved, including who may authorise an exception · Identity provider / directory
governing documentDocuments that govern the control
- The access control policy and the specific rules derived from it, expressed per information asset or asset group · Policy repository / GRC workspace
- The mapping from rules to enforcement points, covering logical systems and physical areas · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Identity provider / directory on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Policy states principles such as least privilege while the actual rules per asset are never written down, so there is nothing to test enforcement against
- Physical access treated as a facilities matter and excluded from the access control rules entirely
- Rules defined for core systems while shadow systems, collaboration platforms and cloud tenancies are outside them
- Documented rules and enforced configuration diverge over time with no reconciliation
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet