What evidence do auditors commonly ask for on 5.18 Access rights?

Access request records showing owner authorization, and management approval where required, before rights were activated; A central record of access rights per user identifier across logical and physical access; Periodic access review records including privileged access, with evidence that removals identified in the review were actioned; Leaver and mover reports showing timely removal or adjustment of rights, including keys, cards and subscriptions; Configuration or records of time-limited access that expired automatically for temporary needs; A change history for every user's logical and physical access.

What is the most common gap auditors find on 5.18?

Access is cloned from a colleague's profile, carrying over excessive rights

ISO/IEC 27002:2022 · Organizational controls

`5.18` Access rights

Granting, reviewing, changing and withdrawing access rights to information and associated assets is to comply with the rules and the access control policy of the organization. Purpose: keep access to information and assets defined and approved in line with business needs. Guidance on provisioning and revocation of physical and logical rights attached to an authenticated identity: get the asset owner's authorization (5.9), with separate management approval where suitable; weigh business need and the access control policy; apply segregation, keeping approval apart from implementation and conflicting roles apart; withdraw rights when no longer needed and promptly for leavers; consider time-limited access that expires automatically, especially for temporary staff or temporary needs; check the level granted fits the policy (5.15) and other requirements such as segregation of duties (5.3); activate rights, including by service providers, only after authorization is complete; keep a central record of rights held by each user identifier; change rights when people change job; remove or adjust rights by revoking or replacing keys, credentials, ID cards or subscriptions; and log every change to logical and physical rights. Reviews should regularly look at rights after internal moves (promotion, demotion, job change) or employment end (6.1 to 6.5) and at privileged authorizations. Before a change or termination, rights are reviewed and reduced or removed based on risk: who initiated it and why, the person's current duties and the value of what they can reach. Other information: role-based access profiles make requests and reviews easier; contracts can set sanctions for attempted unauthorized access (see 5.20 and 6.2, 6.4 and 6.6); people dismissed or resigning may sabotage systems or gather information; copying one user's access to another (cloning) is convenient but should be based on defined roles, since it tends to grant excess rights.

Source: ISO/IEC 27002:2022, 5.18. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.

ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.

artefacts

held by a system

at each review

easy

to go live

Identity provider / directory

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Leaver and mover reports showing timely removal or adjustment of rights, including keys, cards and subscriptions · Identity provider / directory
Configuration or records of time-limited access that expired automatically for temporary needs · Identity provider / directory
A change history for every user's logical and physical access · Physical access / facilities

periodic reviewEvidence produced at each review

Access request records showing owner authorization, and management approval where required, before rights were activated · Identity provider / directory
A central record of access rights per user identifier across logical and physical access · Physical access / facilities
Periodic access review records including privileged access, with evidence that removals identified in the review were actioned · Identity provider / directory

governing documentDocuments that govern the control

none for this control

First move

Automate the pull from your Identity provider / directory. Scheduled export of users, roles and MFA state from the directory; access-review completion pulled from the IdP, not a spreadsheet.

Common gaps auditors find

Access is cloned from a colleague's profile, carrying over excessive rights
Access reviews are rubber-stamped by managers without owner involvement
Physical access badges are not revoked on the same timeline as logical accounts
Temporary access granted for projects is never removed

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

5.17 Authentication information · 5.19 Information security in supplier relationships