Key takeaways
- Set rules for who can access what, based on business need.
- Access control decides who can see and change what.
- Start here: write an access control policy based on least privilege and need to know.
Purpose
Set rules for who can access what, based on business need.
Requirement
Requirement summaryRules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.
Why it matters
Access control decides who can see and change what. It is one of the most tested areas in any audit.
How to implement
- Write an access control policy based on least privilege and need to know.
- Define access per role rather than per person where possible.
- Require approval for access requests and record it.
- Review access regularly and remove what is no longer needed.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.15. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your access control policy, showing who is allowed to access what, based on 'only what you need for your job'.
- A role-based access table showing standard access for each job.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.15 marked as used or not used, a short reason, and its current status.
Records and examples to show
- A list of users and their access for key systems, matching their roles.
- Approval records for recent access requests.
Things you should be able to show or explain
- Be able to walk through how someone requests and gets access.
How much to show: 10 or so users across teams, including administrators.
Common mistakes
- People with more access than their job needs.
- Access given without approval.
- Granting broad access 'just in case'.
- Policy says least privilege but shared admin accounts remain.
- Tip: Write down the 'least privilege' and 'need to know' principles explicitly.
Policies & documents to have
- Access Control Policy
- Physical Security Policy
FAQ
Is A.5.15 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.15?
Be ready to explain how the control works in your organisation and to provide things like: Your access control policy, showing who is allowed to access what, based on 'only what you need for your job'…