ISO 27001 Access Control: Policies and Best Practices
Access control is one of the most critical security domains in any information security management system (ISMS). ISO 27001 Annex A.9 addresses access control across 14 controls grouped into four objectives. Getting access control right protects your organisation from the most common attack vectors: credential theft, insider threats, and privilege misuse. This article provides a comprehensive guide to Annex A.9 requirements, access control policies, user access management, privileged access, and cloud access considerations.
Annex A.9: Access Control Requirements
Annex A.9 of ISO 27001:2022 covers access control with the objective of limiting access to information and information processing facilities on the basis of business and security requirements. It comprises four main categories:
| Reference | Objective | Number of Controls |
|---|---|---|
| A.9.1 | Business requirements for access control. | 3 |
| A.9.2 | User access management. | 6 |
| A.9.3 | User responsibilities. | 2 |
| A.9.4 | System and application access control. | 3 |
Each control within these categories requires specific documented policies and procedures. The standard does not prescribe a specific technology stack; rather, it requires that access controls are risk-based, justified, and auditable.
Access Control Policy
Annex A.9.1.1 requires an access control policy that is documented, reviewed, and communicated. The policy should cover:
- Principles of least privilege and need-to-know.
- Access classification levels based on information sensitivity.
- Roles and responsibilities for access management.
- Segregation of duties to prevent conflicts of interest.
- Access review and revocation procedures.
The policy must be approved by management and updated regularly to reflect organisational changes.
| Policy Element | Description | Documentation Required |
|---|---|---|
| Least privilege | Users receive only the minimum access needed. | Access rights matrix per role. |
| Segregation of duties | No single person can perform critical actions alone. | Segregation matrix, approval workflows. |
| Access approval | Formal authorisation for all access requests. | Access request forms with sign-off. |
| Periodic review | Access rights verified at defined intervals. | Review schedules, signed-off review records. |
User Access Management: Joiner-Mover-Leaver
Annex A.9.2 controls cover the full lifecycle of user access. The joiner-mover-leaver model is the industry standard for managing access throughout an individual’s tenure.
| Phase | Annex A Control | Actions Required | Evidence |
|---|---|---|---|
| Joiner | A.9.2.1 (User registration and de-registration) | Identity verification, role-based provisioning, initial password set. | Completed access request form, identity check record. |
| Mover | A.9.2.5 (Review of user access rights) | Access rights re-evaluated on role change; unused rights removed. | Change request, access review record. |
| Leaver | A.9.2.6 (Removal of access rights) | Immediate revocation of all access, return of assets, account disabling. | Offboarding checklist, de-provisioning confirmation. |
Automation of joiner-mover-leaver processes via identity and access management (IAM) tools significantly reduces the risk of orphaned accounts and privilege creep.
Privileged Access Management (PAM)
Privileged access rights (A.9.2.3) require special attention. Users with administrative privileges can bypass security controls, making them high-value targets for attackers. ISO 27001 requires that:
- Privileged access rights are restricted and controlled.
- Separate accounts are used for administrative and everyday activities.
- Privileged sessions are logged and monitored.
- Privileged access rights are reviewed more frequently than standard access.
- Emergency access (break-glass) procedures are documented and tested.
A PAM solution such as CyberArk, BeyondTrust, or a cloud-native equivalent (e.g. Azure Privileged Identity Management) is strongly recommended for organisations with more than a handful of administrators.
Access Reviews
Annex A.9.2.5 requires periodic review of user access rights. An effective access review process includes:
- Defined review frequency (typically quarterly for privileged access, annually for standard access).
- Data owners or line managers certifying access rights for their teams.
- Evidence of review (signed or digitally approved records).
- Remediation of inappropriate access (removal or adjustment).
- Escalation of unresolved issues to management.
Remote Access Controls
The shift to hybrid and remote working has made remote access controls more critical than ever. Annex A.9.4 and related controls require:
- Multi-factor authentication (MFA) for all remote access.
- VPN or zero-trust network access (ZTNA) with device posture checks.
- Session timeouts and automatic lockout after inactivity.
- Restricted access to only necessary systems (no full network access).
- Logging of all remote access sessions.
Network Access Control
Annex A.9.4.2 requires controls for network access. This includes:
- Segmentation of networks into security zones (e.g. DMZ, internal, guest, OT).
- Firewall rules and network ACLs based on least privilege.
- Port and service restrictions on network devices.
- Network access controls for wired, wireless, and VPN connections.
- Guest network access isolated from corporate resources.
Cloud Access Considerations
Cloud access control requires additional considerations beyond traditional on-premises controls. Key areas to address include:
- Identity federation – integrate cloud IAM with on-premises directories (e.g. Azure AD / Entra ID).
- Role-based access control (RBAC) – define cloud-specific roles with minimal permissions.
- API and service account access – secure access keys, rotate credentials, use managed identities.
- Conditional access policies – location, device, and risk-based access decisions.
- Cloud-to-cloud access – control third-party integrations and SaaS-to-SaaS connections.
| Cloud Environment | Key Access Control Features | ISO 27001 Considerations |
|---|---|---|
| AWS | IAM roles, SCPs, service control policies, Cognito. | Control over customer-managed vs. AWS-managed keys. |
| Azure | Entra ID, RBAC, PIM, Conditional Access, managed identities. | Privileged Identity Management for JIT access. |
| Google Cloud | IAM, Cloud Identity, VPC Service Controls, BeyondCorp. | Workload identity federation for hybrid access. |
| SaaS (e.g. O365, Salesforce) | SSO, SCIM, role hierarchies, API access tokens. | Identity provider integration, access reviews. |
Common Non-Conformities in Access Control Audits
Auditors frequently identify the following issues related to Annex A.9:
- No documented access control policy or policy not approved by management.
- Privileged access not segregated from standard user access.
- Access reviews not conducted or not evidenced.
- Orphaned accounts from former employees still active.
- No logging of privileged access activities.
- Shared or generic accounts in use without approval.
- Remote access without MFA.
Frequently Asked Questions
Does ISO 27001 require multi-factor authentication?
ISO 27001 does not explicitly mandate MFA, but Annex A.8.5 (Authentication) and A.9.4.2 (Secure log-on) combined with risk assessment results almost always require MFA for remote access, privileged access, and access to sensitive information systems. In practice, MFA is considered a baseline control.
What is the difference between least privilege and need-to-know?
Least privilege means granting the minimum rights needed to perform a function (e.g. read-only access to a specific folder). Need-to-know is narrower, restricting access to information that is specifically required to carry out a task. Both principles must be applied within your access control policy.
How often should access rights be reviewed?
Annex A.9.2.5 requires periodic review but does not prescribe a frequency. Industry best practice is quarterly reviews for privileged access and annual reviews for standard user access. Higher-risk environments may require monthly or even continuous review.
Are generic or shared accounts ever acceptable?
Generic accounts are strongly discouraged. If used (e.g. for emergency break-glass scenarios), they must have a documented business justification, a named accountable owner, restricted usage procedures, and full logging of all activities.
How do we manage access for third-party vendors?
Vendor access must be controlled through formal agreements (Annex A.5.14), time-limited access with automatic expiry, monitoring of vendor activity, and immediate revocation when the engagement ends. Vendors should authenticate via your identity provider where possible.
What is the role of segregation of duties in access control?
Segregation of duties (A.5.10) ensures that no single individual can compromise a critical process. For example, the person who requests a system change should not be the same person who approves and implements it. This control reduces the risk of fraud, error, and unauthorised changes.
Strengthen Your Access Controls with Bitrixme
Implementing ISO 27001 Annex A.9 controls requires a deep understanding of both the standard and your operational environment. Bitrixme’s ISMS consultants help organisations across the Middle East design, implement, and audit access control frameworks that align with ISO 27001:2022. From policy development to PAM implementation and cloud IAM integration, we provide end-to-end support.
Or reach us on WhatsApp: +973 3659 9909
