The Big Picture
Access control is one of the most scrutinised areas in any ISO 27001 audit. It's also where many organisations have the widest gap between policy and practice.
Core Principles
1. Least Privilege
Users should only have the minimum access needed for their role. This sounds obvious but is rarely implemented well.
2. Need-to-Know
Access to information should be based on business need, not seniority or convenience.
3. Separation of Duties
No single person should control an entire critical process. The person who writes code shouldn't deploy it to production without review.
What to Implement
User Access Management
•Formal registration and de-registration process — How are accounts created and removed?
•Access provisioning — Who approves access? Is it documented?
•Privileged access management — Admin accounts need extra controls
•Regular access reviews — Quarterly minimum for critical systems
Authentication
•Multi-factor authentication for all remote access and admin accounts
•Password policy aligned with current NIST guidance (length > complexity)
•Service account management and rotation
•SSO where practical to reduce credential sprawl
Network Access
•Network segmentation between environments
•VPN or zero-trust for remote access
•Firewall rules documented and reviewed
•Wi-Fi security (separate guest and corporate networks)
Common Audit Findings
•Orphaned accounts (leavers still with access)
•Shared admin credentials
•No regular access reviews
•Excessive permissions ("everyone is admin")
•No logging of privileged access usage
Evidence to Maintain
•Access request and approval records
•Joiner/mover/leaver process documentation
•Quarterly access review reports
•MFA enrollment reports
•Privileged access usage logs
Pro Tip
Automate access reviews where possible. Manual spreadsheet-based reviews are error-prone and time-consuming. Even a simple script that exports user lists from key systems saves hours.