Ensuring Secure Access: ISO 27002 Control 5.18 Explained
Every employee within your organisation will need to have access to certain computers, databases, information systems, and applications to perform their tasks.
For example, while human resources personnel may need access to sensitive health data of employees, your finance department may rely on accessing and using databases containing employee salary details.
However, these access rights should be provided, modified, and revoked in line with your organisation’s access control policy and its access controls so that you can prevent unauthorised access to, modification of, and destruction of information assets.
For instance, if you fail to revoke the access rights of a former employee, that employee may steal sensitive information.
Control 5.18 deals with how organisations should assign, modify and revoke access rights taking into account business requirements.
Purpose of Control 5.18
Control 5.18 enables an organisation to establish and implement appropriate procedures and controls to assign, modify and revoke access rights to information systems in compliance with the organisation’s access control policy and its access controls.
Attributes of Control 5.18
Control 5.18 is a preventive control that requires organisations to eliminate the risk of unauthorised access to information systems by putting in place robust rules, procedures, and controls.
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Preventive | #Confidentiality | #Protect | #Identity and Access Management | #Protection |
| #Integrity | ||||
| #Availability |
ISO 27001 made easy
An 81% Headstart from day one
We’ve done the hard work for you, giving you an 81% Headstart from the moment you log on. All you have to do is fill in the blanks.
Ownership of Control 5.18
An Information security officer should be responsible to establish, implement and review appropriate rules, processes, and controls for provision, modification and revocation of access rights to information systems.
When assigning, modifying, and revoking access rights, the information security officer should consider business needs and should closely work with information asset owners to ensure that rules and processes are adhered to.
Guidance on Granting and Revocation of Access Rights
Organisations should incorporate the following rules and controls into the process for assignment and revocation of access rights to an authenticated individual:
- Information asset owner should provide its authorisation for access to and use of relevant information assets. Furthermore, organisations should also consider seeking separate approval from the management for granting access rights.
- Business needs of the organisation and its policy on access control should be taken into account.
- Organisations should consider segregating duties. For instance, the approval task and the implementation of access rights can be performed by separate individuals.
- When an individual no longer needs access to information assets, particularly when they are no longer part of the organisation, their access rights should be revoked immediately.
- Personnel or other staff working for the organisation temporarily can be provided with temporary access rights. These rights should be revoked when they no longer work for the organisation.
- Level of access provided to an individual should be in line with the organisation’s access control policy and should be reviewed and verified regularly. Furthermore, it should also be in accordance with other information security requirements such as segregation of duties as set out in Control 5.3.
- Organisations should ensure that access rights are not activated until the appropriate authorisation procedure is completed.
- Access rights provided to each individual identifier, such as ID or physical, should be logged onto a central access control management system and this system should be maintained.
- If an individual’s role or duties change, their level of access rights should be updated.
- Removal or modification of physical or logical access rights can be carried out via the following methods: Removal or replacement of keys, ID cards, or authentication information.
- Changes to a user’s physical and logical access rights should be logged onto a system and should be maintained.
Free yourself from a mountain of spreadsheets
Embed, expand and scale your compliance, without the mess. IO gives you the resilience and confidence to grow securely.
Supplementary Guidance on Review of Access Rights
Physical and logical access rights should go through periodic reviews taking into account:
- Changes in each user’s access rights after they are promoted or demoted within the same organisation, or after their employment is terminated.
- Authorisation procedure for granting privileged access rights.
Guidance on Change or Termination of Employment
Before an employee is promoted or demoted within the same organisation or when his/her employment is terminated, his/her access rights to information processing systems should be evaluated and modified by taking into account the following risk factors:
- Whether the termination process is initiated by the employee or by the organisation and the reason for termination.
- Current responsibilities of the employee within the organisation.
- Criticality and value of information assets accessible to the employee.
Supplementary Guidance
Organisations should consider establishing user access roles based on their business requirements. These roles should include the types and number of access rights to be granted to each user group.
Creating such roles will make it easier to manage and review access requests and rights.
Organisations should include contractual provisions for unauthorised access and sanctions for such access in their employment/service contracts with their staff. This should be in accordance with the controls 5.20, 6.2, 6.4, and 6.6.
Organisations should be cautious against disgruntled employees who are laid off by the management because they may damage information systems on purpose.
If organisations decide to use the cloning techniques to grant access rights, they should perform it on the basis of distinct roles established by the organisation.
It should be noted that cloning comes with the inherent risk of granting excessive access rights.
Manage all your compliance, all in one place
ISMS.online supports over 100 standards and regulations, giving you a single platform for all your compliance needs.
Changes and Differences from ISO 27002:2013
27002:2022/5.18 replaces 27002:2013/(9.2.2, 9.2.5, 9.2.6).
2022 Version Contains More Comprehensive Requirements for Granting and Revocation of Access Rights
Although Control 9.2.2 in the 2013 version listed six requirements for assigning and revoking access rights, Control 5.18 in 2022 version introduces three new requirements in addition to these six requirements:
- Personnel or other staff working for the organisation temporarily can be provided with temporary access rights. These rights should be revoked when they no longer perform work for the organisation.
- Removal or modification of physical or logical access rights can be carried out via the following methods: Removal or replacement of keys, ID cards, or authentication information.
- Changes to a user’s physical and logical access rights should be logged and maintained.
2013 Version Contains More Detailed Requirements for Privileged Access Rights
Control 9.5 in version 2013 explicitly stated that organisations should review the authorisation for privileged access rights at more frequent intervals than other access rights. Control 5.18 in Version 2022, on the contrary, did not contain this requirement.
New ISO 27002 Controls
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | NEW | Threat intelligence |
| 5.23 | NEW | Information security for use of cloud services |
| 5.30 | NEW | ICT readiness for business continuity |
| 7.4 | NEW | Physical security monitoring |
| 8.9 | NEW | Configuration management |
| 8.10 | NEW | Information deletion |
| 8.11 | NEW | Data masking |
| 8.12 | NEW | Data leakage prevention |
| 8.16 | NEW | Monitoring activities |
| 8.23 | NEW | Web filtering |
| 8.28 | NEW | Secure coding |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | NEW | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
How ISMS.online Helps
ISMS.online is a cloud-based platform that offers assistance in implementing the ISO 2702 standard efficiently and cost effectively.
It provides organisations with easy access to up-to-date information about their compliance status at all times through its user-friendly dashboard interface which allows managers to monitor their progress towards achieving compliance quickly and easily.
Get in touch today to book a demo.
