Free ebook: NIS2 ready using ISO 27001 best practices
Download ebook

Defining and documenting access roles


The organization implements role-based access control with predefined access roles for the various protected assets that entitle access to the associated asset. Strictness of the access roles should reflect the security risks associated with the asset.

The following should be considered to support access management:

  • how much information each user needs access to
  • how widely the user should be able to edit data (read, write, delete, print, execute)
  • whether other applications have access to the data
  • whether the data can be segregated within the property so that sensitive data is less exposed
Connected other frameworks and requirements:
I06: Pääsyoikeuksien hallinnointi
25. Data protection by design and by default
5. Principles relating to processing of personal data
9.1.1: Access control policy
ISO 27001
9.2.2: User access provisioning
ISO 27001
No items found.