Content library
ISO 27001 (2022): Full
5.18: Access rights

Requirement description

Access to information and related assets must follow the organization's access control policy, this involves setting up, reviewing, modifying, and removing access rights in line with the Organization's rules. The process of assigning or revoking access rights can involve e.g. obtaining authorization from asset owners, with separate management approval if necessary, addressing segregation of duties, including separation of approval and implementation roles and ensuring timely removal of access rights when not needed.

How to fill the requirement

ISO 27001 (2022): Full

5.18: Access rights

Task name
Priority
Status
Theme
Policy
Other requirements
Regular reviewing of data system access rights
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
System management
Access control and authentication
31
requirements

Examples of other requirements this task affects

I06: Pääsyoikeuksien hallinnointi
Katakri
16 §: Tietojärjestelmien käyttöoikeuksien hallinta
TiHL
24. Responsibility of the controller
GDPR
32. Security of processing
GDPR
5. Principles relating to processing of personal data
GDPR
See all related requirements and other information from tasks own page.
Go to >
Regular reviewing of data system access rights
1. Task description

Data system owner determines the access roles to the system in relation to the tasks of users. The compliance of the actual access rights with the planned ones must be monitored and the rights reassessed at regular intervals.

When reviewing access rights, care must also be taken to minimize admin rights and eliminate unnecessary accounts.

Review of access right for changed employee roles
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Personnel security
Changes in employment relationships
13
requirements

Examples of other requirements this task affects

9.2.5: Review of user access rights
ISO 27001
UAC-06: Managing user privileges
Cyber Essentials
HAL-15: Työskentelyn tietoturvallisuus koko palvelussuhteen ajan
Julkri
TEK-07.3: Pääsyoikeuksien hallinnointi - pääsyoikeuksien ajantasaisuus
Julkri
5.18: Access rights
ISO 27001
See all related requirements and other information from tasks own page.
Go to >
Review of access right for changed employee roles
1. Task description

In all changes on employment relationship, access rights should be reviewed in cooperation with the owners of the protected property and re-granted to the person completely when there is a significant change in the person's employment. A change can be a promotion or a change of role (e.g., moving from one unit to another).

Instructions for reporting changes affecting access rights
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
System management
Access control and authentication
15
requirements

Examples of other requirements this task affects

Članak 30.1.i (Pristup): Politike kontrole pristupa
NIS2 Croatia
9.7 §: Pääsynhallinta, todentaminen ja MFA
Kyberturvallisuuslaki
4.1.1: Management of access methods
TISAX
30 § 3.9° (l'accès): Contrôle d'accès
NIS2 Belgium
14.5.10.b): Prieigos kontrolė
NIS2 Lithuania
See all related requirements and other information from tasks own page.
Go to >
Instructions for reporting changes affecting access rights
1. Task description

Supervisors have been instructed to notify the owners of data systems in advance of significant changes in the employment relationships of subordinates, such as promotions, discounts, termination of employment or other changes in the job role.

Based on the notification, a person's access rights can be updated either from the centralized management system or from individual data systems.

Arranging training and guidance during orientation (or before granting access rights)
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Personnel security
Cyber security training
24
requirements

Examples of other requirements this task affects

Članak 30.1.g: Kibernetičke higijene i osposobljavanje o kibernetičkoj sigurnosti
NIS2 Croatia
2.6: Ohjeet ja koulutus
TiHL tietoturvavaatimukset
9.11 §: Perustason tietoturvakäytännöt ja henkilöstön vastuu
Kyberturvallisuuslaki
2.1.3: Staff training
TISAX
4 §: Tiedonhallinnan järjestäminen tiedonhallintayksikössä
TiHL
See all related requirements and other information from tasks own page.
Go to >
Arranging training and guidance during orientation (or before granting access rights)
1. Task description

Before granting access rights to data systems with confidential information employees have:

  • received appropriate guidance on their security responsibilities (including reporting responsibilities and responsibility for their own devices)
  • received appropriate guidance on their security roles related to their own role (including digital security rules related to their role and information systems and their acceptable use)
  • received information from cyber security contacts who can be asked for more information
Identification and management of shadow IT
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
System management
Data system management
3
requirements

Examples of other requirements this task affects

9.2.2: User access provisioning
ISO 27001
5.18: Access rights
ISO 27001
1.1.5: Identify the organisation’s deliverables, information systems and supporting ICT functions
NSM ICT-SP
See all related requirements and other information from tasks own page.
Go to >
Identification and management of shadow IT
1. Task description

On average, the IT administrator estimates that staff use about 50 cloud services when the actual number is 1,000. Many of these are important for staff productivity and are used outside the organization’s network, so firewall rules do not solve the challenge.

Systems that focus on identifying and managing cloud services allow you to identify the cloud services used by your staff and monitor users of different services. This helps e.g.:

  • determine our own level of risk with respect to data in cloud services
  • review used services in regard to security
  • be able to report as required, e.g. on the location of data and data processors
Restriction of access rights at high risk times of employment
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Personnel security
Changes in employment relationships
5
requirements

Examples of other requirements this task affects

9.2.6: Removal or adjustment of access rights
ISO 27001
5.18: Access rights
ISO 27001
CC6.2: Registering and authorizing new users before granting access
SOC 2
T-09: TYÖSUHTEEN AIKAISET MUUTOKSET TURVALLISUUSLUOKITELTUJEN TIETOJEN KÄSITTELYSSÄ
Katakri 2020
4.5: Käyttöoikeuksien hallinta
TiHL tietoturvavaatimukset
See all related requirements and other information from tasks own page.
Go to >
Restriction of access rights at high risk times of employment
1. Task description

If a person's employment is terminating or significantly changing, the reduction of access rights to assets should be considered, depending on the following:

  • a person’s reluctance towards the upcoming change
  • the extent of the person’s current access rights and responsibilities
  • the value of the assets to which the employee has access

Tasks included in the policy

Task name
Priority
Status
Theme
Policy
Other requirements
No items found.

Never duplicate effort. Do it once - improve compliance across frameworks.

Reach multi-framework compliance in the simplest possible way
Security frameworks tend to share the same core requirements - like risk management, backup, malware, personnel awareness or access management.
Cyberday maps all frameworks’ requirements into shared tasks - one single plan that improves all frameworks’ compliance.
Do it once - we automatically apply it to all current and future frameworks.
Get to know Cyberday
Start your free trial
Cyberday is your all-in-one solution for building a secure and compliant organization. Whether you're setting up a cyber security plan, evaluating policies, implementing tasks, or generating automated reports, Cyberday simplifies the entire process.
With AI-driven insights and a user-friendly interface, it's easier than ever to stay ahead of compliance requirements and focus on continuous improvement.
Clear framework compliance plans
Activate relevant frameworks and turn them into actionable policies tailored to your needs.
Credible reports to proof your compliance
Use guided tasks to ensure secure implementations and create professional reports with just a few clicks.
AI-powered improvement suggestions
Focus on the most impactful improvements in your compliance with help from Cyberday AI.