Auditing Access Control Under ISO 27001
Access control is spread across eight controls in two themes, and the commonest error in auditing it is not missing evidence but citing the wrong one. The rules live in A.5.15 to A.5.18; their technical enforcement lives in A.8.2 to A.8.5. Which side a finding belongs to depends on whether the rule is wrong or is not being followed.
Access control is spread across eight controls in two themes, and the commonest error in auditing it is not missing evidence but citing the wrong one. The rules live in A.5.15 to A.5.18; their technical enforcement lives in A.8.2 to A.8.5. Which side a finding belongs to depends on whether the rule is wrong or is not being followed.
The organisation in the worked finding on this page is invented, and so is the finding.
The eight ISO 27001 access control controls, and what each one owns
| Control | What it owns |
|---|---|
| A.5.15 Access control | Rules for physical and logical access, established and implemented on the basis of business and information security requirements. The policy layer |
| A.5.16 Identity management | The full life cycle of identities. Not permissions — the identity itself, from creation to removal |
| A.5.17 Authentication information | Allocation and management of authentication information, controlled by a management process, including advising personnel on handling it |
| A.5.18 Access rights | Provision, review, modification and removal of access rights, in accordance with the organisation’s topic-specific policy and rules on access control |
| A.8.2 Privileged access rights | The allocation and use of privileged access, restricted and managed |
| A.8.3 Information access restriction | Access to information and other associated assets, restricted in accordance with the established topic-specific policy on access control |
| A.8.4 Access to source code | Who may read and who may alter source code, along with the development tools and software libraries around it |
| A.8.5 Secure authentication | Authentication technologies and procedures, based on the information access restrictions and the topic-specific policy on access control |
Start at the Statement of Applicability. Each of the eight is a control the organisation selected at Clause 6.1.3, and what that document claims about each is your first criterion. On this subject in particular, an organisation that has marked all eight applicable and implemented has made eight separate claims, and they are rarely all true to the same degree.
The ISO 27001 access control distinction that decides most findings
If the rule is wrong, missing or was never decided, you are in A.5. If the rule is sound and the technology does not enforce it, you are in A.8.
That single test resolves most of the difficulty, and it has a consequence worth stating: you cannot audit the A.8 controls at all until you know what the rules are, because there is nothing to measure a configuration against. An auditor who looks at an access list before reading the access control rules is looking at a fact with no criterion, and can only form an opinion about it.
A second distinction is less obvious. A.5.16 covers the life cycle of identities; A.5.18 covers the provision, review, modification and removal of the access rights attached to them. The two overlap, and the same evidence can support findings at both — access that should have been removed engages A.5.18’s removal limb, and engages A.5.16 as well where the identity itself was never closed. What is not defensible is treating them as interchangeable, because the arrangements behind them are usually run by different people.
Looking for an approved provider?3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP 6039853.
ISO 27001 Annex A.5.17, which almost nobody audits
Of the eight, authentication information is the one most often skipped, partly because its subject is easy to mistake for A.8.5’s. The difference is worth having straight.
A.8.5 is about the technology and the procedures — what mechanism authenticates, and how strongly.
A.5.17 is about the authentication information itself — how it is allocated, how that allocation is managed, and what personnel are told about handling it.
So the questions it raises are ones an audit rarely reaches. How does a new starter receive their first credential, and by what route? What happens when one is reset, and who can trigger that? What is a user told about the information they hold, and where is that written? An organisation with strong authentication technology and a habit of emailing initial passwords has a sound A.8.5 and a weak A.5.17, and only one of those is a defensible finding.
The audit trail for ISO 27001 access control
Read the rules first. The topic-specific policy on access control, and whatever sits under it. These become your criteria, and everything after this is measured against them rather than against your experience.
Then take the allocation route. How does a person first come to hold authentication information here, by what channel, and what is done to manage it afterwards? That is A.5.17, and it is the limb of this area that leaves the least behind it, because nothing forces a record of how a credential travelled.
Then ask what personnel are told. The control’s second limb is advising personnel on the appropriate handling of authentication information, and the evidence for it is a document plus somebody who can say what it asks of them.
And read A.8.5 against A.5.15. The authentication technologies and procedures in use are to be based on the information access restrictions and the topic-specific policy on access control — so the question is not whether the mechanism is strong, but what determined it.
Preparing for the PR373 exam?Full-length mock exams and exam application support are included.
A worked ISO 27001 finding on Annex A.5.17
Cranmore Housing operates a tenancy and repairs system with multi-factor authentication on all remote access, and a documented access control policy reviewed within the year.
| Statement | Authentication information is not allocated and managed through a controlled process, and personnel are not advised on its appropriate handling. |
|---|---|
| Objective evidence | The access control policy states that initial credentials are issued through the service management system and must be changed at first use. Twenty account creations from the period were examined. In fourteen, the service management record shows the credential issued through the system as the policy describes. In six, the record shows the request closed with the note “details passed to manager”; the service desk lead confirmed that in those cases the initial credential is telephoned or emailed to the line manager, who passes it on, and that this is the routine arrangement when a starter has no organisation account to receive it in. No forced change at first use is configured on the tenancy system; of the six, three accounts still carry their initial credential according to the system’s own password age report. No guidance to personnel on handling authentication information was produced, and neither the policy nor the induction material addresses it; four staff asked in different teams could not say what they were expected to do if they believed a credential had been seen by someone else. |
| Requirement | ISO/IEC 27001 Annex A.5.17 requires allocation and management of authentication information to be controlled by a management process, including advising personnel on the appropriate handling of authentication information. The organisation’s access control policy, section 5, requires initial credentials to be issued through the service management system and changed at first use. |
| Grade | Major — both limbs of the control fail. The advice limb is absent entirely, in every document and in what anyone could say. On the allocation and management limb, the defined route is bypassed as a matter of routine for a whole category of starter, and the first-use change the process relies on is enforced nowhere on the system concerned — so the fourteen requests that did follow the route are no better managed than the six that did not. |
Note how the limbs support each other in the grade. Six of twenty is a proportion an auditee will want to characterise as exceptional, and missing guidance on its own is thin. What removes both arguments is the first-use setting: because it is absent on the system rather than on six accounts, the management half of the control fails for everybody, and the password age report supplies the consequence without the finding having to assert it.
One discipline in writing any of these. Record what you were told as fact where it establishes how far the failure reaches; keep your own diagnosis of why it happened out. The service desk lead’s account that this is the routine arrangement is recorded because it establishes reach. The finding does not go on to say the process was designed without thinking about starters.
Want structured preparation?One year of LMS access and HD recordings come with the course.
Where ISO 27001 access control evidence lives
Two rows below are deliberately blank. A.5.16 and A.5.18 are the controls this subject is most often examined on, and setting out how to test them is the work of a course rather than of a public page. What each requires is stated; how to go and find it is taught, with a case study, where a tutor can see whether you have understood it.
| Control | Ask for | What it has to show |
|---|---|---|
| A.5.15 | The access control rules and what they are based on | Rules established on business and information security requirements, not inherited |
| A.5.16 | — | The full life cycle of identities. Description only on this page; see the note below |
| A.5.17 | How a first credential is issued, and what users are told | A controlled allocation process, and advice that reaches people |
| A.5.18 | — | Provision, review, modification and removal of access rights, in accordance with the organisation’s topic-specific policy. Description only on this page; see the note below |
| A.8.2 | Who holds privileged access, and on what basis and for how long | Restriction and management, not a list |
| A.8.3 | What a named ordinary user can actually reach | Restriction in accordance with the policy, tested against a real account |
| A.8.4 | Who may read and who may alter source code, and how that is decided | Read and write access governed, along with the development tools and libraries around it |
| A.8.5 | The authentication mechanisms in use and what determined them | Technologies and procedures chosen against the access restrictions and the policy |
Major or minor in an ISO 27001 access control finding
Major territory: no rules for access at all, or rules that were never applied to a system in scope; authentication information allocated with no controlled process behind it anywhere; authentication technologies chosen against nothing the organisation has written down.
Minor territory: one system where the rules are applied inconsistently; guidance on handling authentication information that exists but reaches one group and not another; a documented mechanism with a traceable exception.
Escalation: several access findings that all trace back to nobody checking is a case about the checking, and often belongs at A.5.36 or in Clause 9 rather than as four separate access findings.
And the criteria are the standard, the organisation’s own rules and its legal and contractual obligations — not your view of good practice. That bites harder here than anywhere else in the annex, because most auditors have opinions about access control and the standard has almost none.
ISO 27001 access control: which control owns what?
Pick a control to see what it owns.
How to use it: Choose the option that fits you from the list. The answer appears below.
From the table in this article. Several controls sound alike: the distinction between them is what decides most findings.
Frequently asked questions about auditing access control under ISO 27001
Which ISO 27001 controls cover access control?
Eight. A.5.15 access control rules, A.5.16 identity management, A.5.17 authentication information and A.5.18 access rights set the requirements; A.8.2 privileged access, A.8.3 information access restriction, A.8.4 access to source code and A.8.5 secure authentication cover the technical side.
What is the difference between ISO 27001 Annex A.5.16 and A.5.18?
A.5.16 covers the full life cycle of identities. A.5.18 covers the access rights attached to them: provision, review, modification and removal, in accordance with the organisation’s topic-specific policy on access control. They overlap, and one set of facts can engage both.
Is a finding about a firewall rule an ISO 27001 access control finding?
More often it is a network one. A.8.20 covers networks and network devices and A.8.22 covers segregation; the access controls are about who may reach information and assets. Read what the evidence is about rather than where you found it.
Do I need to see the technology to audit ISO 27001 access control?
You need to see something operating on a real record. That is not a technical assessment: you are asking the organisation to demonstrate that what its rules say happens, happens. Demonstrating it is the auditee’s job.
Which ISO 27001 control covers how passwords are issued?
A.5.17, authentication information — its allocation and management, and advising personnel on handling it. The strength of the mechanism authenticating with it is A.8.5. The two are commonly merged, and only one of them is about issue.
The other ISO 27001 control areas
auditing backup and recoverability
auditing supplier and third-party security
For the controls behind these areas, the four Annex A theme pages set out what each group requires: the A.5 organizational controls, the A.6 people controls, the A.7 physical controls, the A.8 technological controls.
3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.
Booking a PR373 course? See the schedule, trainers and what’s included.
Leave a reply