Key takeaways
- Grant, review, change and remove access rights in a controlled way.
- Access must follow people through joining, moving and leaving.
- Start here: provision access from an approved request tied to a role.
Purpose
Grant, review, change and remove access rights in a controlled way.
Requirement
Requirement summaryAccess rights to information and other associated assets shall be provisioned, reviewed, modified and removed in accordance with the organization’s topic-specific policy on and rules for access control.
Why it matters
Access must follow people through joining, moving and leaving. Stale access is a favourite audit finding.
How to implement
- Provision access from an approved request tied to a role.
- Adjust access when someone changes role, removing what they no longer need.
- Revoke access promptly on exit, ideally same day.
- Run periodic access reviews with system owners and record the results.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.18. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your process for giving, changing, reviewing and removing access.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.18 marked as used or not used, a short reason, and its current status.
Records and examples to show
- A list of everyone who has left in the last 12 months and proof their access was removed on time.
- A list of new starters and proof their access was approved and matched their role.
- Records of your regular access reviews (who checked what, and what was changed).
- Examples of people who changed role, showing old access was removed.
Things you should be able to show or explain
- Be able to explain how managers check access during reviews.
How much to show: A handful of joiners, leavers and movers, plus your last two reviews for key systems.
Common mistakes
- Leavers' accounts still active.
- Access reviews started but never finished.
- Movers who accumulate access from every previous role.
- Access reviews signed off without actually checking.
- Tip: Run quarterly access reviews and keep the evidence.
Policies & documents to have
- Access Control Policy
FAQ
Is A.5.18 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.18?
Be ready to explain how the control works in your organisation and to provide things like: Your process for giving, changing, reviewing and removing access…