Nika Created: Jan 12, 2021 Last commented: Jan 13, 2021

A.9.2.5 Review of user access rights

Hello Advisera Team,

a question to this control: A.9.2.5 Review of user access rights.

What we need and what we have now there is that user access rights are reviewed when there is a change in employees status (e.g. department or position is changed).

Is it enough or is periodical review meint here?

Thank you!

0 0

Assign topic to the user

Select user

Expert

Rhand Leal Jan 13, 2021

Please note that control A.9.2.5 of ISO 27001 Annex A states that review shall be performed at regular intervals.

Considering that, reviewing access rights only when there is a change in employees’ statuses is not enough to be compliant with this control, and you must define a periodicity for review.

This article will provide you a further explanation about access control:

How to handle access control according to ISO 27001 https://advisera.com/27001academy/blog/2015/07/27/how-to-handle-access-control-according-to-iso-27001/

These materials will also help you regarding access control:

ISO 27001 Annex A Controls in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/
ISO 27001 Free online training ISO 27001 Foundations Course https://training.advisera.com/course/iso-27001-foundations-course/

Quote

0 1

Comment as guest or Sign in

HTML tags are not allowed

Name *

Email *

I accept the Privacy and Terms

Notify me when someone replies

Jan 12, 2021

Jan 13, 2021

Expert Advice Community