3.3 Organizational Controls: Access Control & Identity Management (A.5.15–A.5.18)

3.3 Organizational Controls: Access Control & Identity Management (A.5.15–A.5.18)

Access control and identity management constitute the logical security perimeter of modern digital enterprises. Controls A.5.15 through A.5.18 establish how digital identities are established, authenticated, authorized, monitored, and reviewed throughout their lifecycle to prevent unauthorized access to organizational assets.

---

Overview of Access & Identity Controls (A.5.15 – A.5.18)

---

Access Control Policy Principles (A.5.15)

Control A.5.15 mandates that top management approve a comprehensive Access Control Policy aligned with business objectives and risk assessments. The policy must strictly enforce two foundational security tenets:

1. Need-to-Know: Personnel are granted access only to the specific information assets and systems required to perform their assigned business duties.
2. Least Privilege: Users are granted the minimum level of permission (e.g., read-only vs. read/write/execute) necessary to execute their authorized job functions.

Access Control Architectural Models

• Role-Based Access Control (RBAC): Access permissions are grouped into structured organizational roles (e.g., Payroll Specialist, Network Admin). Users are assigned roles, simplifying permission management and preventing ad-hoc permission drift.
• Attribute-Based Access Control (ABAC): Access decisions dynamically evaluate user attributes (department, clear level), resource attributes (classification tag), and environmental context (device health, IP location, time of day).
• Zero Trust Network Access (ZTNA): Applies continuous authentication and contextual authorization under the principle of "never trust, always verify," replacing traditional perimeter-based network access.

---

Identity Management Lifecycle (A.5.16)

Control A.5.16 requires that every user operating within the ISMS scope be assigned a unique identifier (User ID). Shared or generic accounts (e.g., admin, support_team) are strictly prohibited because they destroy audit accountability. Where shared system accounts cannot be avoided due to legacy architecture, compensating controls—such as Privileged Access Management (PAM) vaulting with single-user checkout logging—must be implemented.

+-------------------------------------------------------------------------+
| IDENTITY LIFECYCLE MANAGEMENT (A.5.16 & A.5.18)                         |
+-------------------------------------------------------------------------+
  1. Provisioning   --> Identity created automatically upon HR onboarding trigger.
  2. Authentication --> Credentials verified via MFA / SAML 2.0 / FIDO2 (A.5.17).
  3. Modification   --> Job transfer triggers immediate access right adjustment.
  4. Recertification--> Asset Owners perform periodic access reviews (A.5.18).
  5. Revocation     --> HR offboarding triggers instant logical account disablement.

Emergency / Break-Glass Accounts

For catastrophic system outages where identity providers (IdPs) are unreachable, pre-configured Break-Glass Emergency Accounts are maintained. Break-glass credentials must be stored in secure dual-custody physical or digital vaults, trigger immediate high-priority SOC alarms upon use, and require 100% video session recording.

---

Authentication Information Management (A.5.17)

Control A.5.17 governs the issuance, management, and protection of authentication credentials (passwords, PINs, cryptographic keys, biometric templates, hardware tokens):

• Multi-Factor Authentication (MFA): Mandatory for all remote access (VPN/ZTNA), cloud admin consoles, and applications handling confidential data. Phishing-resistant MFA (such as FIDO2 / WebAuthn hardware security keys) is strongly preferred over SMS-based OTPs or push notifications vulnerable to MFA fatigue attacks.
• Passphrase & Credential Policies: ISO 27001:2022 guidelines emphasize long passphrases (16+ characters) and automated checking against compromised credential databases (e.g., HaveIBeenPwned API) over arbitrary monthly forced password expirations.
• Cryptographic Storage: Passwords stored in databases must be hashed using salted, computationally intensive algorithms such as Argon2id, bcrypt, or PBKDF2 with high iteration counts.

---

Management of Access Rights & Privileged Access (A.5.18)

Control A.5.18 dictates that the allocation, modification, and revocation of access rights must follow a formal authorization workflow. Uncontrolled allocation causes Privilege Creep—where personnel accumulate access permissions as they move across departments.

Privileged Access Management (PAM)

Privileged access rights (e.g., root, domain admin, global tenant admin) pose extreme risk. Control A.5.18 mandates:

• Account Separation: Standard daily work (email, web browsing) must be strictly segregated from administrative accounts.
• Just-In-Time (JIT) Elevation: Administrative privileges are granted dynamically for approved change windows and automatically revoked upon task completion.
• Session Recording & Monitoring: Full auditing and real-time monitoring of all privileged sessions.

Periodic Access Recertification

Asset Owners and Managers must perform periodic access reviews (e.g., quarterly for privileged accounts, semi-annually for standard accounts). Unused or unnecessary permissions identified during recertification must be promptly revoked.

---

Real-World Implementation Scenario:
A financial services company deploys an Identity Governance and Administration (IGA) platform integrated with HR software. When a Financial Analyst transfers to the Marketing team, HR updates the employee role. The IGA system automatically executes Control A.5.18: revoking financial ledger access while provisioning Marketing analytics permissions based on RBAC (A.5.15). Multi-Factor Authentication via FIDO2 hardware keys (A.5.17) is enforced for all system logins.