In this blog post, we'll cover:
Before we get started, knowing the difference between access control and access control policy can help you implement access control effectively in your company.
Access control refers to ensuring that authorised users are able to access the required files or services while preventing access to non-authorised users.
An access control policy is a framework to implement access control in your company. It limits access to information and ensures only the right people who need the information are given access to it.
Access control is also a key component of ISO 27001 certification, the international standard for information security. A proper access control policy can help you successfully get the certification while staying compliant with data privacy laws like the UK GDPR.
Not every employee needs access to all company data, and an access control policy can help you define the levels of access for different people. Clearly, outlining an access control policy is crucial and has several benefits. Some of them are:
If you plan on getting ISO 27001 certified, implementing access control in line with ISO 27001 standard in your company is essential. So, what does ISO 27001 say about access control? Let’s find out.
The ISO 27001 standard (international standard for information security) has listed 14 different categories of controls (Annex A controls) to manage information within your company. Annex A.9 of the list deals with access control.
There are four categories of Annex A.9 controls:
The first Annex A.9 subset lets you know the requirements to set up an access control policy. Let’s see how you can do it and what your policy should cover.
What should your access control policy cover? Your access control policy should cover both technical and physical security measures to prevent unauthorised access to records.
When writing your access control policy, including the following areas of information is important to stay compliant with standards and laws such as ISO 27001 and the UK’s General Data Protection Regulation (GDPR), one of the most comprehensive laws around data protection in the UK and the EU:
Keeping track of everything you need to write your access control policy can be overwhelming. That’s why we’ve put together an initial access control policy template to help you get there.
Now that you know what an access control policy needs let’s see how you can set up one for your company.
There are six key steps you should take when creating an access control policy:
Access control policies fall under two categories:
Identifying why you are setting up your access control policy is the first step to setting up your information security.
Your access control policies are designed to protect sensitive information, and figuring out the type of data you collect can help you determine who should access it.
Some examples of protected information are:
Who needs access to what data? Taking a good look at their job responsibilities can help you determine this. Once you know who these people are, you can decide on a minimum level of access and put it in your access control policy.
After identifying the parties who need access, it's time to outline their roles. Every company has different needs, and you can use them to identify the tasks and responsibilities of who handles protected information.
Some examples of such roles are:
This is one of the most important steps in creating an access control policy. Sensitive information refers to information that should be protected from unauthorised access. There are three main types of sensitive information.
Clearly defining the standard for sensitive information can help you:
Laws such as UK GDPR and GDPR have strict clauses on access management and access control policy. Ensuring your company complies with all applicable laws and regulations can help you avoid data breaches, policy violations and heavy fines.
A typical access control policy should take the above requirements into account.
With the increasing cyber threats, access control is now more important than ever. With our information security solutions, you can gain control of your company’s data while staying legally compliant.
DataGuard’s solutions are suitable for your company because:
A good access control policy is a key requirement of many standards and frameworks, including ISO 27001. If you want to become ISO 27001 compliant, we can help you.