5.15 Access Control

Rules to control physical and logical access to information and other associated assets should be established and implemented based on business and information security requirements

To ensure the right people have access to the right resources whilst keeping away the wrong people from accessing sensitive information and assets by preventing their authorisation rights.

• Physical access to people in the premises,
• Determining the level of access to both physical and digital resources. This could be achieved by considering the clearance, need-to-use, and need-to-know principles,
• Segregation of duties,
• Management of access rights and logging.