Access control is among the highest-tested domains in both SOC 2 (Common Criteria 6) and ISO 27001 (Annex A controls A.5.15–A.5.18, A.8.2–A.8.4). Auditors consistently find over-privileged accounts, stale user access, and missing access review evidence. This guide shows you what to build and what evidence to retain.

Core Principles

  • Least privilege: Grant the minimum access rights needed to perform a job function. Default to read-only; grant write/admin only with documented justification.
  • Need to know: Separate from least privilege — even if someone could technically access data, they should only access what they need for their current task.
  • Separation of duties: No single person should be able to initiate, approve, and complete a sensitive transaction. Relevant in financial controls and production deployments.

Role-Based Access Control (RBAC)

  • Define roles that map to job functions, not to individuals.
  • Document the access rights assigned to each role and the business justification.
  • Assign users to roles — never grant ad hoc permissions outside defined roles without a formal exception process.
  • Review role definitions at least annually or after organisational changes.

Joiner / Mover / Leaver (JML) Process

  • Joiners: Provision access via ITSM ticket or HR system integration. Require manager approval for elevated roles.
  • Movers: Trigger an access review when an employee changes role. Remove access no longer needed; do not simply add new access.
  • Leavers: Revoke all access within 24 hours of termination. Disable accounts before deletion. Retain logs for 12 months minimum.

Periodic Access Reviews

Access reviews are the single most common evidence request in SOC 2 audits. Auditors want to see:

  • A complete list of users with their current access rights exported from each system.
  • Manager or system owner sign-off (dated) confirming access is appropriate.
  • Evidence that inappropriate access identified during the review was removed promptly.
  • Review frequency: quarterly for privileged/admin accounts; semi-annually for standard users is generally acceptable for SOC 2.

Privileged Access Management (PAM)

  • Maintain a separate register of all privileged (admin/root) accounts.
  • Require MFA for all privileged access — no exceptions.
  • Use just-in-time (JIT) access for production systems where possible.
  • Log all privileged sessions and retain logs for 12 months.

Evidence Checklist for Auditors

  • Access provisioning tickets (or HRIS integration logs) for the audit period.
  • Dated access review reports with manager sign-off.
  • Termination/offboarding checklist showing timely account revocation.
  • MFA enforcement report from your identity provider.
  • Privileged account register and PAM session logs.