Information access restriction

What the requirement asks

The organization is to limit who can reach information and associated assets, following its established access control policy. Purpose: permit authorized access and block unauthorized access to information and associated assets. Guidance: to support restriction, consider not allowing unknown or anonymous identities to reach sensitive information, granting public or anonymous access only to locations holding nothing sensitive; configuration settings that govern who reaches what inside systems, applications and services; control over which data each user can reach; control over which identities or groups hold which permissions, for example reading, writing, deleting or executing; and physical or logical isolation of sensitive applications, their data or systems. Consider dynamic access management for high-value sensitive information where the organization needs fine-grained control over who accesses it, when and how; wants to share it externally while keeping control; wants to manage its use and distribution in real time; wants to prevent unapproved alteration, copying, forwarding or printing; wants to monitor its use; or wants a record of changes for possible investigation. Such techniques should protect information throughout creation, processing, storage, transmission and disposal, with rules per use case that grant permissions by identity, device, location or application and use the classification scheme to decide what needs this protection, backed by operating, monitoring and reporting processes and technical infrastructure. Dynamic access systems protect information by requiring authentication, credentials or a certificate; limiting access to a time window; encrypting it; setting print permissions; recording who uses it and how; and alerting on attempted misuse. Other information: these techniques can protect documents, emails and files even after they leave the organization, where ordinary controls cannot reach, adapting over the life cycle; they supplement rather than replace classic controls such as access control lists by adding conditions, real-time evaluation and just-in-time data reduction; permissions can be changed or withdrawn at any time, which aids incident response; ISO/IEC 29146 provides a framework. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Information access restriction follows classification and need to know. The guidance asks for the rule, the enforcement point and the test.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep system, application and cloud storage configurations restricting access by identity or group, with granular permissions per action and one live sample together.

Evidence an assessor asks for

• Access restrictionSystem, application and cloud storage configurations restricting access by identity or group, with granular permissions per action
• Access restrictionEvidence that anonymous or public access is limited to locations holding no sensitive information, for example storage bucket access reviews
• Access restrictionIsolation of sensitive applications, data or systems through physical or logical segmentation
• Access restrictionRules and configuration for dynamic access management or rights management on high-value information (identity, device, location, time limits, printing, encryption)
• Access restrictionUsage logs and misuse alerts from dynamic access or rights management tooling
• Access restrictionMap of classification levels to the access restriction techniques applied

The question an assessor will ask

An assessor will ask for system, application and cloud storage configurations restricting access by identity or group, with granular permissions per action, then trace it to the system it protects. For A.8.3 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Cloud storage or file shares allow anonymous access to sensitive data
• Permissions are granted to broad groups such as all staff
• Sensitive documents shared externally cannot be revoked or tracked
• Delete and execute permissions are granted where only read is needed

Before the next audit

Before the next audit, check one live sample for this gap: cloud storage or file shares allow anonymous access to sensitive data.