Back to all 93 controls
Annex A 5.15
Organizational
A.5.15 Access control
Access is controlled by policy and business need.
What good looks like
Access control policy, role-based access, least privilege, documented requests.
Evidence an auditor will ask for
Access control policy, role matrix, sample access tickets.
Document template for this control
The Access Control Policy template gives you auditor-ready wording that fulfils Annex A 5.15. Preview the full document before you download the editable version.