Back to all 93 controls
Annex A 5.18
Organizational
A.5.18 Access rights
Access rights match current job needs.
What good looks like
Periodic access reviews and removal of unused privileges; privileged access reviewed more often.
Evidence an auditor will ask for
Access review records, leaver removal SLA, privileged account list.
Document template for this control
The Access Control Policy template gives you auditor-ready wording that fulfils Annex A 5.18. Preview the full document before you download the editable version.