ISO 27001 A.8.3: Information access restriction

Implement technical access controls across all information systems based on your access control policy and RBAC model. Consistency across platforms is what matters most here.

For applications: set up role-based access within each application, restrict access to specific functions and data based on user roles, enforce data-level restrictions (row-level and column-level security where needed), configure proper session management (timeouts, single-session restrictions), and hide functions the user is not permitted to use rather than just blocking them.

For databases: lock down direct database access to authorised administrators only. Use row-level security for multi-tenant databases. Prefer stored procedures and views over direct table access. Audit all database access, especially to sensitive tables. Encrypt sensitive columns at the database level.

For file systems and shared storage: set NTFS or equivalent permissions aligned with your access control matrix. Keep share permissions as tight as possible. Deploy DLP to prevent unauthorised copying. Run regular permission audits to catch access drift, and strip out inherited permissions that are too broad.

For cloud and SaaS: integrate SSO with your identity provider. Use conditional access policies to enforce context-based restrictions. Lock down data sharing and export within cloud platforms. Consider a CASB for visibility and control, and secure API access to prevent programmatic bypass.

Verify your access restrictions actually work. Use automated tools to scan for misconfigured permissions, overly broad grants, and orphaned accounts. Penetration testing should specifically check whether access controls can be bypassed. Fix findings quickly and track remediation to completion.