Key takeaways
- Restrict access to information in line with your access control policy.
- Applications and data should only show each user what they need.
- Start here: configure access within applications based on roles.
Purpose
Restrict access to information in line with your access control policy.
Requirement
Requirement summaryAccess to information and other associated assets shall be restricted in accordance with the established topic-specific policy on access control.
Why it matters
Applications and data should only show each user what they need.
How to implement
- Configure access within applications based on roles.
- Restrict access to sensitive data sets and fields.
- Use access groups rather than individual grants.
- Review application access periodically.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.3. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your access control policy explaining how access to information is restricted.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.3 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Permission settings for sensitive folders and systems matching approved access.
- Sharing settings showing public or external sharing is controlled.
- Records of approvals for external sharing.
Things you should be able to show or explain
- Be able to show access restrictions on a sensitive folder or system.
How much to show: Three to five sensitive locations.
Common mistakes
- Sensitive folders open to everyone.
- Uncontrolled external sharing.
- Shared drives open to all staff.
- Test environments with full production data access.
- Tip: Default-deny on shared drives and SaaS apps.
Policies & documents to have
- Access Control Policy
FAQ
Is A.8.3 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.3?
Be ready to explain how the control works in your organisation and to provide things like: Your access control policy explaining how access to information is restricted…