Where Access Control Policies Fit in ISO 27001 and Cyber Essentials

An access control policy sets out who can reach your systems and data, how access is requested, approved, changed and removed, and how users prove their identity. Both ISO 27001 and Cyber Essentials expect this ground to be covered, but they carve it up in very different ways.

ISO/IEC 27001:2022 addresses access control through Annex A, chiefly controls A.5.15 to A.5.18 in the organisational theme and A.8.2 to A.8.5 in the technological theme. Cyber Essentials makes user access control one of its five technical controls, assessed through a pass or fail questionnaire.

The Cyber Essentials side tightened in 2026. Version 3.3 of the NCSC's Cyber Essentials: Requirements for IT Infrastructure applies to assessment accounts created from 27 April 2026, and IASME has confirmed that a cloud service left without multi-factor authentication, where MFA is available, now fails the whole assessment automatically.

This guide maps what an access control policy governs against the specific requirements of each framework, so you can see which controls one well-drafted document satisfies and where the two frameworks pull in different directions.

Access Control Requirements at a Glance

The table below matches the main areas an access control policy covers to the relevant ISO/IEC 27001:2022 Annex A controls and the Cyber Essentials v3.3 user access control requirements.

What an Access Control Policy Governs

An access control policy is the document that turns the principle of least privilege into working rules. It states that every user receives the minimum access needed for their role, and it defines the procedures that keep that statement true as people join, move and leave.

In practice the policy and its supporting procedures cover:

• The user access lifecycle: how accounts are requested, approved, provisioned, amended and removed, usually documented as a joiner, mover, leaver (JML) process
• Privileged and administrator accounts: who holds them, how they are approved, and the rule that admin accounts are never used for day-to-day work
• Multi-factor authentication: which systems require a second factor and which methods are acceptable
• Password standards: minimum lengths, deny lists, secure storage and what happens after a suspected compromise
• Access review cycles: who reviews access rights, how often, and how each review is recorded
• Third-party and remote access: accounts held by IT support providers, contractors and suppliers, and the conditions attached to remote connections

The policy also names owners. Someone must be accountable for approving access, someone for removing it, and someone for checking that both happened. Auditors and assessors look for those names before they look at anything technical.

How ISO 27001:2022 Handles Access Control

ISO/IEC 27001:2022 contains 93 reference controls in Annex A, arranged in four themes: 37 organisational, 8 people, 14 physical and 34 technological. Access control does not sit in a single clause. It runs through the organisational and technological themes.

Four organisational controls carry most of the weight:

• A.5.15 Access control requires rules for physical and logical access, established from business and information security requirements. This is the control your access control policy directly evidences.
• A.5.16 Identity management covers the full lifecycle of identities, which in practice means a documented joiner, mover, leaver process.
• A.5.17 Authentication information governs how passwords and other authentication details are allocated, stored and changed.
• A.5.18 Access rights requires access to be provisioned, reviewed, adjusted and removed in line with the policy.

The standard does not fix a review frequency, so your policy has to. In practice, quarterly reviews for privileged and sensitive system access, annual reviews for standard access, and a review on every role change are the cadences auditors accept without question.

The technological controls behind the policy

The technological theme adds the enforcement detail. A.8.2 restricts and manages privileged access rights, A.8.3 restricts access to information in line with the policy, and A.8.5 requires secure authentication technologies, which is where MFA sits.

Two further controls apply in specific circumstances. A.8.4 governs access to source code, and A.8.18 restricts the use of privileged utility programs, both relevant if you develop software or run your own infrastructure.

The Statement of Applicability decides what applies

Annex A controls are not automatically mandatory. You apply them through your risk assessment and justify inclusion or exclusion in the Statement of Applicability. Few organisations could credibly exclude A.5.15 to A.5.18, so certification auditors treat a documented access control policy as a standing expectation.

The clause-level documents the standard itself demands are a separate list, set out in our ISO 27001 mandatory documents guide. For access control the audit test is evidence of operation: JML records, access review sign-offs and a privileged account register, not the policy text alone.

What Cyber Essentials Requires for User Access Control

Cyber Essentials is the UK government-backed certification administered by IASME on behalf of the NCSC. User access control is one of its five technical controls, and it applies to servers, desktop computers, laptops, tablets, mobile phones and IaaS, PaaS and SaaS services.

Under Requirements for IT Infrastructure v3.3, in force for assessment accounts created from 27 April 2026, your organisation must:

• have a process in place to create and approve user accounts
• authenticate users with unique credentials before granting access to applications or devices
• remove or disable user accounts when they are no longer required, for example when a user leaves or after a defined period of inactivity
• implement MFA where available, and always use MFA for authentication to cloud services
• use separate accounts for administrative activities only, with no emailing or web browsing that could expose admin privileges
• remove or disable special access privileges when no longer required, for example when a member of staff changes role

Version 3.3 also gives cloud services a formal definition and states that they cannot be excluded from scope. If your data or services are hosted in cloud services, the user access control requirements follow them there.

Passwords, MFA and brute-force protection

Where a password forms part of your MFA approach, it must be at least 8 characters long with no maximum length. Acceptable second factors are a managed or enterprise device, an app on a trusted device, a physically separate token, or a known or trusted account.

Password-only accounts need two layers of protection. Brute-force guessing must be blocked by MFA, by throttling attempts to no more than 10 guesses in 5 minutes, or by locking the account after no more than 10 unsuccessful attempts. Password quality must be managed through MFA, a 12 character minimum, or an 8 character minimum combined with automatic blocking of common passwords using a deny list.

Two older habits are explicitly ruled out. The NCSC tells organisations not to enforce regular password expiry and not to enforce complexity requirements, and instead expects a process for changing passwords promptly when a compromise is known or suspected. An access control policy that still mandates 90-day resets contradicts the standard it claims to support.

For the wider scheme, including the other four controls, costs and Cyber Essentials Plus, see our IASME Cyber Essentials checklist.

One Policy, Two Frameworks

The frameworks assess differently. Cyber Essentials is a fixed baseline, self-assessed annually against pass or fail questions. ISO 27001 is a risk-based management system, audited on evidence that the policy actually operates.

Scope also differs. Cyber Essentials covers your whole IT estate by default, including home workers, bring-your-own devices that access organisational data, and every cloud service the business uses. An ISO 27001 certificate only covers whatever scope you define for the management system, which is one reason buyers often ask for both.

The practical answer is to write one policy to the stricter of the two rules on each point. Where Cyber Essentials is absolute, follow it: MFA on every cloud service, brute-force limits, no forced password expiry. Where ISO 27001 asks for more, add it: named owners, defined review cycles and the records that prove they ran.

A policy written only to pass Cyber Essentials tends to fail an ISO 27001 audit, because it defines no review cadence and produces no records. A generic ISO 27001 policy can equally fail Cyber Essentials if it permits password-only access to a cloud service. Drafting against both sets of requirements at once avoids maintaining two conflicting documents.

Common Failure Points

• Leaver accounts left active. Delayed removals are the access control finding we see most often. Same-day or next-business-day disabling is the defensible position.
• Shared administrator accounts, which remove individual accountability and undermine the unique credentials required by both frameworks.
• Admin accounts used for email and browsing, a direct breach of the Cyber Essentials separation requirement.
• One forgotten cloud service without MFA. Under the 2026 marking scheme, a single eligible account can fail the whole assessment.
• Access reviews performed but not recorded. To an ISO 27001 auditor, an unrecorded review did not happen.
• Third-party and support accounts missing from the policy, even though both frameworks place them squarely in scope.

Enforcement and Commercial Risk

The sharpest edge is commercial. Cyber Essentials has been a condition of certain UK government contracts involving sensitive or personal information since 2014, and many prime contractors and insurers now demand it from their supply chains. A failed renewal on an MFA question interrupts that eligibility until the gap is fixed and reassessed.

For ISO 27001, weak access control usually surfaces as audit nonconformities, and unresolved major nonconformities can delay or jeopardise certification. Certification bodies routinely sample leaver records and access review evidence, so gaps between the policy and reality are found quickly.

Access control is also a legal matter. Article 32 of the UK GDPR requires technical and organisational measures appropriate to the risk, and the ICO can fine up to 17.5 million pounds or 4 per cent of annual worldwide turnover. Unauthorised access through an orphaned account is exactly the kind of failure a documented, operated policy prevents.

Access Control Policy and Procedure Writers

Policy Pros writes access control documentation that satisfies both frameworks in a single suite. Our access control policy writing service delivers the main policy plus the procedures assessors ask about: a joiner, mover, leaver procedure, a privileged access procedure, an MFA implementation procedure, an access review schedule and a break-glass account procedure.

Each document is mapped to the ISO/IEC 27001:2022 Annex A controls and the current Cyber Essentials requirements, so the same pack supports your Statement of Applicability and your next Cyber Essentials renewal. If you need the wider framework around it, our IT security policies service covers the full suite, from acceptable use to incident response.

Contact Policy Pros for a fixed, no-obligation quote for your access control policy and supporting procedures.