Habit 07 of 18
People
Access given and removed on time
New staff get only the access they need. Leavers lose it on their last day.
Former staff with live accounts are a common way in. Giving too much access to new staff is the other half of the same problem.
Switch it on in the map Counts towards 7 articles, controls and categories
§1 How to do it
How a small firm does it
- Use a short checklist for joiners: which accounts they get, and why.
- Use a short checklist for leavers: remove all access on their last day, and collect devices.
- Review who has access to what twice a year.
- Keep admin accounts to the few people who need them.
Evidence that shows it
- The joiner and leaver checklists, filled in
- The record of your last access review
Ireland: NCSC Ireland guidance on access control applies here. Irish NIS2 law is still pending.
§2 What it counts towards
What it counts towards
Most links are “supports”: doing this helps you show you meet the reference, without matching it exactly. None of them means “compliant”.
EU NIS2 Directive 1 item
-
21(2)(i) People security, access control and assets · supports
human resources security, access control policies and asset management
Human resources security and access control are named in this measure.
Read Art 21(2)(i) on EUR-Lex
ISO/IEC 27001:2022 4 items
-
A.5.15 Access control rules · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
Giving people only the access they need applies access control rules.
About ISO/IEC 27001:2022 on ISO -
A.5.18 Giving and removing access rights · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
The control is about giving, reviewing and removing access rights.
About ISO/IEC 27001:2022 on ISO -
A.6.1 Background checks for staff · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
This control is about background checks before someone joins. Your joiner process is where those checks would sit, but giving access on time does not meet it by itself. This is a weaker link.
About ISO/IEC 27001:2022 on ISO -
A.6.5 Security duties after someone leaves · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
Removing access on the last day is part of making security duties continue after someone leaves.
About ISO/IEC 27001:2022 on ISO
NIST Cybersecurity Framework 2.0 2 items
-
GV.RR Roles and responsibilities · supports
GV.RR-04: Cybersecurity is included in human resources practices
Building access changes into hiring and leaving is a way of including security in HR practices.
Read GV.RR-04 on NIST -
PR.AA Identity and access · supports
PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization
PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
Giving people only the access they need, and removing it when they leave, is managing access permissions with least privilege.
Read PR.AA-01, PR.AA-05 on NIST
§3 Questions it answers
Indicative mapping, written by hand from public sources. Not legal advice and not a compliance test. Check anything important against the official texts.