Skip to content
PolicyForge
← All posts
By Vyrhak SATH · Founder, NAGASHIELD SECURITY6 minReviewed

How to write an access control policy

What an access control policy must cover to pass an ISO 27001 or SOC 2 audit — least privilege, joiner-mover-leaver, access reviews — with a ready-to-use template.

Why access control is audited so closely

Access control is where most breaches begin and where most audit findings land. The policy proves you decide who gets access to what, on what basis, and how you remove it. It is the backbone of ISO 27001 Annex A and the SOC 2 logical access criteria.

What to include

  1. Principles — least privilege and need-to-know as the default posture.
  2. Access model — role-based access control (RBAC): access follows roles, not individuals.
  3. Joiner-mover-leaver — how access is granted on hire, changed on role change, and revoked on departure (ideally same-day).
  4. Authentication — links to your password and MFA requirements.
  5. Privileged access — stricter controls, separation of duties, and just-in-time elevation where possible.
  6. Access reviews — periodic recertification (e.g. quarterly for privileged, annually for standard), with evidence retained.
  7. Third-party and service accounts — ownership, expiry and review.

Common mistakes

  • No leaver process — orphaned accounts are an auditor magnet.
  • Access reviews with no evidence; if it isn't recorded, it didn't happen.
  • Confusing the policy (the rules) with the procedure (the steps). You usually need both.

Framework alignment

Maps to ISO 27001:2022 Annex A 5.15–5.18, the SOC 2 logical access criteria, and NIST CSF Protect (PR.AA).

Primary sources

  • ISO/IEC 27001:2022 — Annex A controls 5.15, 5.16, 5.18 (access control, identity, access rights) (iso.org/standard/27001).
  • NIST Cybersecurity Framework — Protect function, Identity Management & Access Control (nist.gov/cyberframework).
  • ANSSI — guide d'hygiène informatique (gestion des comptes et des accès) (ssi.gouv.fr).

Generate it in minutes

See a sample access control policy or generate yours free.

Frequently asked questions

What is the difference between an access control policy and a procedure?

The policy states the rules — least privilege, RBAC, who approves access. The procedure describes the steps to grant, change and revoke it. Auditors usually expect both: the policy to set intent, the procedure to show it is operated consistently.

How often should access reviews happen?

Tie frequency to risk: recertify privileged access roughly quarterly and standard access at least annually. The critical part is retaining evidence — a recorded reviewer, date and decision. If a review is not documented, an auditor treats it as if it never happened.

What is joiner-mover-leaver?

It is the lifecycle of access: granted on hire (joiner), adjusted on role change (mover), and revoked on departure (leaver), ideally same-day. Orphaned accounts from a missing leaver process are one of the most common audit findings in ISO 27001 and SOC 2.