ISO 27001: Who Has Access to Your Business Data and Do They Still Need It?

A member of staff leaves. Their laptop comes back, the handover is finished and everyone moves on.

But their account is still active in a system the business uses.

Elsewhere, a supplier can still open a shared folder months after a project ended. An employee who changed roles can still see files from their previous department.

None of that access is needed any more. Nobody has noticed.

This is how a small gap can remain hidden during an otherwise ordinary working week.

People need access to do their jobs. It gets added when they join, take on a project or cover someone’s absence. Removing it can receive less attention because the work has already moved on.

Over time, permissions build up.

The risk includes information being seen by the wrong person, changed by mistake or shared beyond the intended group. If something goes wrong, you may spend hours working out who could access the information and what happened.

An account being familiar does not tell you whether its access is still appropriate.

The useful question is whether you can explain who has access, what they can do and why they still need it.

ISO 27001 access control helps bring those decisions into a clear, managed approach.

Understand what access control means

Access control means deciding who can use information or systems and what they are allowed to do.

That might involve viewing a file, changing a record, downloading information, sharing it or managing the system itself.

Those are different levels of responsibility.

Someone who needs to read a report may not need permission to change the figures. Someone who updates customer contact details may not need to export the whole customer database.

ISO/IEC 27001, commonly shortened to ISO 27001, sets requirements for managing information security risks. It covers keeping information confidential, protecting it from unwanted changes and making it available when needed. Its approach includes people, processes and technology.

The standard uses risk assessment to determine necessary safeguards. Annex A provides a list to compare against. The Statement of Applicability records the controls selected and explains relevant inclusions or exclusions. These decisions need to fit the risks and requirements of your business.

ISO/IEC 27002 provides supporting guidance on information security controls, including access control.

In practical terms, your business needs a clear reason for giving access, a way to keep it appropriate and a process for changing or removing it.

Recognise how access builds up

Excess access is often the result of ordinary business decisions.

A colleague needs urgent help, so someone gives them access to a folder. A manager asks for temporary cover, so additional permissions are added. A new employee receives the same access as someone already in the team.

Each decision may seem reasonable at the time.

The problem arises when nobody checks whether that access remains suitable.

Imagine an employee who begins in accounts, later helps with purchasing and then moves into sales.

Their access may reflect all three roles, even though their current work needs only some of it.

They could still open payment records or change supplier details without anyone intending that arrangement.

The employee does not have to misuse the access for it to matter. An accidental change, a mistaken download or someone gaining control of their account could affect a wider range of information.

Look for a pattern of permissions being added without older ones being reviewed.

That pattern can exist in a small business with a handful of systems as easily as in a larger organisation.

Find out where access exists

Start with the information and systems your business depends on.

Think about customer records, staff information, finance files, project folders and the online services people use every day.

Include places where information is shared with others.

A useful starting record can show the system or information area, who is responsible for it, who has access and what that access allows.

Use the tools already available in your systems to check the current position. A spreadsheet of approved names may differ from the permissions actually in place.

Consider different routes to the same information.

A person may have direct access to a file, access through a group or access through a shared link. Removing one route may leave another available.

Ask people about services used for particular tasks. A project tool or online file store may have its own accounts and access arrangements.

Also include software connections. An application that copies information between systems may have access without a person signing in each day.

Assign a responsible person to those connections so someone can explain their purpose and review them.

Information security also covers paper records and other forms of information. Apply the same question to a staff file in a cabinet or documents left in a shared workspace: who needs access, and how is that controlled?

Build a picture of access as it works today.

Give access for the work required

A helpful principle is to give people the access needed for their work.

This is often called “least privilege”. NCSC guidance describes maintaining permissions at the level necessary for each purpose and removing permissions that are no longer needed.

The aim is to support useful work while limiting unnecessary access.

For example, a project coordinator may need to update schedules and view approved customer details. That does not automatically create a need to see staff pay records.

Decide what a role needs before copying another person’s permissions.

The existing employee may have extra access because of past duties, specialist tasks or temporary cover. Copying everything can pass those extras to the new starter.

Make access requests specific.

A request such as “please give Sam access” leaves too much open to interpretation. A clearer request identifies the system, the work involved, the level of permission and any time limit.

Have the right person approve the business need.

The person managing a finance process, for instance, may be better placed than an IT technician to judge whether someone needs to change payment information. IT can then apply the approved arrangement.

Make temporary access temporary in practice.

If someone covers an absence, record when the cover ends and arrange a review or automatic expiry where suitable.

Explain the request process to staff and make it workable. Long, confusing approval routes can leave people struggling to complete legitimate tasks.

Clear requests and timely decisions help access control support the business.

Treat joining, changing roles and leaving as access events

People’s access needs change as their work changes.

The NCSC recommends managing accounts through a process covering people joining, moving roles and leaving. Its guidance for online applications also includes outside users, such as providers and partners.

A simple way to organise responsibilities is:

The middle row is easy to overlook.

A change of role may trigger new permissions while leaving the old ones untouched. Build an access review into the change itself.

Suppose a manager moves from overseeing one branch to overseeing another.

Their access may need updating for local staff records, customer information and approval tasks. Keeping all previous permissions “just in case” should be a considered exception with a clear reason.

Other changes matter too.

A promotion, temporary assignment, extended cover arrangement or completed project can alter what someone needs.

Agree how the people managing staff changes will notify those managing access. Include enough detail to act: the person, the change, the effective date and the responsible manager.

Then check the result.

A request being sent does not confirm that permissions were updated. Record when the change was completed and deal with any systems still awaiting action.

Make leaving arrangements complete

When someone leaves, access removal needs to cover the services they could use.

Returning equipment is one part of the process. An account in an online system may remain usable from another device.

Check the systems identified in your access records, including separately managed services.

Agree the timing of removal, who will carry it out and how completion will be confirmed. Use an approach that reflects the circumstances and risks.

Involve the people who understand how each system works.

For Microsoft 365, for example, Microsoft’s guidance distinguishes between resetting credentials, signing out existing sessions and blocking future sign-in. The effect and timing of these actions can vary. That is a reason to verify the outcome for the systems involved.

Review shared access the person may have used, and handle it through an approved process.

You can remove someone’s ability to sign in while keeping necessary business records under the organisation’s agreed retention and access arrangements.

Plan the handover of work so an authorised colleague can continue it with suitable permissions.

Keeping a former employee’s access active because another person needs their files leaves an avoidable gap.

A clear handover gives the business continuity without relying on that former user continuing to have access.

Review suppliers, partners and shared links

Outside access can be easy to forget because it may sit outside your staff records.

An accountant, IT provider, subcontractor or other partner may need access to specific information for a genuine task.

Decide what they need, who approves it and when it should be reviewed or removed.

An outside marketing agency might need publishing access to company pages. That does not automatically mean it needs access to customer exports or internal finance files.

Check the individuals and accounts involved, including changes in the provider’s own team.

Shared links deserve attention too.

Microsoft’s OneDrive guidance explains that an “Anyone” link may be usable by people who receive it through forwarding. Links restricted to specified people work differently. The setting chosen affects who can reach the information.

Review the actual sharing settings for important folders and documents.

Ask whether the intended people can view only, edit or download, and whether other permissions already give them access.

Read-only access can still allow copying or downloading, depending on the service and settings.

Use approved sharing methods and agree how information will be handled after the task ends.

Removing future access does not retrieve copies someone has already downloaded. That is why the decision about what to share matters from the start.

Give extra attention to powerful accounts

Some accounts can change security settings, create users or give others access.

These are often called administrator accounts.

They need closer attention because mistakes or misuse can affect many people and systems. NCSC guidance recommends protecting administration access with appropriate technical measures and clear procedures.

Identify who needs those powers and for which tasks.

Separate everyday work from administration where appropriate. A person who sometimes manages system settings does not need to use the most powerful account for every normal activity.

Include authorised cover and a controlled arrangement for emergencies, so necessary work can continue during an absence or system problem.

Shared logins create a different challenge.

If several people use one account, it can become harder to understand who carried out an action or remove one person’s access cleanly.

Prefer named user access where the service supports it. A shared mailbox, for example, can be used by authorised people through their individual accounts rather than everyone knowing one password.

The NCSC also recommends designing access arrangements so actions can be associated with the person or account responsible.

This supports investigation and makes responsibilities clearer.

Keep sign-in security and permissions working together

A strong sign-in method helps establish that someone is who they claim to be.

Multi-factor authentication adds further checks to sign-in. The NCSC provides guidance on using strong methods for corporate online services.

That protection matters, but you still need to decide what the account can do after sign-in.

A person can complete every sign-in check correctly and still hold access they no longer need.

Review both questions together:

• How do we confirm who is signing in?
• What information and actions should that account be allowed to access?

For example, enabling stronger sign-in for a former project account does not explain why its old folder permissions remain.

Check the business need for the account and its permissions, alongside the protection used.

This helps avoid treating one security improvement as the answer to every access issue.

Make access reviews meaningful

An access review should examine whether the permissions currently in place still match an approved need.

A list of names with a manager’s signature may give limited assurance if nobody understands what those names can access.

Give the reviewer useful information.

Show the system or folder, the user or account, the relevant permissions and the reason access was granted.

Include outside accounts, temporary permissions and unusually powerful roles.

Ask the responsible person to decide what should remain, change or end. Follow through on the decisions and record completion.

Choose review timing based on the information involved, the risk and how often circumstances change. A service with frequent project changes may need more attention than a stable area with limited access.

Review access when responsibilities change as well. Scheduled reviews provide another opportunity to catch gaps.

Consider checking a sample of recent staff or project changes during internal audits.

Did a person who moved roles lose the access no longer required? Did a completed supplier task lead to the agreed removal? Do the system records support the completion record?

Use suitable activity records to help understand what is happening. Logging and monitoring can help detect suspicious use, provided someone has responsibility for responding to relevant findings.

A quiet account is not automatically harmless, and an active account is not automatically appropriate.

Judge access against the work it needs to support.

Give decisions a clear owner

Access control needs cooperation between managers, people handling staff changes, IT and the people responsible for the information.

Each sees a different part of the picture.

A manager knows what work an employee performs. The staff team knows when a role changes. IT understands how to apply permissions. The person responsible for the information knows how it should be used.

Agree who makes each decision and how information passes between them.

For a new request, that might mean a manager explains the task, the information owner approves the need and IT applies the permissions.

For a departure, the agreed process should trigger the necessary actions across the services involved.

Make room to raise questions.

If a request asks for access to an entire system when a small part would meet the need, someone should be able to query it and suggest a suitable option.

Give staff clear guidance on requesting access, sharing information and reporting something that appears wrong.

People are more likely to follow an arrangement they understand and can use without unnecessary delay.

Learn from one realistic example

Consider a business reviewing its shared project folders.

An illustrative review finds that a former supplier still has access, an employee retains editing rights from an old assignment and a folder has a link that allows wider access than intended.

The business checks each permission with the person responsible for the project.

The supplier’s task is complete, so their access is removed. The employee still needs to read some records, so suitable access is retained. The shared link is replaced with the approved arrangement.

The review also reveals why the gaps developed: project closure did not include an access check.

The business adds that step and makes responsibility clear.

The useful improvement is both the corrected permissions and the better process for future projects.

Another review can then check whether the new arrangement is being used.

Benefits of a consultant’s support

Reviewing access can be difficult when responsibility is spread across several teams and systems.

The benefits of a consultant’s support may include help making the process clearer, connecting it with ISO 27001 requirements and identifying where the arrangements need strengthening.

A consultant can help a business assess its risks, review access policies and organise evidence showing how decisions are made.

They may also help plan internal audits that follow a real access request, role change or departure through to completion.

That can reveal a practical gap which a policy review alone would miss.

For example, your policy may explain that access ends when a project closes. An audit may show that nobody tells the system owner when closure happens.

The useful action would be to improve that handover and check it works.

Choose support that explains the requirements in plain language and fits the way your business operates.

Use suitably skilled technical support to apply changes within systems and confirm their effect.

Keep responsibility within the business. Managers still need to approve genuine work needs, staff changes still need to be communicated and findings still need action.

Good support leaves your team better able to explain and manage access, with a process it can maintain.

Start with one important information area

Choose a system or folder containing information that matters to your business.

Find out who can access it, including outside users and access through groups or links.

Ask the person responsible to explain what each account needs to do and whether the permissions remain suitable.

Look at one recent change too. That could be a role move, a departure or the end of a supplier’s task.

Check whether the access was updated as intended.

Agree any necessary action with the people responsible, then confirm that it was completed.

Use what you learn to improve the process for the next change.

Could you explain who can access your most important business information today, and why every one of them still needs it?