ISOISO 27001Iso Annex A ControlsEASYFree question
The control for access control policy requires:
- A.Access only for IT staff. Annex A control 7.14 applies this requirement to external auditors during the Plan phase.
- B.Unrestricted access to all systems
- C.An access control policy based on business and information security requirements
- D.No access controls for internal networks. This corresponds to Annex A control 5.11 under the 2022 structure, with a different numbering under the 2013 Annex A.
Why C is correct
The access control policy must be established based on business and information security requirements to restrict access appropriately.
Know someone studying for ISO 27001? Send them this one.