ISO 27002:2022 8.3: Information access restriction
Requires access to information and other associated assets to be restricted in accordance with the established topic specific policy on access control.
What else in your programme already covers this
This control maps to 91 controls across 33 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
3.4.2 Technical controls prevent unauthorized PAN copy
7.3.2 The access control system(s) is configured to enforce permissions assigned to individuals, applications, and systems based on job classification and function
9.4.1 Media with cardholder data physically secured
7.2.4 All user accounts and related access privileges, including third-party/vendor accounts, are reviewed as follows: • At least once every six months. • To ensure user accounts and access remain appropriate based on job function.
7.2.5 All application and system accounts and related access privileges are assigned and managed as follows: • Based on the least privileges necessary for the operability of the system or application. • Access is limited
7.2.6 All user access to query repositories of stored cardholder data is restricted as follows: • Via applications or other programmatic methods, with access and allowed actions based on user roles and least privileges. •
7.3.1 An access control system(s) is in place that restricts access based on a user's need to know and covers all system components
NIST800-AC-16 Security and Privacy Attributes. Provide the means to associate [organization-defined] with [organization-defined] for information in storage, in process, and/or in transmission; Ensure that the attribute associations are made and retained with the information; Establish
NIST800-AC-21 Information Sharing. Enable authorized users to determine whether access authorizations assigned to a sharing partner match the information's access and use restrictions for [organization-defined] ; and Employ [organization-defined] to assist users in making information
NIST800-AC-24 Access Control Decisions. [organization-defined] to ensure [organization-defined] are applied to each access request prior to access enforcement
NIST800-SC-43 Usage Restrictions. Establish usage restrictions and implementation guidelines for the following system components: [organization-defined] ; and Authorize, monitor, and control the use of such components within the system
NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
NIST-CSF-PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
NIST-CSF-PR.PS-05 Installation and execution of unauthorized software are prevented
You are reading one control. How much of ISO 27002:2022 have you already done?
ISO 27002:2022 8.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.