[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-15":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-15","Annex A 5.15","ISO\u002FIEC 27001:2022 Annex A 5.15: Access control",14,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects rules for controlling physical and logical access to information and other associated assets to be established and implemented, based on business and information security requirements. Its purpose is to make sure only authorised access takes place and to prevent unauthorised access to information and assets.\n\n**In practice.** Good practice is a topic-specific access control policy built on need to know and least privilege, defining how access is requested, approved, reviewed and removed. The rules are reflected in technical configuration across systems, including cloud services. Auditors look for the policy, evidence of approvals, periodic access reviews and timely removal of leavers.\n\n**Common gaps.** Common gaps are a policy that is not applied consistently across SaaS tools, access that accumulates as people move roles and reviews that are rubber-stamped.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"ai-agents-outpace-legacy-iam-the-non-human-identity-security-gap","AI Agents Outpace Legacy IAM: The Non-Human Identity Security Gap","2026-10-09T12:20:39.879+00:00",{"slug":23,"title":24,"published_at":25},"agentic-ai-identity-risks-demand-new-access-controls","Agentic AI Identity Risks Demand New Access Controls","2026-09-29T12:20:21.048+00:00",{"slug":27,"title":28,"published_at":29},"ai-agents-need-dedicated-iam-frameworks-to-prevent-identity-blind-spots","AI Agents Need Dedicated IAM Frameworks to Prevent Identity Blind Spots","2026-09-28T20:21:25.007+00:00",{"slug":31,"title":32,"published_at":33},"ai-agents-are-unaudited-privileged-users-a-growing-insider-threat","AI Agents Are Unaudited Privileged Users — A Growing Insider Threat","2026-09-28T20:20:52.488+00:00",{"slug":35,"title":36,"published_at":37},"german-court-upholds-gdpr-reprimand-against-food-facility-for-unlawful-employee-surveillance","German Court Upholds GDPR Reprimand Against Food Facility for Unlawful Employee Surveillance","2026-09-16T14:21:20.379+00:00",{"slug":39,"title":40,"published_at":41},"italian-health-agency-fined-24k-for-weak-ehr-access-controls-and-missing-anomaly-detection","Italian Health Agency Fined €24K for Weak EHR Access Controls and Missing Anomaly Detection","2026-09-16T10:22:17.207+00:00",{"slug":43,"title":44,"published_at":45},"italian-hospital-fined-24k-for-granting-unauthorized-access-to-patient-health-records","Italian Hospital Fined €24K for Granting Unauthorized Access to Patient Health Records","2026-09-14T14:22:41.755+00:00",{"slug":47,"title":48,"published_at":49},"ai-agent-identity-sprawl-creates-governance-crisis","AI Agent Identity Sprawl Creates Governance Crisis","2026-07-10T16:21:42.939+00:00",{"slug":51,"title":52,"published_at":53},"lithuanian-medical-firm-fined-450k-for-weak-access-controls-exposing-383000-health-records","Lithuanian Medical Firm Fined €450K for Weak Access Controls Exposing 383,000 Health Records","2026-07-08T10:20:39.008+00:00",{"slug":55,"title":56,"published_at":57},"ai-agents-expose-critical-gaps-in-identity-lifecycle-management","AI Agents Expose Critical Gaps in Identity Lifecycle Management","2026-07-02T14:21:18.004+00:00",{"slug":59,"title":60,"published_at":61},"polish-accounting-firm-fined-after-email-breach-exposes-client-data","Polish Accounting Firm Fined After Email Breach Exposes Client Data","2026-06-29T14:21:08.431+00:00",{"slug":63,"title":64,"published_at":65},"vodafone-espaa-fined-105m-for-unauthorized-line-registration-and-personal-data-disclosure","Vodafone España Fined €1.05M for Unauthorized Line Registration and Personal Data Disclosure","2026-06-24T12:20:51.897+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",12,{"slug":73,"name":74,"problem":75,"stories":76},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",6,{"slug":78,"name":79,"problem":80,"stories":81},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",4,{"slug":83,"name":84,"problem":85,"stories":86},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",3,{"slug":88,"name":89,"problem":90,"stories":91},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",2,{"slug":93,"name":94,"problem":95,"stories":91},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[97,102,108,111,117,121,126,130],{"family":98,"item":99,"code":100,"title":101,"together":9},"nist-800-53","ac-2","AC-2","Account Management",{"family":103,"item":104,"code":105,"title":106,"together":107},"cis","6","Control 6","Access Control Management",13,{"family":103,"item":109,"code":110,"title":101,"together":71},"5","Control 5",{"family":112,"item":113,"code":114,"title":115,"together":116},"gdpr","25","Article 25","Data protection by design and by default",10,{"family":112,"item":109,"code":118,"title":119,"together":120},"Article 5(1)(f)","Principles relating to processing of personal data",8,{"family":103,"item":122,"code":123,"title":124,"together":125},"8","Control 8","Audit Log Management",7,{"family":98,"item":127,"code":128,"title":129,"together":125},"ac-6","AC-6","Least Privilege",{"family":98,"item":131,"code":132,"title":133,"together":125},"ia-2","IA-2","Identification and Authentication (Organizational Users)"]