[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-18":3},{"item":4,"lessons":16,"controls":30,"related":57},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-18","Annex A 5.18","Access rights",3,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Access rights to information and assets should be granted, reviewed, changed and removed in line with the organisation's access control policy and rules. This covers the full lifecycle, not only the initial request.\n\n**In practice.** Every request is approved by the asset or system owner, provisioned according to the least privilege and need to know principles, and recorded. Access is reviewed at regular intervals, more often for privileged and high risk systems, and changes after a move or exit are made promptly. Many organisations automate this through an identity governance tool fed by the HR system. An auditor will sample joiners, movers and leavers and ask for approval records and completed access review reports with the actions taken.\n\n**Common gaps.** Reviews are often rubber-stamped by managers who approve everything shown to them. Service accounts, local application accounts and SaaS tools outside single sign-on are frequently left out of the review scope entirely.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22,26],{"slug":19,"title":20,"published_at":21},"romanian-retailer-fined-54k-for-gdpr-failures-including-unauthorized-employee-data-access","Romanian Retailer Fined €54K for GDPR Failures Including Unauthorized Employee Data Access","2026-08-14T14:20:23.214+00:00",{"slug":23,"title":24,"published_at":25},"former-employees-retain-data-access-after-departure-triggering-gdpr-fine","Former Employees Retain Data Access After Departure, Triggering GDPR Fine","2026-06-30T18:21:12.538+00:00",{"slug":27,"title":28,"published_at":29},"former-employees-retain-data-access-costing-polish-sub-processor-gdpr-fine","Former Employees Retain Data Access, Costing Polish Sub-Processor GDPR Fine","2026-06-30T10:21:45.066+00:00",[31,35,40,45,49,53],{"slug":32,"name":33,"problem":34,"stories":9},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":36,"name":37,"problem":38,"stories":39},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",2,{"slug":41,"name":42,"problem":43,"stories":44},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",1,{"slug":46,"name":47,"problem":48,"stories":44},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":50,"name":51,"problem":52,"stories":44},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":54,"name":55,"problem":56,"stories":44},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[58,63,68,73,77,79,83,87],{"family":59,"item":60,"code":61,"title":62,"together":9},"cis","6","Control 6","Access Control Management",{"family":64,"item":65,"code":66,"title":67,"together":9},"gdpr","32","Article 32","Security of processing",{"family":69,"item":70,"code":71,"title":72,"together":9},"nist-800-53","ac-2","AC-2","Account Management",{"family":64,"item":74,"code":75,"title":76,"together":9},"5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":59,"item":74,"code":78,"title":72,"together":9},"Control 5",{"family":69,"item":80,"code":81,"title":82,"together":39},"ps-4","PS-4","Personnel Termination",{"family":69,"item":84,"code":85,"title":86,"together":39},"ac-6","AC-6","Least Privilege",{"family":64,"item":88,"code":89,"title":90,"together":39},"28","Article 28","Processor"]