[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-3":3},{"item":4,"lessons":16,"controls":66,"related":95},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-3","Annex A 8.3","ISO\u002FIEC 27001:2022 Annex A 8.3: Information access restriction",18,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects access to information and other associated assets to be restricted in line with the organisation's topic-specific access control policy. Its purpose is to make sure only authorised users and systems can reach information, preventing unauthorised access.\n\n**In practice.** Good practice means applying access rules within applications and systems, not only at login, so users see only the information they need. Methods include role-based permissions, restricting access to sensitive data sets, controlling read, write and delete rights, and considering dynamic access management for sensitive information. Auditors expect access rules that link back to policy and evidence that permissions are configured and reviewed.\n\n**Common gaps.** Typical gaps are broadly shared folders and collaboration spaces, overly permissive default roles in SaaS applications and no review of who can access sensitive data.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"spanish-cycling-federation-fined-4800-after-two-month-data-breach-exposing-261965-records","Spanish Cycling Federation Fined €4,800 After Two-Month Data Breach Exposing 261,965 Records","2026-10-16T16:20:43.825+00:00",{"slug":23,"title":24,"published_at":25},"ai-agents-accessed-live-sensitive-data-during-testing-due-to-exposed-credentials-and-excessive-permi","AI Agents Accessed Live Sensitive Data During Testing Due to Exposed Credentials and Excessive Permissions","2026-10-16T08:20:59.754+00:00",{"slug":27,"title":28,"published_at":29},"inherited-ai-agents-create-hidden-identity-and-access-blind-spots","Inherited AI Agents Create Hidden Identity and Access Blind Spots","2026-10-10T12:20:48.952+00:00",{"slug":31,"title":32,"published_at":33},"third-party-access-exposes-88-million-danes-national-id-data","Third-Party Access Exposes 8.8 Million Danes' National ID Data","2026-10-06T08:21:29.589+00:00",{"slug":35,"title":36,"published_at":37},"third-party-access-exploited-to-breach-denmarks-entire-population-registry","Third-Party Access Exploited to Breach Denmark's Entire Population Registry","2026-10-05T16:20:37.656+00:00",{"slug":39,"title":40,"published_at":41},"zero-trust-remains-effective-against-ai-attacks-when-properly-implemented","Zero Trust Remains Effective Against AI Attacks — When Properly Implemented","2026-10-01T18:20:20.176+00:00",{"slug":43,"title":44,"published_at":45},"ai-agent-circumvents-government-portal-access-controls-reporting-delay-compounds-risk","AI Agent Circumvents Government Portal Access Controls, Reporting Delay Compounds Risk","2026-09-24T10:21:28.2+00:00",{"slug":47,"title":48,"published_at":49},"italian-health-agency-fined-24k-for-lax-ehr-access-controls-and-insufficient-audit-logging","Italian Health Agency Fined €24K for Lax EHR Access Controls and Insufficient Audit Logging","2026-09-14T14:22:22.466+00:00",{"slug":51,"title":52,"published_at":53},"social-engineering-via-third-party-contractor-exposes-41m-healthcare-records-1789042843480","Social Engineering via Third-Party Contractor Exposes 4.1M Healthcare Records","2026-09-10T12:20:43.327+00:00",{"slug":55,"title":56,"published_at":57},"broad-government-subpoena-of-retail-purchase-data-raises-mass-surveillance-concerns","Broad Government Subpoena of Retail Purchase Data Raises Mass Surveillance Concerns","2026-09-04T12:21:17.692+00:00",{"slug":59,"title":60,"published_at":61},"autonomous-ai-agents-orchestrate-supply-chain-breach-without-human-direction","Autonomous AI Agents Orchestrate Supply Chain Breach Without Human Direction","2026-08-26T20:20:57.254+00:00",{"slug":63,"title":64,"published_at":65},"brazil-sisvisa-health-database-left-79gb-of-sensitive-records-publicly-exposed","Brazil SISVISA Health Database Left 79GB of Sensitive Records Publicly Exposed","2026-08-05T12:21:52.305+00:00",[67,72,77,82,87,91],{"slug":68,"name":69,"problem":70,"stories":71},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",6,{"slug":73,"name":74,"problem":75,"stories":76},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",5,{"slug":78,"name":79,"problem":80,"stories":81},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",4,{"slug":83,"name":84,"problem":85,"stories":86},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",3,{"slug":88,"name":89,"problem":90,"stories":86},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":92,"name":93,"problem":94,"stories":86},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[96,102,108,113,118,122,125,129],{"family":97,"item":98,"code":99,"title":100,"together":101},"cis","6","Control 6","Access Control Management",16,{"family":103,"item":104,"code":105,"title":106,"together":107},"nist-800-53","ac-2","AC-2","Account Management",11,{"family":109,"item":110,"code":111,"title":112,"together":107},"gdpr","32","Article 32","Security of processing",{"family":103,"item":114,"code":115,"title":116,"together":117},"ac-3","AC-3","Access Enforcement",10,{"family":97,"item":119,"code":120,"title":106,"together":121},"5","Control 5",7,{"family":109,"item":119,"code":123,"title":124,"together":121},"Article 5(1)(f)","Principles relating to processing of personal data",{"family":97,"item":126,"code":127,"title":128,"together":71},"13","Control 13","Network Monitoring and Defense",{"family":97,"item":130,"code":131,"title":132,"together":71},"3","Control 3","Data Protection"]