What is access control?
Access control decides what a signed-in person, device or service account may do with a resource: read, change, delete, export or approve. In a payroll system, an employee can see her own payslip but not her colleague's.
The goal of the German BSI module ORP.4 Identity and Authorisation Management is that users access only the resources and information they need and are authorised for. ISO/IEC 27002 gives implementation guidance for the Annex A controls of ISO/IEC 27001.
Physical, system and data access: three levels
German security language separates three levels that English lumps together as "access control". ORP.4 covers them in separate requirements: physical entry (Zutritt) in A5, system access (Zugang) in A6 and data access (Zugriff) in A7. When you write or translate a requirement, always name the level.
| Level | Protects against | Examples |
|---|---|---|
| Physical entry control (Zutritt) | unauthorised entry to rooms | locks, badge readers, visitor rules |
| System access control (Zugang) | unauthorised use of systems | sign-in, multi-factor authentication, screen lock |
| Data access control (Zugriff) | unauthorised reading, changing or deleting of data | role concept, tenant separation, logging |
Signing in does not prove permission
Authentication checks who someone is. Access control checks whether this account may perform this action on this object. MFA strengthens only the first step: whether a signed-in employee may export customer data or approve payments is decided by a separate rule.
Enforce that rule on the server for every request and refuse anything no rule permits. Hiding a button does not stop a direct call to the same function.
DAC, MAC, RBAC and ABAC compared
| Model | Who or what decides | Example |
|---|---|---|
| DAC (Discretionary Access Control) | the owner of an object | The author of a file gives a colleague editing rights. |
| MAC (Mandatory Access Control) | central rules users cannot change | A classified document requires the matching clearance level. |
| RBAC (Role-Based Access Control) | the role a user is assigned to | The "payroll" role may run salary payments. |
| ABAC (Attribute-Based Access Control) | attributes of user, object and context | Support reads an assigned customer's record only from a managed device. |
The models can be combined. Whatever the model, the least privilege principle applies: roles are derived from tasks, not from rights someone has collected over the years. ORP.4.A4 also requires incompatible functions to be separated.
A permissions test you can reuse
Fictional example: in an expense application, employees read their own claims. Managers approve their team's claims but not their own. The test uses test accounts and made-up records.
| Test case | Expected result | Evidence |
|---|---|---|
| Employee A opens her own claim | claim is shown | test account, claim ID, application response |
| Employee A requests B's claim directly through the API | no data from B | sanitised request and response |
| Manager approves a team member's claim | approval is saved | new status and approving person |
| Manager approves her own claim | approval is refused, claim stays open | response and unchanged status |
The test passes only if both the permitted and the prohibited cases behave as expected. An application that refuses everything protects the data and is still unusable.
Record the version or configuration, test date and tester. If a case fails, name an owner, fix the rule and repeat the affected cases.
What the BSI Act, ISO 27001, DORA and the GDPR require
| Source | Provision | What it requires |
|---|---|---|
| BSI Act (BSIG) | § 30(2) sentence 2 no. 9 BSIG | concepts for access control at essential and important entities |
| ISO/IEC 27001:2022 | Annex A 5.15 to 5.18, 8.2, 8.3 | controls for managing access and permissions; the BSI mapping table maps them to ORP.4 |
| DORA | Article 9(4)(c) of Regulation (EU) 2022/2554 | limit physical and logical access to what is required for legitimate activities |
| GDPR | Article 32(1) and (4) GDPR | a level of security appropriate to the risk; persons acting under authority process data only on instruction |
Access rights go stale with every change
ORP.4.A2 requires permissions that are no longer needed to be removed when staff change; ORP.4.A3 requires a regular check that the documentation matches the actual state.
Include service accounts, administrative accounts and interfaces. When someone leaves, disabling one account is not enough: also check open sessions and tokens in the connected applications. The access control concept template gives a structure for roles, approvals and reviews.
Access requirements on each system
Rizzqo carries access control as a requirement on each system. Every supporting asset shows the access control requirements that the ISO/IEC 27002 catalogue held in Rizzqo maps to its category. The system owner attaches evidence, such as the role concept and the log of the last permissions test. The owner then finalises the answer with name and timestamp.
The system inherits the confidentiality rating and the personal-data flag from the primary assets it supports. Rizzqo calculates coverage from the finalised answers.