Templates and records · ISO 27001 · Clause A.5.18

ISO 27001 access rights review record

The periodic check that each person has, in each system, the permissions they need and no more, with the owner’s decision on record.

In one sentence

The access rights review record shows that the owners of each system have reviewed, at regular intervals, the existing users and permissions, and which changes were made; it is the evidence called for by control 5.18 of ISO/IEC 27001:2022, which requires access to be granted, reviewed, modified and removed in line with the policy.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 27001 · Clause A.5.18 Clauses follow ISO/IEC 27001:2022; those beginning with “A.” are Annex A controls, required to the extent that the statement of applicability includes them.
Type of information: Good practice Evidence for Annex A control 5.18
Who fills it in: The owner of each system IT extracts the listings and applies the changes
When: As set by the policy For example, quarterly for privileged access and every six months for the rest
How long it is kept: Set by the organisation ISO/IEC 27001 sets no periods: it asks you to decide on the retention and disposition of documented information (7.5.3). Covering the three-year certification cycle lets you show the history at recertification.

What the standard requires

What ISO 27001 demands and what it leaves to your judgement

Control 5.18 requires access rights to be provisioned, reviewed, modified and removed in accordance with the access control policy (5.15). The periodic review is the part most often forgotten and the one that generates the most findings.

The standard does not set the frequency: the organisation decides it according to risk. It is common to review privileged access more often than ordinary access, and always after role changes or departures.

What turns the review into evidence is that it is carried out by the owner of the system or data, not just by IT, and that it leaves a trail of what is kept and what is removed.

Read it in context: Operation, in the ISO 27001 Academy

Structure

Fields the template should include

System or application reviewed
Date and period covered
List of users and permissions reviewed
Reviewer: system owner
Decision per user: keep, reduce, remove
Generic, service and privileged accounts, with their justification
Changes applied and date

Example

Example: quarterly review of privileged access

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
System	Cloud administration console
Period	Third quarter of 2026 · reviewed on 6 October
Reviewer	Chief technology officer, system owner
Users reviewed	9 administrators and 2 service accounts
Decisions	7 kept · 1 reduced to read-only · 1 removed (team change in July)
Service accounts	Justified: backups and automated deployment
Changes applied	7 October 2026, confirmed by IT

At the audit

Mistakes auditors commonly flag

IT carries out the review without the data owner making the decisions.
The list is reviewed and signed off, but no change is ever applied.
Accounts belonging to people who left months ago are still active.
Shared generic accounts with no owner or justification.

In Kimobox

How this record is kept in Kimobox

1Permissions are managed by profile from the employee portal.
2The periodic review of access and privileges by profile is recorded with its date and reviewer.
3Recording a leaver in the staff file automatically closes access to the portal, the app and the associated modules.

Frequently asked questions

What people ask us before getting started

How often should access be reviewed?

The standard does not say: the access control policy sets it according to risk. What matters is meeting the frequency that the policy itself states.

Is it enough to review access when someone leaves?

No. A departure is a trigger, but the periodic review catches what slips through: role changes, temporary permissions nobody removed or forgotten service accounts.

Keep your ISO 27001 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

ISO/IEC 27001:2022 — Information security management systems. Requirements ISO/IEC · 25 October 2022
ISO/IEC 27002:2022 — Information security controls ISO/IEC · February 2022