## 8.3 Information access restriction

| Control type | Information security properties           | Cybersecurity concepts | Operational capabilities        | Security domains |
| ------------ | ----------------------------------------- | ---------------------- | ------------------------------- | ---------------- |
| #Preventive  | #Confidentiality #Integrity #Availability | #Protect               | #Identity_and_access_management | #Protection      |

**Control**
Access to information and other associated assets should be restricted in accordance with the established topic-specific policy on access control.

**Purpose**
To ensure only authorized access and to prevent unauthorized access to information and other associated assets.

**Guidance**
Access to information and other associated assets should be restricted in accordance with the established topic-specific policies. The following should be considered in order to support access restriction requirements:

a\) not allowing access to sensitive information by unknown user identities or anonymously. Public or anonymous access should only be granted to storage locations that do not contain any sensitive information;
b\) providing configuration mechanisms to control access to information in systems, applications and services;
c\) controlling which data can be accessed by a particular user;
d\) controlling which identities or group of identities have which access, such as read, write, delete and execute;
e\) providing physical or logical access controls for the isolation of sensitive applications, application data, or systems.

Further, dynamic access management techniques and processes to protect sensitive information that has high value to the organization should be considered when the organization:

a\) needs granular control over who can access such information during what period and in what way;
b\) wants to share such information with people outside the organization and maintain control over who can access it;
c\) wants to dynamically manage, in real-time, the use and distribution of such information;
d\) wants to protect such information against unauthorized changes, copying and distribution (including printing);
e\) wants to monitor the use of the information;
f\) wants to record any changes to such information that take place in case a future investigation is required.

Dynamic access management techniques should protect information throughout its life cycle (i.e. creation, processing, storage, transmission and disposal), including:

a\) establishing rules on the management of dynamic access based on specific use cases considering:
1\) granting access permissions based on identity, device, location or application;
2\) leveraging the classification scheme in order to determine what information needs to be protected with dynamic access management techniques;

b\) establishing operational, monitoring and reporting processes and supporting technical infrastructure.

Dynamic access management systems should protect information by:

a\) requiring authentication, appropriate credentials or a certificate to access information;
b\) restricting access, for example to a specified time frame (e.g. after a given date or until a particular date);
c\) using encryption to protect information;
d\) defining the printing permissions for the information;
e\) recording who accesses the information and how the information is used;
f\) raising alerts if attempts to misuse the information are detected.

**Other information**
Dynamic access management techniques and other dynamic information protection technologies can support the protection of information even when data is shared beyond the originating organization, where traditional access controls cannot be enforced. It can be applied to documents, emails or other files containing information to limit who can access the content and in what way. It can be at a granular level and be adapted over the life cycle of the information.

Dynamic access management techniques do not replace classical access management \[e.g. using access control lists (ACLs)\], but can add more factors for conditionality, real-time evaluation, just-in-time data reduction and other enhancements that can be useful for the most sensitive information. It offers a way to control access outside the organization’s environment. Incident response can be supported by dynamic access management techniques as permissions can be modified or revoked at any time.

Additional information on a framework for access management is provided in ISO/IEC 29146.