ISO 27001 Annex A.9 is the access control area of the standard, covering how organisations restrict, approve, and review access to information and systems. It focuses on ensuring access is authorised, appropriate to role, and removed when no longer needed. Audit evidence and repeatable governance are central to implementation.
Expanded Definition
iso 27001 annex a.9 is the access control domain inside the broader information security management system defined by ISO/IEC 27001:2022 Information Security Management. In practical terms, it requires organisations to decide who can access what, approve that access with governance, and prove those decisions through repeatable evidence.
For NHI security, Annex A.9 matters because service accounts, API keys, workloads, and agent credentials often bypass the human-centric assumptions embedded in older access models. The control family is less about a single login event and more about the full access lifecycle: request, approval, provisioning, review, and removal. That lifecycle should be consistent with role-based access, least privilege, and timely revocation, as reflected in ISO/IEC 27002:2022 Information Security Controls.
Definitions vary across vendors when Annex A.9 is translated into tooling language, especially where teams confuse access control with authentication alone. The most common misapplication is treating initial sign-in checks as sufficient, which occurs when access reviews, privilege reduction, and removal of stale NHI entitlements are not operationalised.
Examples and Use Cases
Implementing Annex A.9 rigorously often introduces governance overhead, requiring organisations to weigh faster access provisioning against stronger approval and review discipline.
- Granting a deployment pipeline only the repository and secret vault permissions it needs, then reviewing those permissions on a fixed cadence.
- Requiring documented approval before a service account can read production secrets, rather than leaving inherited access in place indefinitely.
- Using the Ultimate Guide to NHIs to benchmark access governance for service accounts, API keys, and automation identities against real-world NHI risk patterns.
- Aligning access control workflows with ISO/IEC 27001:2022 Information Security Management so that access is formally authorised and auditable.
- Removing access from an agent after the business process it served has ended, rather than waiting for a later cleanup cycle.
In many NHI environments, annex-style access control is also about visibility: only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs. That makes access review processes dependent on discovery, inventory, and ownership clarity before they can be effective.
Why It Matters in NHI Security
Annex A.9 becomes critical when NHI access is broader than intended, because excessive privilege is a common failure mode in automation-heavy environments. NHI Management Group reports that 97% of NHIs carry excessive privileges, which means weak access control is not an edge case but a systemic exposure pattern.
When teams misunderstand Annex A.9, they often build approval workflows for humans while leaving machine identities with standing permissions, weak expiry rules, or no periodic recertification. That creates a gap between policy and operational reality, especially across CI/CD, cloud platforms, and AI agent toolchains. The result is not only overexposure but also poor auditability, making it difficult to prove who authorised access, when it was last reviewed, and whether removal actually occurred.
For governance teams, the control is a practical bridge between policy intent and evidence. It forces access decisions to be explicit, reviewable, and reversible. Organisations typically encounter the cost of this control only after a compromised credential or over-permissioned service account is used in a real incident, at which point Annex A.9 becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 | Covers over-privileged NHI access and review gaps. |
| NIST CSF 2.0 | PR.AC-1 | Identity and access management requires authorized access enforcement. |
| NIST Zero Trust (SP 800-207) | AC-6 | Least privilege is a core zero trust access principle. |
| NIST SP 800-63 | AAL2 | Assurance requirements inform how access is authenticated before authorization. |
| CSA MAESTRO | Agentic systems need scoped, reviewable tool access and revocation. |
Apply least privilege to service accounts and agents, with continuous verification of access need.
