Logical access security, also called logical access control, is the set of technical controls that decide who can reach an information system and what they may do inside it. The word "logical" is there to distinguish it from physical access control: one governs the login, the other governs the door.
Logical and physical access
You need both, and they fail differently. An auditor will ask about each separately, because a server room with a strong lock and a shared admin password is not protected, and neither is the reverse.
| Logical access | Physical access | |
|---|---|---|
| Controls | Accounts, passwords, MFA, roles, permissions, network segmentation | Locks, badges, visitor logs, cabinets, cameras |
| Protects against | Remote intrusion, credential theft, over-broad permissions | Theft of hardware, unsupervised access to equipment |
| Evidence | User lists, MFA coverage, access review records, logs | Badge records, visitor register, inspection reports |
The four layers
Logical access is usually broken into four steps. Naming them separately is useful because you will probably be strong on the first two and weak on the last two, which is where audit findings come from.
| Layer | Question it answers |
|---|---|
| Identification | Who are you claiming to be? One unique account per person, no shared logins. |
| Authentication | Can you prove it? A password plus a second factor, or a certificate or passkey. |
| Authorisation | What are you allowed to do? Least privilege, granted by role rather than per person. |
| Accountability | What did you do? Logging that ties an action back to one identity. |
Shared accounts break the first and last layer at once. If two people use one login, you cannot prove who acted, and every log line becomes an assertion rather than evidence.
What ISO 27001 asks for
Access control is spread across several Annex A controls, which is why it rarely fits in a single policy document. A.5.15 covers access control rules, A.5.16 identity management, A.5.17 authentication information, and A.5.18 the granting, review and removal of access rights.
A.8.2 then treats privileged access as its own problem, because an administrator account defeats most other controls. Expect to show that privileged accounts are separate, few, and reviewed more often than ordinary ones.
Common mistakes
Leavers keep access. Your offboarding probably removes the obvious accounts and misses the ones nobody owns centrally, so tie removal to the HR event rather than to someone remembering.
Access accumulates. People move roles and gain permissions without losing the old ones, which is why your periodic review exists. A review that confirms everything is fine every quarter is not being done.
And permissions get granted per person rather than per role. That feels faster and makes the estate impossible to reason about, because there is no longer any statement of what a given job should be able to see.