Skip to main content
Control Institute
Category: Access and Identity Management

Logical Access Control

Also known as: LAC, logical access controls, logical access control system
Simply put

Logical access control is a system that verifies who a user is and then decides what computer resources they are allowed to reach, such as a workstation, network, application, or data. Unlike physical access control, which governs entry to buildings and devices, logical access control governs access within computer systems. It typically works by authenticating a person's identity and then authorizing them for only the resources appropriate to their role.

Formal definition

Logical access control refers to the automated, technical means of enforcing policy decisions that govern an individual's ability to access computer system resources, including workstations, networks, applications, and data. It typically encompasses authentication (verifying identity) and authorization (granting or restricting access to specific resources based on defined rules), and is commonly implemented through access control models and mechanisms. It is distinct from physical access control, which addresses access to facilities, devices, and physical documents. As a technical implementation layer, logical access controls carry out policy that is set by the management official responsible for a given system, rather than defining that policy themselves.

Why it matters

Logical access control is one of the foundational safeguards examined in both SOC 2 examinations and ISO 27001 certifications, because it determines who can reach an organization's computer systems and what they can do once inside. When access is not properly authenticated and authorized, sensitive data, applications, and networks become exposed to unauthorized users, whether external attackers or insiders acting outside their role. Auditors and certification bodies commonly treat the effectiveness of logical access controls as a central indicator of an organization's broader security posture.

In a SOC 2 engagement, controls addressing logical access typically fall under the Security category (the Common Criteria), which is required in every SOC 2 examination. In a Type II report, the CPA firm assesses not only whether these controls are suitably designed but also whether they operated effectively over the defined review period. For ISO 27001, logical access control aligns with reference controls that an organization may select through its Statement of Applicability, informed by its risk assessment. In both frameworks, weaknesses in this area are frequently flagged, since access management touches nearly every system in scope.

It is important to remember what these controls do and do not guarantee. A SOC 2 report attests only to the controls and the period it covers and does not guarantee freedom from breaches, and an ISO 27001 certificate covers only the defined scope of the ISMS. Well-designed logical access controls reduce risk but should be understood as one layer within a larger control environment rather than an absolute protection.

Who it's relevant to

Compliance and GRC Managers
Compliance and GRC managers need to ensure logical access controls are documented, mapped to the relevant Trust Services Criteria for SOC 2 or selected via the Statement of Applicability for ISO 27001, and supported by clear policy set by the responsible management official. Because access management spans nearly every in-scope system, it is often one of the more evidence-intensive areas to prepare for an examination or certification.
Auditors and Assessors
For CPA firms performing a SOC 2 examination, logical access typically falls within the required Security category, and in a Type II engagement the auditor evaluates both design and operating effectiveness over the review period. For those working toward ISO 27001, assessors consider how logical access controls are selected and justified through the risk assessment and Statement of Applicability. In both cases, assessors typically examine the policy behind the controls as well as their technical enforcement.
Security Engineers and IT Administrators
Security engineers and administrators are typically responsible for implementing the authentication and authorization mechanisms that enforce access policy across workstations, networks, applications, and data. They translate management's access decisions into working technical controls and are often the ones producing the evidence that these controls operate as intended throughout the relevant period or scope.

Inside LAC

Authentication
Mechanisms that verify the identity of a user, device, or process before access is granted, such as passwords, multi-factor authentication, or certificate-based methods. The specific mechanisms selected typically depend on scope and risk assessment.
Authorization
Controls that determine what an authenticated identity is permitted to do, commonly enforced through role-based access, least-privilege principles, and access rules aligned to business need.
User Provisioning and Deprovisioning
Processes for granting, modifying, and revoking access as personnel join, change roles, or leave, including timely removal of access for terminated users.
Access Reviews
Periodic evaluations of granted access to confirm it remains appropriate. The frequency and depth typically vary based on scope, risk, and auditor or certification body expectations.
Privileged Access Management
Additional safeguards applied to administrative or elevated accounts, which may include restricted use, monitoring, and stronger authentication depending on scope.
Logging and Monitoring of Access
Recording and reviewing access events to detect and respond to inappropriate or anomalous activity. The extent of monitoring depends on the criteria and controls in scope.
Relationship to Framework Criteria
In SOC 2, logical access is addressed within the Security category (the Common Criteria), which is the only required Trust Services Criteria category. In ISO/IEC 27001, related reference controls appear in Annex A and are selected via the Statement of Applicability informed by risk assessment; the certifiable requirements themselves reside in clauses 4 through 10. The two frameworks address logical access differently and should not be treated as equivalent.

Common questions

Answers to the questions practitioners most commonly ask about LAC.

Does implementing logical access controls mean my organization is SOC 2 compliant or ISO 27001 certified?
No. Logical access control is one control area among many. A SOC 2 report attests only to the controls and review period covered by the examination, and an ISO 27001 certificate covers only the defined scope of the ISMS. Strong logical access controls contribute to, but do not by themselves establish, either outcome. Both frameworks assess a broad set of controls, and the results depend on the auditor or certification body, the scope, and the applicable criteria.
Are logical access controls the same requirement under SOC 2 and ISO 27001?
Not exactly. In SOC 2, logical access is addressed within the Security category (the Common Criteria) of the Trust Services Criteria. In ISO 27001, access-related expectations are typically addressed through Annex A reference controls selected via the Statement of Applicability and informed by risk assessment, while the certifiable requirements themselves sit in clauses 4 through 10. Mapping between the two is possible but partial, and satisfying one framework's treatment of logical access does not automatically satisfy the other's.
How does the SOC 2 Type I versus Type II distinction affect how logical access controls are evaluated?
In a Type I examination, the auditor assesses the suitability of the design of logical access controls at a point in time. In a Type II examination, the auditor assesses both the design and the operating effectiveness of those controls over a defined review period. The length of that period varies and is set by scoping decisions rather than fixed by the standard, so evidence expectations for logical access typically differ between the two report types.
What kinds of evidence do assessors typically look for regarding logical access controls?
In most engagements, assessors look for evidence such as user provisioning and de-provisioning records, access review documentation, authentication configurations, and role or permission assignments. For a SOC 2 Type II or an ISO 27001 surveillance context, evidence generally needs to demonstrate that controls operated over time, not just that they were designed. The specific evidence expected depends on the auditor or certification body, the scope, and the applicable criteria.
How should logical access controls be documented for an ISO 27001 ISMS?
Where logical access controls are selected as applicable, they are typically reflected in the Statement of Applicability and justified by the organization's risk assessment. The ISMS requirements in clauses 4 through 10 drive how controls are planned, operated, and reviewed, while relevant Annex A reference controls inform what is implemented. Documentation approaches vary by organization and are ultimately evaluated by the accredited certification body against the defined scope.
How often should logical access reviews be performed?
Neither framework prescribes a single universal frequency. In most engagements, organizations define a periodic review cadence based on their own policies and risk assessment, and the assessor evaluates whether reviews were performed consistently with that stated cadence over the relevant period. The appropriate frequency depends on scope, risk, and the commitments the organization has documented.

Common misconceptions

Implementing logical access controls guarantees that a SOC 2 report or ISO 27001 certificate is achieved.
A SOC 2 report attests only to the controls and period covered by the examination and does not guarantee freedom from breaches; an ISO 27001 certificate covers only the defined scope of the ISMS. Logical access controls are one element among many evaluated, and outcomes depend on the auditor, certification body, scope, and applicable criteria.
The logical access controls needed for SOC 2 automatically satisfy ISO 27001, and vice versa.
Mapping between SOC 2 and ISO 27001 is possible but partial. SOC 2 evaluates logical access against the Trust Services Criteria (Common Criteria), while ISO 27001 uses Annex A reference controls selected through a Statement of Applicability. Satisfying one framework does not automatically satisfy the other.
A specific logical access control, such as multi-factor authentication, is universally mandatory across engagements.
Specific controls are typically selected based on scope, risk assessment, and applicable criteria rather than being universally mandated, unless the standard itself requires them. The precise expectations depend on the auditor or certification body and the defined scope.

Best practices

Enforce least-privilege authorization so identities receive only the access needed for their role, and document the rationale for access decisions.
Establish timely provisioning and deprovisioning processes, ensuring access is promptly revoked when personnel change roles or leave.
Conduct periodic access reviews at a frequency appropriate to the scope and risk, retaining evidence to support SOC 2 examination or ISO 27001 certification.
Apply additional safeguards to privileged and administrative accounts, such as restricted use, stronger authentication, and closer monitoring, based on risk.
Log and monitor access events to detect anomalous or inappropriate activity, aligning the scope of monitoring with the criteria and controls in scope.
Map logical access controls to both frameworks where relevant, but validate coverage independently since alignment between SOC 2 and ISO 27001 is only partial.