The locking system knows who can unlock, not why
ISO 27001 A.7.2 and the BSI building blocks of layer INF require evidence of who has access to sensitive areas and that authorisations are withdrawn on departure or role change. The locking system itself knows who can unlock, but not why. The register closes that gap with four building blocks: the locking system as the bracket, the access area as what gets unlocked, the authorisation group as a bundle of areas, and the authorisation as the assignment to a person.
An authorisation that no longer applies is withdrawn. Date, reason and whether the medium came back remain on record. A deleted record proves nothing: in an audit it cannot be told apart from an authorisation that never existed.
Expired but not withdrawn, groups with an overdue review, areas with high protection needs. The first is the classic finding with contractors and temporary staff.
Mechanical systems, electronic ones and mixed estates are handled alike. Two fields are prepared for later reconciliation: the leading system and its reference there.
Evidence that authorisations were withdrawn on departure, including whether the key came back.
Schedule a no-obligation demo – we will show you the module with your own use cases.
