An information technology process of any organization produces many assets. Information assets are stored as an evidence for organizational operation. These assets may be damaged by any unexpected actions such as information modification and disruption or released to outside by unauthorized person. These actions may affect the overall operation and business value. Thus, the organizations should focus on security and safety of information assets by creating the access control management system to manage information authorization. This thesis proposes process design for information assets access control based on security patterns and ISO/IEC 27001:2005 standard and ISO/IEC 27002:2005 standard. The proposed access control process consists of three model layers: overview layer, workflow layer, and definition layer. Moreover, the related template documents and supporting tool are also developed to help implementing the proposed access control process effectively. The access control process for information assets proposed in this thesis helps any organizations to create security for their information assets and to reduce the risks that may impact organizational operations.