Skip to content

Access Control

What is Access Control?

Security measures that regulate who can view or use resources in a computing environment. Access controls include authentication, authorisation, and audit mechanisms.

Information Security

Related terms

AuthenticationAuthorisationRBAC (Role-Based Access Control)

Frameworks that govern access control

ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on access control

Requirements naming access control across 6 standards, quoted from the control text.

New Zealand Information Security Manual (NZISM)35 controls

Access controls for BYOD must be implemented in line with Chapter 16 (Access Control).

new-zealand-information-security-manual-nzism::21.4.11.C.08 · 21.4.11.C.08 BYOD access controls per Chapter 16 →
NIST SP 800-53 Rev 528 controls

Route remote accesses through authorized and managed network access control points.

NIST800-AC-17(3) · AC-17(3) Remote Access | Managed Access Control Points →
ISO 27002:202220 controls

Rules that govern both physical entry and logical access to information and associated assets are to be set and applied on the basis of business and information security requirements. Purpose: allow access that is authorized and block access that is not.

iso-27002-2022::5.15 · Access control →
FFIEC IT Examination Handbook16 controls

Management designs cloud access control around the network, hypervisor, virtual machines, APIs, multi-tenancy, attribute and role management and data replication and destruction, addresses the compounding of risk by the volume of virtual machines, defines acce...

ffiec-it-examination-handbook::AIO-VII.A.5(a) · VII.A.5(a) Access Control Considerations (Architecture, Infrastructure, and Operations) →
PCI DSS 4.016 controls

The access control systems must be configured to deny all access by default, so that nobody receives access unless a rule specifically grants it.

7.3.3 · 7.3.3 Access control default deny all →
FBI CJIS Security Policy11 controls

Route remote access through authorized and managed network access control points.

fbi-cjis-security-policy::AC-17(3) · AC-17(3) Remote Access | Managed Access Control Points →

Questions people ask about access control

What is Access Control?
Security measures that regulate who can view or use resources in a computing environment. Access controls include authentication, authorisation, and audit mechanisms.
Why is Access Control important for compliance?
Access Control is a key concept in Information Security. Understanding access control helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
What concepts are related to Access Control?
Key concepts related to Access Control include Authentication, Authorisation, RBAC (Role-Based Access Control). Understanding these interconnected concepts provides a more comprehensive view of Information Security requirements and helps organizations build holistic compliance programs.
Which compliance frameworks address Access Control?
Access Control appears in the requirement text of New Zealand Information Security Manual (NZISM), NIST SP 800-53 Rev 5, ISO 27002:2022, FFIEC IT Examination Handbook, PCI DSS 4.0. Across these standards we have identified 126 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Access Control?
Explore our compliance framework pages to see how access control applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Access Control applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.