Access Control List
What is Access Control List?
A list of rules that specifies which users or system processes are granted access to objects, as well as what operations are allowed on given objects.
Frameworks that govern access control list
What the standards actually require on access control list
Requirements naming access control list across 6 standards, quoted from the control text.
Agencies must use a defined process to develop access control lists, for example the staged table in this control: stage 1, group every system resource by shared security objectives; stage 2, name the information owner of each resource group;
new-zealand-information-security-manual-nzism::16.2.4.C.01/CID1930 · 16.2.4.C.01 Defined eight-stage process for building access control lists →Set data access control lists according to each user's need to know, and apply these access permissions to file systems (local and remote), databases and applications.
CIS-3.3 · Configure Data Access Control Lists →Set access control lists on data according to need to know, and enforce those permissions on file systems (local or networked), on databases and inside applications.
cis-controls-v8-1::3.3 · Configure Data Access Control Lists →Management designs cloud access control around the network, hypervisor, virtual machines, APIs, multi-tenancy, attribute and role management and data replication and destruction, addresses the compounding of risk by the volume of virtual machines, defines acce...
ffiec-it-examination-handbook::AIO-VII.A.5(a) · VII.A.5(a) Access Control Considerations (Architecture, Infrastructure, and Operations) →Limit, physically and logically, who can communicate with or use a CBS, handle or learn its information or control its components, without obstructing authorised staff at their level under least privilege, allowing access only to people who need it for their d...
iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E26-4.2.4 · E26 4.2.4 Access control →The organization is to limit who can reach information and associated assets, following its established access control policy. Purpose: permit authorized access and block unauthorized access to information and associated assets.
iso-27002-2022::8.3 · Information access restriction →Questions people ask about access control list
What is Access Control List?
Why is Access Control List important for compliance?
Which compliance frameworks address Access Control List?
Where can I learn more about Access Control List?
See how Access Control List applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.