Attribute-Based Access Control
What is Attribute-Based Access Control?
An access control paradigm that grants or denies access based on policies evaluating attributes of users, resources, actions, and the environment.
Terms that appear alongside attribute-based access control
Each of these is named in at least one of the same controls as attribute-based access control. The number is how many controls name both.
- access control 9 shared controls
- role based access control 6 shared controls
- zero trust 5 shared controls
- privileged access management pam 5 shared controls
- role based access control rbac 5 shared controls
- privileged access management 5 shared controls
- access management 5 shared controls
- nist 5 shared controls
Frameworks that govern attribute-based access control
What the standards actually require on attribute-based access control
Requirements naming attribute-based access control across 6 standards, quoted from the control text.
The access control policy is enforced on the basis of security attributes, with explicit rules for allowing and denying operations. The standard's application note for this SFR sets how its operations are to be completed for a QKD module.
iso-iec-23837-2023::1-9.2.6 · Part 1, 9.2.6 FDP_ACF.1 Security attribute-based access control →Enforce attribute-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined attributes to assume access permissions].
NIST800-AC-3(13) · AC-3(13) Access Enforcement | Attribute-based Access Control →Assign permissions via groups, permission sets or attribute-based access control rather than to individual users to simplify management and reduce permission sprawl.
SEC02-BP06 · Employ user groups and attributes →Enable authorized users to determine whether a sharing partner's access authorizations match the information's access and use restrictions as set in an executed information exchange agreement, and employ attribute-based access control or the manual processes t...
fbi-cjis-security-policy::AC-21 · AC-21 Information Sharing →ISMAP Identity and Access Management requires comprehensive IAM controls covering customer + CSP + administrative + service-to-service identities.
ISMAP-Identity-Access-MFA-Privileged-Federation-SSO-API-Tokens-CloudIAM-PIV-PASETO · ISMAP Identity and Access Management - Cloud IAM + Multi-Factor Authentication + Privileged Access + Federation/SSO + API Security + Access Tokens + My Number Card Integration + Government IAM →Security Dimension 1 Access Control per X.805 Clause 6.1: Access Control guards network resources against use without authorization, admitting only authorized staff or devices to services, applications, information flows, stored information and network element...
X805-Dim1-Access-Control-RBAC-Authorization-Resources-Network-Elements-Services-Applications · ITU-T X.805 Security Dimension 1 - Access Control + Role-Based Access Control (RBAC) + Authorization + Resources + Network Elements + Services + Applications + Access Limitations + Authorized Personnel + Discretionary + Mandatory Access Control →Questions people ask about attribute-based access control
What is Attribute-Based Access Control?
Why is Attribute-Based Access Control important for compliance?
Which compliance frameworks address Attribute-Based Access Control?
Where can I learn more about Attribute-Based Access Control?
See how Attribute-Based Access Control applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.