Role-Based Access Control
What is Role-Based Access Control?
An access management approach that assigns permissions to defined roles rather than individual users, simplifying administration and enforcing least privilege.
Terms that appear alongside role-based access control
Each of these is named in at least one of the same controls as role-based access control. The number is how many controls name both.
- access control 24 shared controls
- authentication 16 shared controls
- role based access control rbac 13 shared controls
- access management 13 shared controls
- least privilege 13 shared controls
- privileged access management 12 shared controls
- nist 11 shared controls
- multi factor authentication 10 shared controls
Frameworks that govern role-based access control
What the standards actually require on role-based access control
Requirements naming role-based access control across 6 standards, quoted from the control text.
A secure communication has an association identifier, authenticates the stations to each other, may rely on a central authority for credentials, applies role-based access control from part 8, manages update keys and session keys (the controlling station issuin...
iec-62351-power-systems-communication-security::5:6.2 · Part 5, 6.2: theory of operation (association ID, authenticating, central authority, role-based access control, cryptographic keys, security statistics and events) →Establish a role-based access control system with supporting policies and procedures.
awwa-cybersecurity-guidance-for-the-water-sector-american-water-works-association::IA-3 · IA-3 Role-based access control →Define and keep role-based access control by working out and recording the access rights each role in the enterprise needs to perform its duties.
CIS-6.8 · Define and Maintain Role-Based Access Control →Run role-based access by working out and documenting the access each role needs to perform its duties, and review privileges on enterprise assets at least yearly to confirm all are authorised.
cis-controls-v8-1::6.8 · Define and Maintain Role-Based Access Control →The IED enforces authorization by assigning each user a level or role that determines the functions available, supporting role-based access control so that viewing, control, configuration change, firmware update and data retrieval can each be restricted to aut...
ieee-1686::5.2.2 · Authorization levels and role-based access control →Security Dimension 1 Access Control per X.805 Clause 6.1: Access Control guards network resources against use without authorization, admitting only authorized staff or devices to services, applications, information flows, stored information and network element...
X805-Dim1-Access-Control-RBAC-Authorization-Resources-Network-Elements-Services-Applications · ITU-T X.805 Security Dimension 1 - Access Control + Role-Based Access Control (RBAC) + Authorization + Resources + Network Elements + Services + Applications + Access Limitations + Authorized Personnel + Discretionary + Mandatory Access Control →Questions people ask about role-based access control
What is Role-Based Access Control?
Why is Role-Based Access Control important for compliance?
Which compliance frameworks address Role-Based Access Control?
Where can I learn more about Role-Based Access Control?
See how Role-Based Access Control applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.