Access control is the security practice of deciding who can access which systems and data — and what they’re allowed to do with them. It’s one of the most fundamental controls in any security programme.
It combines authentication (proving who you are) with authorisation (what you’re allowed to do), applied through models like RBAC and ABAC and principles like least privilege.
Plain-English explainer · Maps to ISO 27001 Annex A / SOC 2 / DPDP · Last reviewed June 2026
Access control is how an organisation regulates who can access its systems and data, and what they can do once in. It has two halves: authentication (confirming a user is who they claim — passwords, MFA) and authorisation (deciding what that authenticated user is permitted to do). Good access control enforces the principle of least privilege: people get only the access their job requires. It’s implemented through models — most commonly RBAC (role-based) and increasingly ABAC (attribute-based) — and it’s a cornerstone of every major framework: a whole theme of ISO 27001’s Annex A controls, a core part of SOC 2’s security criteria, and essential to DPDP protection of personal data.
Key Takeaways
- Access control = authentication (who you are) + authorisation (what you may do).
- Four models: DAC (owner-decided), MAC (policy/label-driven), RBAC (role-based — most common), ABAC (attribute-based — most granular).
- The guiding principle is least privilege — minimum access needed — backed by need-to-know, separation of duties, and regular access reviews.
- It’s foundational to ISO 27001 (Annex A), SOC 2 (logical access), and DPDP (protecting personal data).
Four Ways to Grant Access
DAC — Discretionary
The data owner decides who gets access. Flexible but easy to sprawl. Common in file shares and small teams.
MAC — Mandatory
Access is set centrally by policy and classification labels (e.g., Confidential, Secret). Rigid and high-assurance. Used in government/defence.
RBAC — Role-Based
Access is granted to roles (e.g., “Finance”, “Engineer”), and people inherit their role’s permissions. The most common model in business systems.
ABAC — Attribute-Based
Access is decided by attributes (user, resource, context — department, location, time). The most granular and dynamic. Powers zero-trust setups.
Rules That Make Access Control Work
- Least privilege — give each person the minimum access they need to do their job, nothing more.
- Need-to-know — access to specific data is limited to those who require it for a task.
- Separation of duties — split sensitive actions across people so no one can act alone (e.g., request vs approve).
- Joiner-mover-leaver — provision on hire, adjust on role change, and revoke promptly on exit.
- Regular access reviews — periodically re-certify who has access to what, and remove what’s stale.
Access Control — Common Questions
The questions people ask most about access control.
What is access control in cyber security?
What are the types of access control?
What is the difference between RBAC and ABAC?
What is the principle of least privilege?
How does access control relate to ISO 27001 and SOC 2?
Related reading: the Learn hub, what an ISMS is, GRC, and the ISO 27001 Annex A controls. More terms in the compliance glossary.
Related Reading
Annex A Controls Overview
All 93 controls across organizational, people, physical and tech domains.
Read moreISO 27001 Knowledge Hub
All 93 Annex A controls, all clauses, every guide in the cluster.
Read moreTSC: Security (CC Series)
The mandatory common criteria — every SOC 2 report includes these.
Read moreSOC 2 Controls List
No official list exists — illustrative controls by criteria series (CC1–CC9).
Read moreISO 27001 Controls Library
Browse all 93 Annex A controls with implementation guidance.
Read moreISO 27001 Overview
The ISMS standard — the baseline certificate global buyers ask for.
Read more