[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is Access Control? The Essential Cybersecurity Practice](/blog/access-control) Publish date June 24, 2025 {x} minute read # What is Access Control? The Essential Cybersecurity Practice [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-cybersecurity) [Free trial](/demo) Written by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Cybersecurity Free resource ### A Complete Guide to Cybersecurity Learn how to protect your business with an effective cybsecurity program. [Download now](/resources/complete-guide-to-cybersecurity) Access control is a method of restricting access to sensitive data. Only those that have had their identity verified can access company data through an access control gateway. ## What are the Components of Access Control? At a high level, access control is about restricting access to a resource. Any access control system, whether physical or logical, has five main components: 1. **Authentication: **The act of proving an assertion, such as the identity of a person or computer user. It might involve validating personal identity documents, verifying the authenticity of a website with a digital certificate, or checking login credentials against stored details.  2. **Authorization: **The function of [specifying access rights or privileges to resources](https://www.upguard.com/blog/prevent-supply-chain-attacks-by-securing-pam). For example, human resources staff are normally authorized to access employee records and this policy is usually formalized as access control rules in a computer system.  3. **Access: **Once authenticated and authorized, the person or computer can access the resource. 4. **Manage: **Managing an access control system includes adding and removing authentication and authorization of users or systems. Some systems will sync with G Suite or Azure Active Directory, streamlining the management process. 5. **Audit: **Frequently used as part of access control to enforce the [principle of least privilege](https://www.upguard.com/blog/principle-of-least-privilege). Over time, users can end up with access they no longer need, e.g. when they change roles. Regular audits minimize this risk.   ## How Does Access Control Work? Access control can be split into two groups designed to improve physical security or [cybersecurity](https://www.upguard.com/blog/cyber-security): * **Physical access control:** limits access to campuses, building and other physical assets, e.g. a proximity card to unlock a door. * **Logical access control:** limits access to computers, networks, files and other [sensitive data](https://www.upguard.com/blog/sensitive-data), e.g. a username and password. For example, an organization may employ an electronic control system that relies on user credentials, access card readers, intercom, auditing and reporting to track which employees have access and have accessed a restricted data center. This system may incorporate an access control panel that can restrict entry to individual rooms and buildings, as well as sound alarms, initiate lockdown procedures and prevent unauthorized access.  This access control system could authenticate the person's identity with [biometrics](https://www.upguard.com/blog/biometrics) and check if they are authorized by checking against an access control policy or with a key fob, password or personal identification number (PIN) entered on a keypad.  Another access control solution may employ multi factor authentication, an example of a [defense in depth](https://www.upguard.com/blog/defense-in-depth) security system, where a person is required to know something (a password), be something ([biometrics](https://www.upguard.com/blog/biometrics)) and have something (a [two-factor authentication code](https://www.upguard.com/blog/two-factor-authentication) from smartphone mobile apps).  In general, access control software works by identifying an individual (or computer), verifying they are who they claim to be, authorizing they have the required access level and then storing their actions against a username, IP address or other audit system to help with [digital forensics](/blog/digital-forensics) if needed. ## Why is Access Control Important? Access control minimizes the risk of authorized access to physical and computer systems, forming a foundational part of [information security](https://www.upguard.com/blog/information-security), [data security](https://www.upguard.com/blog/data-security) and [network security](https://www.upguard.com/blog/network-security).  Depending on your organization, access control may be a regulatory compliance requirement: * **PCI DSS:** Requirement 9 mandates organizations to restrict physical access to their buildings for onsite personnel, visitors and media, as well as having adequate logical access controls to mitigate the [cybersecurity risk](https://www.upguard.com/blog/cybersecurity-risk) of malicious individuals stealing [sensitive data](https://www.upguard.com/blog/cybersecurity-risk). Requirement 10 requires organizations employ security solutions to track and monitor their systems in an auditable manner.  * **HIPAA: **The HIPAA Security Rule requires Covered Entities and their business associates to prevent the unauthorized disclosure of [protected health information (PHI)](https://www.upguard.com/blog/protected-health-information-phi), this includes the usage of physical and electronic access control.   * **SOC 2: **The auditing procedure enforce [third-party vendors](https://www.upguard.com/blog/third-party-vendor) and service providers to manage [sensitive data](https://www.upguard.com/blog/sensitive-data) to [prevent data breaches](https://www.upguard.com/blog/prevent-data-breaches), protecting employee and customer privacy. Companies who wish to gain SOC 2 assurance must use a form of access control with two-factor authentication and [data encryption](/blog/encryption). SOC 2 assurance is particularly important for organization's who process [personally identifiable information (PII)](https://www.upguard.com/blog/personally-identifiable-information-pii). * **ISO 27001:** An [information security](https://www.upguard.com/blog/information-security) standard that requires management systematically examine an organization's [attack vectors](https://www.upguard.com/blog/attack-vector) and audits all [cyber threats](https://www.upguard.com/blog/cyber-threat) and [vulnerabilities](https://www.upguard.com/blog/vulnerability). It also requires a comprehensive set of risk mitigation or transfer protocols to ensure continuous information security and business continuity.  ## What are the Types of Access Control? The main types of access control are: * **Attribute-based access control (ABAC): **Access management systems were access is granted not on the rights of a user after authentication but based on attributes. The end user has to prove so-called claims about their attributes to the access control engine. An attribute-based access control policy specifies which claims need to be satisfied to grant access to the resource. For example, the claim may be the user's age is older than 18 and any user who can prove this claim will be granted access. In ABAC, it's not always necessary to authenticate or identify the user, just that they have the attribute.  * **Discretionary access control (DAC):** Access management where owners or administrators of the protected system, data or resource set the policies defining who or what is authorized to access the resource. These systems rely on administrators to limit the propagation of access rights. DAC systems are criticized for their lack of centralized control.  * **Mandatory access control (MAC): **Access rights are regulated by a central authority based on multiple levels of security. MAC is common in government and military environments where classifications are assigned to system resources and the operating system or security kernel will grant or deny access based on the user's or the device's security clearance. It is difficult to manage but its use is justified when used to protected highly [sensitive data](https://www.upguard.com/blog/sensitive-data).  * [**Role-based access control (RBAC)**](/blog/rbac)**: **In RBAC, an access system determines who can access a resource rather than an owner. RBAC is common in commercial and military systems, where multi-level security requirements may exist. RBAC differs from DAC in that DAC allows users to control access while in RBAC, access is controlled at the system level, outside of user control. RBAC can be distinguished from MAC primarily by the way it handles permissions. MAC controls read and write permissions based on a user/device's clearance level while RBAC controls collections of permissions that may include complex operations such as credit card transactions or may be as simple as read or write. Commonly, RBAC is used to restrict access based on business functions, e.g. engineers, human resources and marketing have access to different SaaS products. [Read our full guide on RBAC here](/blog/rbac). * **Rule-based access control: **A security model where an administrator defines rules that govern access to the resource. These rules may be based on conditions, such as time of day and location. It's not uncommon to have some form of rule-based access control and role-based access control working together. * **Break-Glass access control:** Traditional access control has the purpose of restricting access, which is why most access control models follow the [principle of least privilege](https://www.upguard.com/blog/principle-of-least-privilege) and the default deny principle. This behavior may conflict with operations of a system. In certain situations, humans are willing to take the risk that might be involved in violating an access control policy, if the potential benefit of real-time access outweighs the risks. This need is visible in healthcare where inability to access to patient records could cause death.  eBook A Complete Guide to Cybersecurity Free resource ### A Complete Guide to Cybersecurity Learn how to protect your business with an effective cybsecurity program. [Download now](/resources/complete-guide-to-cybersecurity) ## Related posts Learn more about the latest issues in cybersecurity. Attack Surface Management #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 Data Breaches #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Data Breaches #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)