access control policy
A governing statement or set of rules — situated at the policy layer of a security architecture, above implementation mechanisms — that defines which subjects (users, processes, or roles) are permitted to perform which operations on which objects (files, devices, records, domains, or other resources), and under what conditions. Organizations implementing access control systems distinguish three abstractions — policies, models, and mechanisms — with access control policies being the high-level requirements that specify how access is managed and who may access information under what circumstances. Policies may pertain to resource usage within or across organizational units, or may be based on need-to-know, competence, authority, obligation, or conflict-of-interest factors. In practice the term names a recognized category of security artifact that can be instantiated in several named paradigms: identity-based, role-based, and attribute-based policies are all enumerated types, each paired with a corresponding enforcement mechanism such as access control lists, matrices, or cryptography.
Framework senses
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A governing statement or set of rules — situated at the policy layer of a security architecture, above implementation mechanisms — that defines which subjects (users, processes, or roles) are permitted to perform which operations on which objects (files, devices, records, domains, or other resources), and under what conditions. Organizations implementing access control systems distinguish three abstractions — policies, models, and mechanisms — with access control policies being the high-level requirements that specify how access is managed and who may access information under what circumstances. Policies may pertain to resource usage within or across organizational units, or may be based on need-to-know, competence, authority, obligation, or conflict-of-interest factors. In practice the term names a recognized category of security artifact that can be instantiated in several named paradigms: identity-based, role-based, and attribute-based policies are all enumerated types, each paired with a corresponding enforcement mechanism such as access control lists, matrices, or cryptography.DR-088 backfill from the noun definition column