home/dictionary/system access

system access

nounverified·updated Aug 30, 2026

The ability of a user, process, or device to interact with an information system — whether to connect to it, log in, read data, execute transactions, or perform administrative functions. It is distinguished from related but narrower concepts (such as data access, network access, or physical access) by treating the *system* as the unit of control: authority documents enumerate subtypes such as physical access, logical/network access, and privileged/administrative access to define the full surface that must be governed. In practice, the field uses the expression as the object managed by access-control policies — something that is granted, restricted, monitored, audited, and revoked — and frameworks from NIST SP 800-171 through SOC 2 / AICPA Trust Services Criteria all treat governing "system access" as a primary control objective rather than a derived one.

Framework senses

NIST SP 800-171r31 senseview framework →
§1 · attested_usage_reviewer_confirmed
No definition is given in NIST SP 800-171r3. The term is attested in use at 13 citations in that document; a definition is pending curation.
Increment 2: attested in 800-171r3 without a glossary definition.
Legacy lexicon import1 senseview framework →
§1 · legacy_primary
The ability of a user, process, or device to interact with an information system — whether to connect to it, log in, read data, execute transactions, or perform administrative functions. It is distinguished from related but narrower concepts (such as data access, network access, or physical access) by treating the *system* as the unit of control: authority documents enumerate subtypes such as physical access, logical/network access, and privileged/administrative access to define the full surface that must be governed. In practice, the field uses the expression as the object managed by access-control policies — something that is granted, restricted, monitored, audited, and revoked — and frameworks from NIST SP 800-171 through SOC 2 / AICPA Trust Services Criteria all treat governing "system access" as a primary control objective rather than a derived one.
DR-088 backfill from the noun definition column