system access authorization
A set of formally approved permissions and privileges that specify which users, roles, or processes are permitted to interact with a given information system and in what capacity. In NIST SP 800-53 access control guidance, organizations are directed to "define system access authorizations to support separation of duties," framing these authorizations as the structured assignments of access rights that underpin separation-of-duties enforcement. The identification of authorized users and the specification of their access privileges may be defined by account, by account type, or both, and may incorporate additional attributes such as time-of-day or point-of-origin restrictions. In practice, the phrase is used across federal policy and compliance standards as the collective body of documented, approved access entitlements for a system — distinct from the technical mechanism that enforces them — and is subject to management activities such as provisioning, periodic review, and revocation.
Framework senses
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A set of formally approved permissions and privileges that specify which users, roles, or processes are permitted to interact with a given information system and in what capacity. In NIST SP 800-53 access control guidance, organizations are directed to "define system access authorizations to support separation of duties," framing these authorizations as the structured assignments of access rights that underpin separation-of-duties enforcement. The identification of authorized users and the specification of their access privileges may be defined by account, by account type, or both, and may incorporate additional attributes such as time-of-day or point-of-origin restrictions. In practice, the phrase is used across federal policy and compliance standards as the collective body of documented, approved access entitlements for a system — distinct from the technical mechanism that enforces them — and is subject to management activities such as provisioning, periodic review, and revocation.DR-088 backfill from the noun definition column