system access
163527·updated Aug 30, 2026The ability of a user, process, or device to interact with an information system — whether to connect to it, log in, read data, execute transactions, or perform administrative functions. It is distinguished from related but narrower concepts (such as data access, network access, or physical access) by treating the *system* as the unit of control: authority documents enumerate subtypes such as physical access, logical/network access, and privileged/administrative access to define the full surface that must be governed. In practice, the field uses the expression as the object managed by access-control policies — something that is granted, restricted, monitored, audited, and revoked — and frameworks from NIST SP 800-171 through SOC 2 / AICPA Trust Services Criteria all treat governing "system access" as a primary control objective rather than a derived one.
Source
. Types of system access includethe sentence this term was read in
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- system accesses
- possessive
- system access's
- pluralpossessive
- system accesses'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 13 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · legacy_primary
- The ability of a user, process, or device to interact with an information system — whether to connect to it, log in, read data, execute transactions, or perform administrative functions. It is distinguished from related but narrower concepts (such as data access, network access, or physical access) by treating the *system* as the unit of control: authority documents enumerate subtypes such as physical access, logical/network access, and privileged/administrative access to define the full surface that must be governed. In practice, the field uses the expression as the object managed by access-control policies — something that is granted, restricted, monitored, audited, and revoked — and frameworks from NIST SP 800-171 through SOC 2 / AICPA Trust Services Criteria all treat governing "system access" as a primary control objective rather than a derived one.DR-088 backfill from the noun definition column