Home » Security Training and Tips » Domains of CISSP: Access Control

Domains of CISSP: Access Control

Access control is the collection of mechanisms that permits managers of a system to exercise a directing or restraining influence over the behavior, use, and content of a system. It permits management to specify what users can do, which resources they can access, and what operations they can perform on a system.


The candidate should fully understand access control concepts, methodologies, and implementation within centralized and decentralized environments across the enterprise’s computer systems. Access control techniques as well as detective and corrective measures should be studied to understand the potential risks, vulnerabilities, and exposures.

Key Areas of Knowledge

  • Control access by applying the following concepts/methodologies/techniques:
    • Policies
    • Types of controls (preventive, detective, corrective, etc.)
    • Techniques (e.g., non-discretionary, discretionary and mandatory)
    • Identification and Authentication
    • Decentralized/distributed access control techniques
    • Authorization mechanisms
    • Logging and monitoring
  • Understand access control attacks
  • Assess effectiveness of access controls

About this author:


Frank is a leading trainer in IT Security.

Leave a Reply

Your email address will not be published. Required fields are marked *


This site uses Akismet to reduce spam. Learn how your comment data is processed.