Information Security Handbook

Access control policy

The purpose of access controls in an information system is to determine what activities are allowed and what activities are prohibited. Users, in most cases, should not have unfettered access to information systems. Access controls allow organizations to establish rules around how they want users to access information systems.

An access control policy should address:

• Limiting information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems)
• Limiting information system access to the types of transactions and functions that authorized users are permitted to execute
• Controlling the flow of information in accordance with approved authorizations ...