Access Control
The policies, processes, and technologies that determine who can access which resources under what conditions. Access control ensures that only authorized individuals reach sensitive systems and data.
Why it matters
Most breaches involve unauthorized access, whether through stolen credentials, excessive permissions, or forgotten accounts. Access control is the single most impactful category of security controls. Every framework mandates it. The principle of least privilege, granting only the minimum access needed, is simple to state but hard to maintain as organizations grow. Without active management, permissions accumulate and orphaned accounts persist.
In practice
Access control spans identity management, authentication (proving who you are), authorization (what you are allowed to do), and regular access reviews. It applies to applications, infrastructure, physical facilities, and data. In vucavoid, access-related controls are tracked with assigned owners and periodic effectiveness testing. Reviews surface when access rights drift from policy, and findings feed into your VUCA score.