Granting access to a valuable resource is a question of trust (conditional authorization) and necessity (continuous authentication). For example, consider a company office building. Some areas are publicly accessible, while others are restricted to specific personnel. These restricted areas may have confidential information or sensitive equipment and therefore are limited only to people the company both trusts and have a need to be in that area.   This same concept can be applied to information systems. Much in the same way that building access is restricted to different people, access control in information systems defines the allowed activities of specific users.    Considering the increasing utilization and dependency on applications and information systems, creating a comprehensive policy to define access control is a necessary task that virtually all organizations will have to complete to varying degrees. Fortunately, organizations can save considerable time by leveraging access control policy templates.   In this article, we’ll explore what is included in an access control policy, how to create an access control policy for your organization, and where to find a time-saving access control policy template.  

What is an Access Control Policy? 

Access control is a data security technique that limits system access based on the user’s specified authorization (e.g. personas). This can be as simple as enabling password protection or far more complex with a system requiring varying sensitivity levels and sophisticated clearance models.  By creating an access control policy, an organization defines rules and guidelines detailing who can access specific data and resources. Access control policies are a key measure in ensuring adequate information system security. NIST discusses access control policies as part of the fundamental management responsibility to ensure adequate security of information. 

Common Access Control Systems 

Access control can be achieved through a variety of techniques and models. Information system types, number of users, data sensitivity, and other factors can influence how an organization may approach access control. The four most common types of access control include: 

1. Mandatory Access Control (MAC) is the most restrictive and inflexible type of access control. In this type of access control, only system administrators have the ability to permit system access. This provides a high level of security, but also requires lengthy approval processes to change user permissions or grant new user access.  
2. Discretionary Access Control (DAC) is the least restrictive and most flexible type of access control. In this system, the owner of the resource can specify who can access the resource. In other words, if you create a file in a Discretionary Access Control system, you as the file owner can transfer access to whichever users you specify. This puts the security control into the hands of the users. While this can be flexible and easy to use, it does require more active management by the users to upkeep resource security. 
3. Role-based Access Control (RBAC) has become one of the most popular access control systems. Instead of individual user assignments such as in MAC or user-specified access such as in DAC, RBAC provides a proactive level of user permission based on their position in the organization. Each role in an organization is provided a customized level of access rights. Users are then assigned to a role and inherit those access rights. 
4. Rule-Based Access Control is typically used in conjunction with other Access Control types and is relatively vague in its definition. Rule-based Access Control allows or denies resource access based on a set of rules and limitations set by the system administrator. For example, Rule-Based Access Control can be used to restrict data access on holidays, or after working hours.  

How to Create an Access Control Policy in 4 Steps 

Virtually every modern organization will need to create an access control policy. Though there are many ways to approach this process, one method an organization can consider is to follow these 4 steps:  

Step 1: Identify target information systems and data sensitivity levels 

The first step in creating an access control policy is to identify which information systems need access control systems and what the level of sensitivity is of the resource. For example, a database containing client banking information would likely require a significantly high level of security. If more than one information system requires access control, then each may need to be considered separately under the access control policy.  

Step 2: Determine access requirements 

Step 2 is identifying who needs access to each of the systems identified in the first step. It will also be important to consider other access requirements (roles, attributes, flow, service…) such as access timing (i.e. when someone would need to access the data), number of expected users, frequency in which access requirements could change, and how users will access the system.   

Step 3: Determine how you will protect your data 

After completing Steps 1 and 2, you’ll have gathered the information required to begin putting access controls in place. Selecting access controls is a balance between ensuring adequate security is in place and allowing for flexibility in user access. For example, consider an organization that is determining access control systems for a database with thousands of constantly changing users.  If that organization selected a MAC strategy, that strategy would likely provide adequate security, however, they may have difficulties keeping up with the constant access requests, causing users a delay in accessing the resources they need. Using an RBAC approach instead may allow system administrators to partially automate the user access permissions based on the roles that new users are grouped into.  

(Optional) Step 4: Set rules, guidelines, or automation for access control 

Though not technically a required step, completing Step 4 in your access control policy will very likely reduce time and effort down the road. As time goes on, access requirements will change. This could be due to people changing roles, new employee hires, new customers using your system, and a variety of other reasons.   Adding guidelines and even automation to your access control strategy can help to adjust access permissions on a timely basis (and potentially without requiring the manual intervention of a system administrator). For example, in an RBAC system, a new hire could be added to a role group which would automatically grant the associated access permissions to that person. Similarly, someone departing the organization would be removed from the group and automatically have their access revoked.  

What Needs to Be Included in an Access Control Policy? 

Now that you know the steps to create an access control policy, it’s important to know what to document within the policy itself.    As mentioned earlier, a good template will go a long way in getting you pointed in the right direction for preparing your access control policy. Each policy can be customized to best fit the organization’s specific needs and systems, however, there are a few sections that most access control policies should likely include.  

1. Document overview and/or purpose 

The document overview identifies which organization, systems, and personnel the policy applies to. This is especially important in large organizations with multiple information systems as they may have separate governing policies for each system.   The document purpose is sometimes written separately from the document overview section and outlines the motivation behind developing the access control policy. Though this section is often quite brief, it helps set the stage for the spirit of access control policies and informs readers of why following the policy is important.  

2. Glossary/definitions 

Though the team members within your organization may be intimately familiar with the current terms used in the access control policy, it’s important to ensure your policy includes this section. Terms may change as your systems evolve, or new personnel may join your team and may be unfamiliar with the terms in the policy. If the policy cannot be understood, then it will be impossible for your team to follow.  

 3. Procedures and specific rules 

Procedures and rules will detail how the policy is to be set up, controlled, and monitored. These sections will constitute the bulk of the policy and can be organized in a variety of ways. For example, user access levels may be detailed in these sections, along with remote access, physical data center access, and administrative access. Additionally, procedures for securing access permissions or submitting access requests may also be outlined in these sections.  

 4. Responsible person/department 

This section is usually quite brief and provides contact information should questions or concerns regarding the policy arise. In a small organization, the policy may be owned by a single individual, while in a large organization, the policy may be owned by a department.  

Use this Template to Generate your Access Control Policy in Minutes 

A well-organized template can help guide your organization in creating a high-quality Access Control Policy, saving significant time (and associated costs). Don’t know where to find one? CNI IPKeys Technologies has you covered! With IPKeys’ CLaaS, you can eliminate hours of analysis and tedious manual work in researching and developing your Access Control Policy. As an organization committed to providing cybersecurity and NIST compliance solutions, we understand the need to simplify and streamline security processes.  Our team likes to use the template created by our friends at I-Assure as a starting point. It’s a comprehensive yet easy-to-follow Access Control Policy template for information systems and you can download it here.

Protect your sensitive data with IPKeys 

CNI IPKeys Technologies provides cybersecurity and NIST compliance solutions for Federal agencies. Here’s how IPKeys can help you improve your cybersecurity and compliance processes:  

Automate your processes 

IPKeys provides fully customizable, out-of-the-box solutions that can automate your compliance and security processes, saving your organization valuable time and money. Our comprehensive and intuitive solutions are designed to keep you organized, automate important tasks, track key processes, and more. 

Stay up-to-date 

Today’s software environments can produce an overwhelming amount of cybersecurity information. IPKeys helps organizations to visualize relevant data clearly and intuitively, making it easy to stay ahead of issues and respond proactively.  

Get experienced help 

Our experienced team includes industry professionals committed to providing our clients with the highest level of service. From system architecture and engineering to software development and cybersecurity, our team provides our clients with the skill, expertise, and support needed to develop innovative strategies and solutions. 

Access control policy template – common FAQs 

What should be included in an access control policy? 

A typical access control policy should include a glossary of terms, policy scope, policy purpose, access control rules, and contact information for the person /department responsible for generating and maintaining the policy.  

What are the benefits of creating an access control policy? 

Access control policies are key security measures for information systems. The benefits of creating an access control policy include increased data security, streamlining access requests, and monitoring information system access.  

What are examples of access controls? 

Access controls in information security include any systems which restrict user access. Examples include login information, untrusted networks, and security tokens.