Access control

Q: What is the difference between access control and IAM?

Access control enforces rights. IAM is the overarching framework that manages identities, roles and rights.

Q: What does the least-privilege principle mean?

Each user receives only the rights they need for their task, limiting the damage if an account is compromised.

Q: Why does access control matter for the GDPR?

The GDPR requires protection from unauthorized access; granular rights and logging are central measures.

Access control governs who may access which data and systems. It ensures users receive only the permissions they need for their task.

What is access control?

Access control governs and enforces who may access which data, applications and systems. It is a core part of data security and ensures sensitive information is available only to authorized people.

Authentication and authorization

First a user proves their identity (authentication), then access control checks and grants the appropriate rights (authorization). Without reliable authentication, access control cannot work.

Access control models

Role-based access control (RBAC): rights assigned to roles rather than individuals
Least-privilege principle: only as many rights as necessary
Privileged access management (PAM): extra protection for privileged accounts

These models are managed within an identity and access management (IAM) framework.

Why access control matters for compliance

The GDPR requires that only authorized people access personal data. Granular rights and complete logging are key technical and organizational measures, also required by frameworks such as ISO 27001 and NIS2.

Access control with SecureCloud

SecureCloud provides granular, role-based access rights, logging and multi-factor authentication as part of Advanced Access Management. The service is operated in Germany, GDPR-compliant, BSI C5-attested and ISO 27001-certified.

Frequently asked questions

What is the difference between access control and IAM?

Access control is the concrete enforcement of access rights. IAM (identity and access management) is the overarching framework that manages identities, roles and rights across their entire lifecycle.

What does the least-privilege principle mean?

Least privilege means each user receives only the rights they need for their task. This limits the potential damage if an account is compromised.

Why does access control matter for the GDPR?

The GDPR requires personal data to be protected from unauthorized access. Access control with granular rights and logging is a central measure for this.

Advanced Access Management