Access Control

Access control is the set of policies, processes and technical mechanisms that decide who or what may use a resource, such as a computer system, a database, a payment function or a physical room, and that enforce and record those decisions. Its goal is that each person, application or device can reach exactly what its role requires and nothing more. In financial services it is one of the core data security controls and a basic defence against fraud and error.

Access control is usually described as a chain of steps. Identification states who someone claims to be; authentication proves it; authorization decides what that identity may do; and accountability logs what it actually did. Logical access control covers systems and data, while physical access control covers buildings, data centres, vaults and cash rooms. Both are expected by bank supervisors, the card industry and data protection law.

Think of an office building with key cards. Everyone gets a card at reception after showing ID, but each card opens different doors. A cleaner's card opens every floor in the evening but not the server room; a finance clerk's card opens the accounts office but not the vault; a visitor's card works for one day only. When someone leaves the company, their card is switched off.

Access control in computer systems works the same way. The badge check at reception is the login, the list of doors each card opens is the permission list, and the record of every door opened is the audit log that investigators read when something goes wrong.

Several models decide how permissions are assigned:

• Discretionary access control (DAC). The owner of a file or record decides who else may use it, as with shared folders. It is flexible but hard to supervise at scale.
• Mandatory access control (MAC). A central authority assigns security labels to users and data, and the system enforces them; users cannot override them. It is common in military and government systems.
• Role-based access control (RBAC). Permissions are attached to job roles such as teller, payments approver or auditor, and people receive roles. Most banking software uses this model.
• Attribute-based access control (ABAC). Decisions use attributes of the user, the resource and the context, such as department, data sensitivity, time of day or device, so a rule can say "relationship managers may view client files for their own region during working hours".

Large organizations often combine models and connect them to a central identity system, using federated identity management so one login and one set of roles applies across many applications.

Whatever the model, a few principles recur in banks, payment firms and fintechs:

• Least privilege. Each account gets the minimum access needed for its job, and administrator rights are given only for specific tasks, ideally for a limited time.
• Segregation of duties. No single person should be able to complete a sensitive process alone. The maker-checker rule, where one person enters a payment and another approves it, is the classic example.
• Default deny. Access that has not been explicitly granted is refused.
• Joiner, mover, leaver. Access is granted when staff join, adjusted when they change roles and removed promptly when they leave; unused "orphan" accounts are a frequent audit finding.
• Periodic review. Managers recertify their team's access at set intervals, often quarterly for powerful roles in core banking and payment systems.
• Strong login for powerful accounts. Privileged and remote access is protected by multi-factor authentication (MFA) and monitored, often by a security operations centre (SOC).

Access control extends to outsiders. Vendors, outsourcers and cloud providers that connect to a firm's systems need tightly scoped accounts, which is a central concern of third-party risk and vendor risk management. Background screening under know your employee (KYE) programmes complements technical controls for staff in sensitive roles.

Access control appears in nearly every security rulebook that applies to finance. The Payment Card Industry Data Security Standard (PCI DSS) devotes requirements 7, 8 and 9 to restricting access by need to know, identifying and authenticating users, and limiting physical access to card data. In the United States, the FTC's amended Safeguards Rule, whose main new requirements took effect on 9 June 2023, requires non-bank financial institutions to implement access controls and MFA for anyone accessing customer information, and the FFIEC's August 2021 guidance on authentication and access sets supervisory expectations for banks covering customers, employees and third parties. In the European Union, the Digital Operational Resilience Act (DORA), which has applied since 17 January 2025, requires financial entities to have policies limiting physical and logical access to what is needed. The NIST SP 800-53 catalogue, widely used as a reference, groups these measures in its "Access Control" family.

Weak access control sits behind many losses recorded as operational risk. Typical failures include staff who keep access from old roles and can both create and approve payments, shared administrator passwords, former employees whose accounts were never closed, and service accounts with far more rights than their software needs. Insiders with excessive rights can commit fraud or leak data; outsiders who achieve account takeover inherit whatever the stolen account could reach, so tight permissions limit the damage of any single compromise. Many large data breaches began with one over-privileged account. For that reason auditors and compliance testing teams routinely sample access rights, and access management is treated as a standing item in cybersecurity risk reporting to boards.

• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations
• PCI Security Standards Council: PCI DSS