The definitive interactive guide for CISSP students. Understand how each model works, spot the differences, and pass the exam with confidence.
Access control models define who decides who gets access to resources. The CISSP exam tests your ability to identify which model is in use given a scenario — these four models are the most commonly tested.
Access is enforced by the system/policy. Neither users nor data owners can override it. Based on security labels and clearances.
The data owner decides who gets access. Access is granted at the owner's discretion via ACLs or permissions.
Access is based on the user's role or job function. Permissions are assigned to roles, not individuals.
Access is determined by evaluating multiple attributes — user, resource, and environment — against a policy.
| Model | Who Decides Access? | Flexibility | Best For |
|---|---|---|---|
| MAC | The system/OS | ❌ Very rigid | Military, government |
| DAC | The data owner | ✅ Very flexible | Consumer OS, file sharing |
| RBAC | Admin assigns roles | ✅ Moderately flexible | Enterprise, healthcare |
| ABAC | Policy engine | ✅✅ Most flexible | Cloud, Zero Trust |
Select a model to see exactly how an access decision is made — step by step.
The system enforces access based on security labels. No user or owner can override this policy.
The resource owner decides who gets access and sets permissions via an Access Control List (ACL).
Access is determined by a user's role or job function. Permissions are assigned to roles, and users are assigned to roles.
Access is granted when multiple attributes (user, resource, environment) all satisfy a policy. The most context-aware model.
Filter by category to focus on what matters most for your study session.
| Criteria | 🔴 MAC | 🟢 DAC | 🔵 RBAC | 🟣 ABAC |
|---|---|---|---|---|
| Who decides access? | System / OS | Data Owner | Administrator (via roles) | Policy Engine |
| Can owner override? | ❌ Never | ✅ Yes — owner controls all | ⚠️ No — admin assigns roles | ⚠️ No — policy rules apply |
| Access basis | Security labels & clearances | Identity & ACL entries | Role / job function | Multiple attributes + conditions |
| Flexibility | ❌ Very rigid | ✅ Very flexible | ✅ Moderately flexible | ✅✅ Most flexible |
| Security level | 🏆 Highest | ⚠️ Lowest (user error risk) | ✅ Good | ✅✅ Very high (context-aware) |
| Trojan horse risk | ✅ Very low (system enforced) | ❌ High vulnerability | ✅ Low | ✅ Low |
| Insider threat protection | ✅✅ Excellent | ⚠️ Poor | ✅ Good | ✅✅ Excellent |
| Auditability | ✅ Easy (system controls all) | ⚠️ Difficult (owners vary) | ✅ Easy (by role) | ⚠️ Complex (many policies) |
| Best environment | Military, government | Personal OS, small teams | Enterprise, healthcare | Cloud, Zero Trust, SaaS |
| Real-world examples | SELinux, JWICS, NSA systems | Windows NTFS, Google Drive | Active Directory, hospital EMR | AWS IAM, Microsoft Entra / Azure ABAC, XACML |
| Scalability | ⚠️ Difficult to scale | ❌ Poor at large scale | ✅ Scales well | ✅✅ Scales best |
| Admin complexity | ⚠️ High setup, then automatic | ✅ Low (owners manage) | ✅ Moderate | ❌ High (policy management) |
Click any example to expand the full scenario, why it matches the model, and the CISSP exam takeaway.
A military intelligence analyst holds a SECRET clearance. The system automatically allows them to access documents labeled SECRET or below, but completely blocks access to TOP SECRET documents — even if their commanding officer personally requests it. The commanding officer cannot override this; only a formal clearance upgrade processed through the security administration can change access.
A web server process running as the Apache user tries to access /etc/shadow (the password file). Even though the Apache process is running with elevated privileges, SELinux's mandatory policies block this access entirely. The system administrator configured these labels, and even root cannot bypass them without disabling SELinux itself.
Sarah creates a budget spreadsheet and saves it to a shared network drive. She opens the Properties → Security tab and adds her colleague Tom with Read access and her manager with Read/Write access. She can change these permissions any time, or revoke them. The IT department didn't configure this — Sarah did it herself as the file owner.
City General Hospital's EMR system has three roles: Doctor (can view and update treatment records, write prescriptions), Nurse (can view records, update vitals, cannot prescribe), Receptionist (can view scheduling only, no clinical data). When Dr. Chen joins the hospital, IT assigns her the Doctor role. She instantly has the right access without configuring individual permissions. When a nurse is promoted to Head Nurse, the admin simply changes the role.
An AWS IAM policy grants access to financial S3 buckets only when: (1) the user has department=finance tag, AND (2) the request comes from the corporate IP range, AND (3) the request is made between 8AM–6PM Monday–Friday, AND (4) MFA is enabled on the session. All four conditions must be true simultaneously. A finance employee working from home on a Saturday at 10PM would be denied — even though they're in the Finance department.
A company implements Zero Trust using a Policy Decision Point (PDP). Every access request is evaluated in real-time against: user identity + device health score + geolocation + time of day + resource sensitivity + current threat intelligence feed. An employee who passes at 9AM might be denied at 3PM if their device's health score drops (e.g., antivirus goes out of date). Access is never assumed — it's always evaluated.
Each question is phrased exactly like the CISSP exam. Read the scenario and identify the access control model in use.
Answer 3 questions about your scenario and we'll identify the right model — with a full explanation.
Click each card to reveal the mnemonic. These are designed for the CISSP exam — easy to recall under pressure.
| If the question says… | Think… | Model |
|---|---|---|
| "clearance level" / "security label" / "cannot override" / "system enforced" | 🔴 Military / Government / No override | MAC |
| "owner controls" / "user grants access" / "ACL set by" / "shared with" | 🟢 Data owner / Google Drive / Windows sharing | DAC |
| "role" / "job function" / "all [job title] can" / "group membership" | 🔵 Hospital roles / Active Directory / Groups | RBAC |
| "attributes" / "AND conditions" / "time of day" / "location" / "Zero Trust" | 🟣 AWS IAM / Cloud / Multiple conditions | ABAC |