AP® Cybersecurity · Unit 5: Securing Applications and Data · Topic 5.2
Protecting Applications and Data: Managerial Controls and Access Controls
Organizations protect information by pairing clear decisions about people, responsibilities, and risk with technical rules that allow the right subject to perform the right action on the right resource—under approved conditions and with an auditable record.
Managerial controls turn security goals into repeatable work
Managerial controls, often called administrative controls, are the governance decisions, documents, roles, training, reviews, and plans that direct how an organization manages cybersecurity risk. They establish what must be protected, who is responsible, which behavior is acceptable, how exceptions are approved, and how results are checked.
Direct and govern
Policies, risk assessments, training, audits, vendor requirements, incident plans, data ownership, and approval workflows.
Enforce and observe
Identity systems, MFA, permissions, encryption, application controls, backups, logging, alerts, and session controls.
Protect places and equipment
Locks, badges, cameras, secure storage, environmental controls, and restricted server rooms.
Control logic: policy states the outcome → a standard defines mandatory requirements → a procedure explains the steps → technology enforces and records → reviews test whether the result works.
| Document | Purpose | Student-friendly example |
|---|---|---|
| Policy | States high-level intent, scope, ownership, and required outcomes—the “what” and “why.” | Only authorized users may access student records. |
| Standard | Sets specific, mandatory, measurable requirements. | Administrative accounts must use approved multifactor authentication. |
| Procedure | Provides ordered instructions, responsible roles, evidence, and escalation—the “how.” | A help-desk checklist for verifying a recovery request and recording the change. |
| Guideline | Offers recommended, adaptable advice where judgment is allowed. | Prefer a separate browser profile for administrative work. |
Protect information through its entire lifecycle
Data governance assigns responsibility and rules from collection to secure disposal. Classification labels are organization-specific; the example below shows a common increasing-sensitivity pattern, not a universal naming system.
| Class | Possible examples | Handling focus |
|---|---|---|
| Public | Published calendars or approved marketing material | Integrity, accessibility, approved publication, and version control still matter. |
| Internal | Staff directories or routine operating documents | Limit to the organization; use approved collaboration and sharing settings. |
| Confidential | Student records, contracts, employee files | Need-to-know access, encryption, monitoring, and controlled external sharing. |
| Restricted | Authentication secrets or especially sensitive regulated records | Strongest approvals, isolation, limited privileged access, detailed auditing, and tightly controlled disposal. |
Ownership and handling
- A data owner is accountable for classification, permitted use, and access decisions.
- A custodian or steward operates safeguards and follows the owner’s requirements.
- Users must collect, view, share, store, and transmit data only for approved purposes.
- Handling rules should cover copying, printing, export, cloud sharing, mobile access, and backups.
Retention and disposal
- Keep data for a defined business, legal, or learning purpose—not forever by default.
- Place records on approved legal or investigative hold when required.
- Dispose of paper, media, accounts, exports, and backup copies through approved methods.
- Record disposal where accountability or compliance requires evidence.
Core program controls
Use and development rules
Acceptable-use policies define permitted use of accounts, devices, networks, apps, and data. Application-security policies cover approved development, testing, dependencies, secrets, changes, and release responsibilities.
People and awareness
Everyone receives baseline training; developers, database administrators, help-desk staff, managers, and data owners receive role-based training for their risks and authority. Users report mistakes and suspicious events promptly.
Assess and improve
Risk assessments identify assets, threats, vulnerabilities, likelihood, and impact. Audits examine evidence, compliance reviews compare obligations, and remediation tracks gaps to closure.
Controlled change
Change management documents the request, risk, testing, approval, schedule, rollback plan, implementation, and review. Emergency changes should be recorded and reviewed afterward.
Third-party access
Vendors and contractors receive sponsored, scoped, time-limited accounts; appropriate agreements, MFA, monitoring, periodic review, and prompt revocation reduce supply-chain and offboarding risk.
Resilience plans
Incident response contains and investigates harm. Backups preserve recoverable data, disaster recovery restores technology, and business continuity maintains critical services during disruption. Plans and restores must be tested.
Access control: who may do what, to which resource, and when?
Access control is the set of policies and mechanisms that mediate requests to applications, databases, files, APIs, and systems. A complete decision considers the subject, resource, requested action, context, and applicable policy. Successful sign-in does not automatically justify access to every record or function.
- IdentificationA subject claims an identity, such as a username, employee ID, service account, or device identity.
- AuthenticationThe system verifies the claim with an authenticator such as a passkey, security key, password, or biometric-backed device credential.
- AuthorizationPolicy decides which actions the authenticated subject may perform on a specific resource under current conditions.
- AccountingLogs record important activity—who accessed what, when, from where, and what changed—supporting accountability and investigation.
Access decision: allow only if authenticated identity + authorized role or rule + approved context + required purpose all satisfy policy; otherwise deny and record the event.
Access-control models and building blocks
| Model | How decisions are made | Practical example |
|---|---|---|
| Role-based access control (RBAC) | Permissions are assigned to job or functional roles; users receive appropriate roles. | A “registrar” role can update enrollment while a “teacher” role can view assigned class rosters. |
| Rule-based access control | System-wide rules evaluate conditions such as resource type, network, device state, location, or time. | A rule blocks confidential-data downloads from unmanaged devices. |
| Discretionary access control (DAC) | An object owner can grant or revoke access within organizational policy. | The owner of a shared project file invites a classmate as a viewer or editor. |
| Mandatory access control (MAC) | A central authority assigns labels and clearances; users cannot freely override the policy. | A highly controlled system permits access only when an approved subject clearance satisfies the resource label. |
Real systems often combine models. For example, a cloud application might use RBAC for job functions, rules for trusted devices, and owner-managed sharing for a low-risk folder.
Accounts and groups
An account represents a human, service, or device identity. Groups make it easier to assign common access, but nested or forgotten group memberships can hide excessive permissions.
Roles and permissions
A permission allows an action such as read, create, update, approve, export, or delete. Roles bundle permissions around defined responsibilities instead of assigning them one person at a time.
Access-control lists
An ACL is attached to a resource and lists which users, groups, or other principals are allowed or denied specific actions. ACL complexity makes documentation and review essential.
Manage access from request to revocation
- Request and approveConfirm identity, owner, purpose, role, data scope, duration, approver, and separation-of-duties constraints.
- Provision and protectCreate a unique account, assign minimum access, enroll strong authentication, set session controls, and notify the user of responsibilities.
- Review and adjustMonitor use, investigate alerts, certify access periodically, remove unused privileges, and change rights promptly after role changes.
- Disable and preserveDeactivate access promptly when no longer needed, revoke sessions and tokens, transfer ownership safely, retain required records, and log completion.
Stop privilege creep
Privilege creep occurs when access accumulates after projects, transfers, temporary duties, or group changes. Owners and managers should compare current access with current work, remove stale roles, find dormant accounts, and investigate conflicts. Job rotation can reveal hidden dependencies or irregularities but does not replace least privilege.
Protect authentication and sessions
Use MFA appropriate to risk, short and reasonable idle timeouts for sensitive functions, reauthentication for high-impact actions, secure logout and token revocation, login and recovery alerts, and a recovery process resistant to social engineering. Recovery must not be an easier bypass around strong sign-in.
Separate duties
Divide critical steps so one person cannot request, approve, perform, and hide a sensitive action alone. Examples include separating developer and production-release approval, or payment creation and approval. Check whether combined roles create a conflict.
Log, monitor, review
Collect useful identity, application, database, administrative, export, sharing, and recovery events. Protect logs from alteration, synchronize time, limit log access, define retention, alert on meaningful patterns, and have humans investigate context rather than treating every alert as proof.
Real-world decisions
School information system
A substitute teacher needs a class roster for two weeks. The school sponsor approves a temporary teacher role limited to assigned classes, requires MFA, records access, and schedules automatic expiration. The substitute cannot export the full student database.
Business cloud application
An employee moves from sales to finance. The identity workflow removes sales groups before granting the approved finance role. A conflict check keeps invoice creation and payment approval separate; a later access review verifies that old sharing links and permissions are gone.
Database support vendor
A contractor receives a named, time-bound support account for one database and an approved maintenance window—not a shared administrator password. Strong authentication, command and access logs, a company sponsor, and immediate deactivation after the work provide layered accountability.
Shared research files
The data owner classifies a folder as confidential, approves a limited project group, blocks public links, and sets a retention date. When the project ends, the owner reviews final records, removes collaborators, archives required material, and securely disposes of temporary copies.
Watch: managerial and access controls
As you watch, identify one managerial decision, one technical enforcement mechanism, and one record that could prove the control is operating.
Knowledge check: who gets access—and why?
What the quiz covers
These 10 questions test policy hierarchy, the four access-control steps, least privilege, RBAC and MAC, separation of duties, privilege creep, third-party access, account recovery, logging, and defense in depth.
How it works
Answer every question, then select Check my score. You will see one correct answer per question, feedback explaining why, a score out of 10, and a restart option.
Study toolkit
Use three questions to analyze any case: Who owns the decision? How is the decision enforced? What evidence proves it happened? For more study support, explore computer science resources, review this introduction to cryptography, or use these AP® self-study strategies.
Entitlement
A permission or access right assigned to a subject, directly or through a group or role.
Provisioning
Creating an account and assigning approved access; deprovisioning removes or disables it.
Privilege creep
Accumulation of access that is no longer justified by current responsibilities.
Access review
A documented check that accounts, roles, groups, and permissions remain appropriate.
Session
The period of authenticated interaction maintained after sign-in, usually represented by a protected session secret or token.
Business continuity
Planning that keeps critical operations functioning during and after disruption.
Frequently asked questions
1. What is the difference between a managerial control and an access control?
A managerial control directs risk decisions through policies, ownership, training, assessments, and reviews. An access control mediates who or what may use a resource and which action is allowed. Managerial requirements usually guide the technical access rules.
2. Are policies, standards, procedures, and guidelines interchangeable?
No. A policy states intent and required outcomes; a standard gives mandatory measurable requirements; a procedure gives ordered implementation steps; and a guideline offers recommended, adaptable advice. Organizations may use different templates, but these distinctions help clarify authority.
3. What are identification, authentication, authorization, and accounting?
Identification is the identity claim, authentication verifies that claim, authorization decides allowed actions, and accounting records relevant activity for accountability, monitoring, and investigation.
4. How do least privilege and need to know differ?
Least privilege limits a subject’s permissions to the minimum needed for work. Need to know limits access to the specific information needed for an approved purpose. They overlap, but one emphasizes capabilities and the other emphasizes information relevance.
5. What is the difference between RBAC and rule-based access control?
RBAC connects permissions to job or functional roles. Rule-based access control evaluates system-wide conditions such as device state, resource label, time, or network. A system may apply both: a user must have the right role and satisfy contextual rules.
6. How do DAC and MAC differ?
In discretionary access control, an object owner can usually delegate access within policy. In mandatory access control, a central authority applies labels and clearances that ordinary users cannot freely override. The suitable model depends on the resource and assurance needs.
7. Why are privileged accounts especially risky?
They can change security settings, manage identities, access sensitive data, or affect many systems. Separate admin accounts, strong authentication, limited duration and scope, approvals, protected recovery, monitoring, and individual accountability reduce the danger.
8. What causes privilege creep?
Temporary projects, department transfers, nested groups, duplicate accounts, and incomplete offboarding can leave old permissions behind. Current-role checks, periodic reviews, automatic expiration, manager and owner certification, and prompt deactivation help remove them.
9. Why are logs not enough by themselves?
Logs must capture useful events, have trustworthy timestamps, resist alteration, follow retention rules, and be reviewed. Alerts can be false or lack context, so trained people and documented investigation procedures remain necessary.
10. How should third-party application access be controlled?
Use a named sponsor, documented purpose, contractual requirements, a unique least-privileged account, MFA, restricted resources and times, logging, regular review, and a firm expiration or revocation process. Avoid permanent shared credentials.
Trusted references
- NIST Cybersecurity Framework (CSF) 2.0—risk governance and cybersecurity outcomes.
- NIST Role-Based Access Control FAQ—users, roles, permissions, and constraints.
- NIST SP 800-63B-4—authentication, authenticator management, sessions, and account recovery.
AP® is a trademark registered by the College Board, which is not affiliated with and does not endorse this page. This lesson is for defensive education; follow your organization’s policies and obtain authorization before changing accounts, permissions, or security configurations.
