DAC, MAC, RBAC, and ABAC

ISC2 Certified in Cybersecurity CC

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Official 2026 CC Exam Facts and Timeline CAT Format and Beginner Security Judgment Domain Map and Time Allocation 30, 60, and 90 Day Study Plan with Readiness Thresholds

2 Domain 1: Security Principles (24%)

CIA Triad as a Practical Decision Tool Authentication, Authorization, Accounting, and Non-Repudiation Privacy in the CC Outline Beginner Security Decision Scenarios AI Security in Security Principles

3 Domain 1: Risk Management and Security Controls

Risk Identification in Business Context Risk Management Processes Risk Treatment Decisions Security Controls: Technical, Administrative, and Physical

4 Domain 1: Governance, Ethics, Policy, and Privacy

Governance and the ISC2 Code of Ethics Policies, Procedures, Standards, Laws, and Regulations Privacy and AI Governance Due Care, Due Diligence, and Governance Decisions

5 Domain 1: Physical Security Controls

Physical Controls and Their Monitoring Tailgating and Physical Penetration Testing

6 Domain 2: Security Governance - Business Continuity

Business Continuity (BC)

7 Domain 2: Security Governance - Disaster Recovery

Disaster Recovery (DR) Redundancy in Business Continuity and Disaster Recovery

8 Domain 2: GRC Planning

GRC Planning: Purpose, Importance, and Tools

9 Domain 2: Measuring Cybersecurity Effectiveness

Security Metrics, KRIs, and Dashboards AI Security in Governance, Awareness, and Continuity

10 Domain 2 and Domain 5: Security Awareness and Triage

Security Awareness and Organizational Culture Phishing and Password Protection Security Event Triage and Human Review

11 Domain 3: Identity Lifecycle Management

Identification, Authentication, Authorization, and Accountability Multi-Factor Authentication and Password Protection Provisioning, Deprovisioning, and Access Reviews Service Accounts and AI Bots in Identity Management AI Bots and Service Accounts in Identity Management

12 Domain 3: Logical Access Controls

Least Privilege and Separation of Duties DAC, MAC, RBAC, and ABAC

13 Domain 4: Networking Fundamentals

Network Models and IP Addressing Firewalls: Ports and Applications Virtual Private Networks (VPN) Wireless Networks and Embedded Systems

14 Domain 4: Network Security Architecture and Cloud Security

Network Segmentation Defense in Depth and Zero Trust Cloud Characteristics and Shared Security Model Cloud Service Models, Deployment Models, and Shared Security AI in Network Security and Cloud Hosting

15 Domain 5: Incident Response

Incident Response (IR) and the Incident Response Plan Preparing the Incident Response Plan Incident Response Exercises and Tabletops AI in Security Operations and Incident Response

16 Domain 5: Security Monitoring

Logging and Monitoring Security Events

17 Domain 5: Threat Actors and Threat Intelligence

Threat Actors, Threat Intelligence, and Frameworks

18 Domain 5: Data Security

Encryption and Hashing for Data Security Data Handling: Classification, Labeling, Masking, and Sanitization Security of the AI Workspace

19 Domain 5: Asset Protection

Configuration and Change Management Change Management and Asset Protection Asset Lifecycle and End-of-Life Management

20 Domain 5: Data Handling Policy

Data Handling Policy and Classification

21 Domain 5: Security Testing

Security Readiness, Application, and Physical Testing

22 Integrated CC Scenario Labs

Risk and Control Selection Drill Continuity, Recovery, and Response Drill Access Control Design Drill Segmentation and Triage Drill

23 Final 14-Day Review and Exam Readiness

CAT Pacing and 100-125 Item Strategy Missed-Question Notebook and Domain Repair Exam Day Logistics and Rescheduling After Passing: AMF and CPE

DAC, MAC, RBAC, and ABAC

Key Takeaways Explain This Topic AI

Discretionary access control (DAC) lets the object owner decide who else may access it; identity and ownership drive the decision.

Mandatory access control (MAC) enforces central labels and clearances that users cannot override at their discretion.

Role-based access control (RBAC) attaches permissions to roles (job functions) and assigns users to roles, which scales better than per-user grants.

Attribute-based access control (ABAC) evaluates attributes of subject, object, action, and environment such as department, device posture, location, and time.

Real systems blend models, so exam items ask for the model that drives the main access decision in the scenario.

Last updated: October 2026

Key Concepts

Access control models are patterns for making authorization decisions. This section asks you to recognize the model that fits a scenario, not to recite theory. For every model, ask three questions: who controls the permission, what information drives the decision, and how flexible is the rule?

Discretionary access control (DAC) gives the owner of an object discretion to share it. A document owner grants a colleague read or edit rights to a file. DAC underlies operating-system file permissions, shared drives, and most cloud collaboration tools. It is flexible and user-friendly, but that very flexibility is its weakness: a user can over-share a sensitive file or grant edit when read would do. A useful cue is owner decides .

Mandatory access control (MAC) is centralized and rigid. Access is governed by labels, classifications, and clearances that ordinary users cannot change. A document labeled Secret is readable only by subjects holding Secret clearance and a valid need-to-know. The owner cannot simply decide to share a Top Secret file with someone uncleared. MAC is associated with military, intelligence, and highly regulated environments. Keyword: labels and clearances enforced by the system .

Role-based access control (RBAC) assigns permissions to roles that represent job functions, then assigns users to roles. A hospital may define roles such as emergency nurse, attending physician, billing clerk, pharmacist, and system administrator. RBAC scales: hiring a new billing clerk means assigning one role, not hand-picking dozens of permissions. It must be governed, though. Roles that are too broad over-grant; too many tiny roles create role sprawl that nobody can audit. Good RBAC maps roles to real duties, separates conflicting responsibilities, and is reviewed periodically. Keyword: job function determines permissions .

Attribute-based access control (ABAC) decides using attributes of the subject, object, action, and environment: department, employment status, project code, data classification, device compliance, network location, time of day, or transaction amount. An ABAC rule might allow a claims adjuster to approve claims only for assigned regions, from a managed device, during business hours, below a dollar threshold. ABAC is powerful for context but depends on accurate attributes and well-tested policies. Keyword: context and conditions .

Most production systems combine models. A file-sharing app may use DAC when a user shares a document, RBAC for administrator privileges, and ABAC to block downloads from unmanaged devices. For exam purposes, identify the model that drives the main access decision the question describes.

Exam Application

Use this quick decision table to match clues to models:

• Scenario clue Likely model
• Owner decides who can access a file DAC
• Classification labels and clearances control access MAC
• Job function or title determines permissions RBAC
• Time, location, device posture, or data tag affects access ABAC

Walk four micro-cases. A project manager creates a folder and invites two contractors — the owner chose, so DAC . A report labeled Confidential is readable only by cleared personnel and the user cannot relabel it — system-enforced labels, so MAC . All help-desk analysts can reset passwords but cannot approve payments because they hold the help-desk role — RBAC . Access is allowed only when the analyst is on the corporate network using a compliant laptop during business hours — conditional context, so ABAC .

Common traps: candidates pick MAC whenever they see the word "classification," but if a user chose to share, it is still DAC. They pick RBAC whenever a job title appears, but if the decisive factor is device or time, it is ABAC. And single sign-on (SSO) and multifactor authentication (MFA) are authentication mechanisms, not access-control models — they are tempting distractors precisely because they are not models at all.

Finally, match the model to the business need rather than the most technical-sounding option. DAC is flexible and collaborative, MAC is strict and consistent for classified data, RBAC is manageable and scalable for job functions, and ABAC is adaptive to risk and context. The strongest answer reflects which property the scenario actually requires.

Comparing the Models Head to Head

When two options seem plausible, compare the models on who controls the decision and what it costs to administer:

• Model Who decides Flexibility Main weakness
• DAC The object owner High Over-sharing; inconsistent decisions
• MAC Central authority via labels Low Rigid; heavy to administer
• RBAC Role design + role assignment Medium Role sprawl; broad roles over-grant
• ABAC Policy engine evaluating attributes Very high Depends on accurate attributes and tested rules

Notice the trade-off the table exposes: as control moves from the individual owner (DAC) toward central policy (MAC, ABAC), consistency improves but flexibility and ease of use drop. RBAC sits in the practical middle, and it is often combined with ABAC conditions for sensitive actions.

A common confusion is rule-based access control , sometimes also abbreviated in ways that look like RBAC. Rule-based control applies the same fixed rules to everyone, such as a firewall permitting traffic only on specific ports regardless of who sends it. It is not driven by job role, so do not confuse it with role-based access control even though the acronyms collide. ABAC generalizes rule-based logic by letting the rules reference rich attributes about the subject, object, and environment.

One more practical point: RBAC simplifies the joiner-mover-leaver lifecycle. When someone is hired, they receive a role; when they transfer, the old role is removed and a new one assigned; when they leave, the role assignment is revoked and access disappears at once. Managing this through roles is far less error-prone than editing thousands of individual permissions, which is precisely why per-user grants tend to rot into privilege creep while well-governed roles do not. Match the model to whether the scenario emphasizes owner control, classification, job function, or context, and the right answer follows.

Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomain 3.2 (access control models), checked 2026-10-22.