Access Control

What is Access Control?

Access Control is the combined set of techniques, processes and rules with which an organisation determines who may access which systems, data or physical areas, which actions that person may perform there, and under what conditions. It protects against unauthorised access to data, networks and machinery, and records who did what. Access Control is the enforcement side of access management and identity management, and a core component of ISMS, ISO 27001, IEC 62443, Zero Trust and OT security.

🎯 Why is Access Control needed?

Without access control, anyone with a network connection or a key can do anything. Effective Access Control serves five goals:

• Confidentiality — only authorised users can see sensitive data, recipes or process settings
• Integrity — only those authorised may change a PLC program, a setpoint or a record
• Limited damage — least privilege keeps the impact of a stolen account, malware or human error small
• Accountability — Logging records who performed which action and when, which you need for investigations and audits
• Compliance — NIS2, ISO 27001, IEC 62443, GMP and GxP all require demonstrable access management

Access Control also supports segmentation between IT and OT: it determines not only which networks may talk to each other, but also which people and systems may cross a boundary.

🧠 How does Access Control work in four steps?

Every access decision runs through the same chain, often abbreviated as IAAA:

Authentication and authorisation are often confused. Authentication establishes the identity; authorisation determines the rights attached to that identity. An operator who logs in correctly is not thereby allowed to modify PLC logic. In network environments the same chain is called AAA (authentication, authorisation, accounting), for example in RADIUS and 802.1X.

Access Control comes in two complementary forms:

• Physical access control — who may enter a control room, server room, control cabinet or plant site? Means include keys, badge readers, biometrics, barriers and visitor registration.
• Logical access control — who may log on to systems, networks, files and applications, and what may they do there? Means include accounts, roles, ACLs, firewalls and NAC.

In OT both matter equally: anyone with physical access to a PLC or an engineering station can often bypass every logical control through a USB port or a programming cable.

🔧 Which Access Control models are there?

An access control model determines who sets the rules and what they are based on. The four classic models:

DAC and MAC were formally defined in the US Orange Book (TCSEC, 1983; adopted as DoD standard 5200.28-STD in 1985), with MAC building on the Bell-LaPadula model for classified information. RBAC goes back to a model by Ferraiolo and Kuhn (NIST, 1992) and was standardised in 2004 as ANSI INCITS 359. NIST described ABAC in 2014 in SP 800-162: access follows from a policy rule that combines attributes, for example “engineer, own plant, during an approved change, connecting from the jump server”.

In practice the models are combined. Most OT systems use RBAC as the basis, supplemented by context rules such as time windows or location. See also User-Based Access Control for access configured per individual user.

🔐 How does Access Control work in OT environments?

PLCs, SCADA servers, HMIs and engineering stations are vulnerable to unauthorised access, while availability and safety come first. That creates OT-specific tensions:

• Shared accounts — many HMIs run under a single operator account that stays logged in permanently. That is fast, but makes accountability impossible. NIST SP 800-82 recommends individual accounts; where that is not feasible, compensating controls are needed, such as restricted physical access to the control room and logging.
• No lockout on critical stations — an operator locked out during an upset because of too many failed login attempts is a safety risk. IEC 62443-3-3 requires that security measures do not block essential functions.
• Emergency access — there must be a documented, logged “break glass” procedure for when the normal path fails, for example a red envelope procedure.
• Legacy equipment — many controllers and protocols such as Modbus have no authentication at all. Access must then be enforced at network level with firewalls, VLANs and NAC.
• Suppliers — remote access runs through a VPN, a jump server or a bastion host, with MFA, temporary accounts and session recording.

What does IEC 62443 require?

IEC 62443-3-3 groups its system requirements into seven foundational requirements. Two of them deal directly with Access Control:

Which enhancements apply depends on the target security level (SL 1–4) of the zone. The partitioning into zones and conduits itself comes from IEC 62443-3-2; per zone and conduit you decide what level of access control is required.

🛠 How do you implement Access Control in practice?

A workable approach for a mixed IT/OT environment:

1. Inventory systems, accounts and access paths, including shared accounts and vendor default accounts.
2. Define roles (operator, shift supervisor, process engineer, maintenance, supplier) and record per role which actions are allowed.
3. Centralise identities in a separate OT domain in Active Directory or an IAM solution, kept apart from the office domain.
4. Secure privileged access with PAM: separate admin accounts, a password vault, just-in-time rights and session recording.
5. Enforce at network level with segmentation, firewall rules per conduit, 802.1X and NAC.
6. Manage joiners, movers and leavers: adjust rights immediately on a change of role or departure, including for contractors.
7. Review periodically — common practice is quarterly for administrator accounts and annually or semi-annually for regular accounts.

Which laws and regulations apply in the Netherlands and the EU?

• NIS2 explicitly names access control policies in Article 21(2)(i) and multi-factor authentication in Article 21(2)(j). In the Netherlands these obligations are implemented through the Dutch Cybersecurity Act (Cyberbeveiligingswet), not to be confused with the EU Cybersecurity Act on certification.
• ISO 27001:2022 covers access in Annex A controls 5.15 to 5.18 (access control policy, identity management, authentication information, access rights), 8.2 to 8.5 (privileged access rights, information access restriction, access to source code and secure authentication) and 7.2 (physical entry); ISO 27002 provides the guidance.
• GMP and GxP — the US 21 CFR Part 11 (§11.10(d) and (g)) and EU GMP Annex 11 require that only authorised persons use a computerised system and alter records.

🔄 How does Access Control relate to other concepts?

• IAM manages the lifecycle of identities and rights; Access Control is the moment those rights are enforced.
• Least Privilege is the design principle; Access Control is the mechanism that implements it.
• Zero Trust replaces trust based on network location with an access decision per request, often using ABAC and continuous verification.
• Defense in Depth uses Access Control as one layer alongside segmentation, hardening and monitoring.

✅ What does good Access Control deliver?

• Stronger cybersecurity — attackers and malware get less far with a compromised account
• Better compliance with NIS2, ISO 27001, IEC 62443, GMP and GxP
• Reduced impact during incidents thanks to least privilege
• Traceability of user actions for forensic and quality investigations
• Safe collaboration with external parties through temporary, controlled access

❓ Frequently asked questions

What is the difference between authentication and authorisation?

Authentication checks whether someone really is who they claim to be, for example with a password and MFA. Authorisation then determines which actions that authenticated user may perform. Access Control covers both, plus identification and the recording of actions.

Which Access Control model is used most?

RBAC is the most widely used Access Control model in businesses and industrial systems, because roles map well onto functions such as operator and engineer. ABAC is gaining ground in cloud and Zero Trust environments, where access also depends on context such as time, location and device status. Many organisations combine the two.

May an HMI use a shared operator account?

A shared operator account on an HMI is common, but it makes it impossible to trace who performed which action. IEC 62443-3-3 requires unique identification per person from security level 2 upwards. Where a shared account is unavoidable, you compensate with physical access control to the control room, logging and personal accounts for critical actions.

How often should access rights be reviewed?

Access rights are commonly reviewed every quarter for administrator and supplier accounts and at least annually for regular users. In addition, rights must be adjusted immediately when someone changes role or leaves. ISO 27001 requires periodic review in control 5.18, and under NIS2 you must be able to show that your access control policy works.

What is emergency access in OT?

Emergency access, also called break-glass access, is a predefined way to log on to an OT system during a fault or emergency when the normal access path does not work. The account is sealed or stored in a vault, every use is logged and reviewed afterwards, and the password is replaced after use.

Is physical access control part of cybersecurity?

Physical access control is an essential part of cybersecurity, especially in OT. Anyone who can physically reach a PLC, switch or engineering station can bypass logical controls through USB or a programming cable. ISO 27001 therefore includes physical as well as logical access controls, such as control 7.2 on physical entry.

📌 In summary

Access Control ensures that only the right people and systems, under the right conditions, gain access to your systems, data and premises, and records what they do there. In OT this means roles per function, personal accounts wherever possible, secured remote access and emergency procedures that never put the availability of the process at risk.