What is RBAC?
RBAC stands for Role-Based Access Control. It is an access management method in which users are granted access rights based on their role within the organisation.
Instead of assigning rights to individuals, you manage access by job function (e.g. operator, engineer, administrator).
RBAC is a widely used standard in both IT and OT and is recommended by, among others, ISO 27001, IEC 62443 and NIS2.
🎯 The aim of RBAC
- Limit excessive or unnecessary access rights
- Simplify management of access rights (through roles rather than individuals)
- Align access policy with functions and responsibilities
- Comply with security standards and audit requirements
- Support the “least privilege” principle
🔧 How does RBAC work?
RBAC works in 3 layers:
- Users → are assigned to a role
- Roles → represent a function group (e.g. Operator, Maintenance, Admin)
- Rights/permissions → are assigned to the role (e.g. read-only, modify, execute)
A user therefore gains access through their role, not directly.
🧱 Example: an OT environment
| Role | System access | Permitted actions |
|---|---|---|
| Operator | HMI, SCADA | View, operate buttons |
| Maintenance | PLCs, Historian, alarm system | Read, reset, run diagnostics |
| OT Engineer | SCADA, PLC, Historian, network configuration | Modify, upload, configure |
| Third party | Only via a jump server during pre-arranged time windows | Read-only or perform updates under supervision |
🧠 RBAC vs. ABAC vs. DAC
| Model | Access decision based on… | Use |
|---|---|---|
| RBAC | The user’s role or function | Standard in companies and OT environments |
| ABAC | Attributes (time, location, device, role) | More fine-grained, often in Cloud/access portals |
| DAC | Discretionary, decided by the owner | More flexible but harder to control |
✅ Benefits of RBAC
- Easy management of access rights per role
- Quick onboarding/offboarding of staff
- Less risk of overly broad access
- Easy integration with Active Directory or IAM
- Traceability and compliance for audits
🛠 Implementing RBAC
- Identify functions/roles within the organisation
- Determine which systems and actions are needed for each role
- Map users to roles
- Automate via IAM systems or directory services
- Monitor and review regularly (e.g. through Access Review)
📌 In summary
RBAC controls access based on function or role, not per individual — easy to manage, scalable and easy to audit.