Access control
Policies and technical mechanisms that restrict who can access information assets, systems, and data — typically including identity provisioning, authentication, authorization, periodic access reviews, and deprovisioning.
In practice
In a SaaS environment, access control means every human and service identity lives in one identity provider with single sign-on, multi-factor authentication is enforced on production and admin systems, and access is granted through named roles rather than one-off requests. Quarterly access reviews produce a dated record naming the reviewer, the population reviewed, and any accounts changed or removed — not just a completed calendar reminder.
Common confusion
Teams often conflate access control with authentication alone, treating MFA enrollment as sufficient evidence on its own. Auditors expect authentication (proving identity), authorization (what that identity can do), and provisioning/deprovisioning (when access starts and stops) as three distinct, separately evidenced processes — a login screen with MFA says nothing about whether a departed contractor's account was disabled on their last day.