What's the difference between Non-discretionary access control and Role-based Access Control? In CISSP book both mentioned in the different paragraph as in different entity. But In some other place (Cisco Learning Resource) it is said that,

Non-discretionary access control is also known as RBAC.

So is there any difference between them (if yes then what are they) or they are same?


RBAC can be discretionary access control, with anyone in the role granting it to you, or mandatory access, with only the security officer granting the role upon application from a manager.

The latter is more common, so the book probably just conflated the two.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.