Category: Identity & Access Management

Authorization

Also known as: Authorisation

Simply put

Authorization is the process of granting a user, program, or process permission to access specific resources such as a document, database, application, or physical location. It determines what an already-identified entity is allowed to do, and is usually governed by an access policy set by someone with the authority to define those permissions.

Formal definition

Authorization is the function of specifying and enforcing rights and privileges for accessing resources, typically implemented through an access policy that matches users, programs, or processes to permitted actions and assets. It encompasses both the granted access privileges and the act of granting them. Authorization follows authentication in the access control flow: authentication establishes identity, while authorization determines the scope of permitted access for that identity. In NIST usage, authorization was formerly referred to as accreditation.

Why it matters

Authorization is the control point that determines what an authenticated identity can actually do inside an environment. Without well-defined authorization, verifying who someone is accomplishes little, because identity alone does not constrain access to sensitive documents, databases, applications, or physical locations. A robust access policy governed by someone with the authority to define permissions is what translates identity into appropriately scoped access, and weak or overly broad authorization is a frequent root cause of excessive access that expands the impact of a compromised account.

For security leaders, authorization is fundamentally a governance and business risk concern, not merely a technical setting. Deciding who is permitted to access which resources requires a policy owned by a person with authority to grant those privileges, and it depends on the organization understanding its own data, systems, and roles. Because authorization follows authentication in the access control flow, gaps here can undermine otherwise strong identity controls: a valid identity mapped to inappropriate privileges still results in inappropriate access.

A virtual CISO can help an organization establish and mature the access policies that drive authorization, but accountability for approving and maintaining those permissions typically remains with the client organization and its officers. The effectiveness of any authorization scheme depends heavily on organizational maturity, cooperation from stakeholders who own resources, and clear definition of who holds the authority to grant access.

Who it's relevant to

Security and IAM leaders

Those responsible for identity and access management rely on authorization to ensure that authenticated identities receive only the access appropriate to their role. They own or oversee the access policies that map users, programs, and processes to permitted resources, and they must keep authentication and authorization functions distinct within the access control flow.

Resource and data owners

Individuals with the authority to define permissions are central to authorization, because the process starts with policy set by someone empowered to grant those privileges. Their cooperation is essential, since authorization decisions depend on people who understand and own the documents, databases, applications, or physical locations being protected.

Virtual and fractional CISOs

A vCISO or fractional CISO can advise on and help develop the access policies and governance that drive authorization, framing it as a business risk and governance function rather than a purely technical task. They typically guide policy and structure while legal and organizational accountability for approving and maintaining permissions remains with the client organization and its officers. Their impact depends on organizational maturity and access to the stakeholders who own the resources.

Buyers evaluating security leadership services

Organizations engaging fractional or virtual security leadership benefit from understanding that establishing authorization policies is a governance activity that requires internal stakeholder involvement. A vCISO engagement can support the design and maturation of these controls, but the value realized depends on defined scope, client cooperation, and clarity about who holds the authority to grant access.

Inside Authorization

Access Rights Determination

The process of deciding what actions an authenticated user, system, or service is permitted to perform, and what resources they may reach. Authorization occurs after authentication has established identity, and governs the boundaries of that identity's permitted activity.

Access Control Models

Structured approaches for granting permissions, such as role-based access control (RBAC), attribute-based access control (ABAC), and discretionary or mandatory access control. The appropriate model typically varies by organizational size, complexity, and risk profile.

Least Privilege Principle

The practice of granting users and systems only the minimum access necessary to perform their functions. This is a foundational governance concept that a virtual CISO often advises on, though implementation depends on client tooling and cooperation.

Policy Definition and Governance

The documented rules and standards that specify who may access what and under what conditions. A vCISO typically helps define and direct these policies at a strategic level rather than administering the underlying access management tools directly.

Segregation of Duties

The distribution of authority so that no single individual controls all stages of a critical process. This reduces fraud and error risk and is frequently referenced in compliance readiness efforts for frameworks such as SOC 2 or ISO 27001.

Common questions

Answers to the questions practitioners most commonly ask about Authorization.

Isn't authorization the same thing as authentication?

No, and conflating the two is a common mistake an expert would correct. Authentication verifies who a user or system is, while authorization determines what that verified identity is permitted to do. A user can be successfully authenticated yet still be denied access to specific resources because authorization controls govern permissions rather than identity. Both are typically required, but they address distinct questions and are enforced through different mechanisms.

If we implement strong authorization controls, does that mean the vCISO is now accountable for who accesses what?

Generally no. A virtual CISO advises on and helps design authorization policies, access models, and governance, but legal and organizational accountability for access decisions typically remains with the client organization and its officers. Unless a contract explicitly assigns such accountability, the vCISO's role is to direct and guide authorization strategy rather than to assume liability for individual access grants or their consequences.

What authorization models might a virtual CISO recommend an organization consider?

Recommendations often depend on organizational maturity, complexity, and risk profile. Commonly discussed approaches include role-based access control, which grants permissions according to defined roles, and attribute-based access control, which evaluates attributes such as user, resource, and context. A vCISO may help an organization evaluate which model fits its needs, but implementation itself is typically carried out by internal teams or contracted operational resources rather than the vCISO directly.

How does the principle of least privilege relate to authorization?

Least privilege is a guiding principle often applied to authorization, meaning identities are granted only the access necessary to perform their functions and nothing more. In many engagements, a virtual CISO will advocate for least privilege as part of governance and risk reduction, help define policies that support it, and recommend periodic access reviews. The effectiveness of least privilege depends heavily on client cooperation and accurate role definitions.

Where do authorization controls typically fall in the scope of a vCISO engagement versus operational work?

A virtual CISO generally provides strategy, governance, and policy guidance for authorization, such as defining access management principles and reviewing the design of access controls. Hands-on tasks like configuring permissions in specific systems, administering identity tools, or executing access provisioning are typically out of scope unless explicitly contracted, and are usually handled by internal staff or other providers.

Do authorization frameworks or standards guarantee compliance with regulations?

No. Frameworks and standards that address access control can support compliance readiness, but implementing authorization controls does not by itself guarantee compliance or certification. A virtual CISO may help align authorization practices with the access-related expectations of standards an organization is pursuing, yet the outcome depends on scope, organizational maturity, and the specific requirements involved. Supporting readiness should be distinguished from asserting compliance.

Common misconceptions

Authorization is the same as authentication.

Authentication verifies who someone is, while authorization determines what they are allowed to do once verified. They are distinct control layers, and an expert would insist on treating them separately even though they often operate in sequence.

A virtual CISO configures and enforces authorization controls directly within systems.

A vCISO typically advises on and directs authorization strategy, policy, and governance, but hands-on tasks such as configuring identity and access management tools or administering permissions are generally out of scope unless explicitly contracted. Enforcement usually remains with the client's operational teams.

Strong authorization policies guarantee compliance or prevent breaches.

Well-designed authorization supports readiness for frameworks and can reduce risk, but it does not by itself guarantee certification or breach prevention. Effectiveness depends on organizational maturity, consistent enforcement, and access to the stakeholders responsible for implementation.

Best practices

Apply the principle of least privilege when defining access, granting only the minimum permissions necessary for a given role or function.

Choose an access control model, such as RBAC or ABAC, that fits the organization's size, complexity, and risk profile rather than defaulting to a single approach.

Document authorization policies clearly and align them with governance objectives so accountability for access decisions remains with the client organization and its officers.

Implement segregation of duties for critical processes to reduce the risk of fraud or error from concentrated authority.

Review and recertify access rights on a recurring basis to catch privilege creep, keeping in mind that consistent enforcement depends on client cooperation and appropriate tooling.

Clarify in the engagement scope whether the virtual CISO is advising on authorization strategy or is expected to perform hands-on configuration, and confirm that operational enforcement responsibilities are assigned to the appropriate internal teams.