DAC

{
  "id": "MLC-T-CYB-001200",
  "term": "DAC",
  "field": "Cybersecurity",
  "definition": "1. An access control policy that is enforced over all subjects and objects in an information system where the policy specifies that a subject that has been granted access to information can do one or more of the following: (i) pass the information to other subjects or objects; (ii) grant its privileges to other subjects; (iii) change security attributes on subjects, objects, information systems, or system components; (iv) choose the security attributes to be associated with newly-created or revised objects; or (v) change the rules governing access control. Mandatory access controls restrict this capability.\n\n2. A means of restricting access to objects (e.g., files, data entities) based on the identity and need-to-know of subjects (e.g., users, processes) and/or groups to which the object belongs. The controls are discretionary in the sense that a subject with a certain access permission is capable of passing that permission (perhaps indirectly) on to any other subject (unless restrained by mandatory access control).",
  "expansions": [
    "Discretionary Access Control"
  ],
  "references": [
    "NIST SP 800-53 Rev. 4 [Superseded]",
    "NIST SP 800-53 Rev. 4 [Superseded] from CNSSI 4009",
    "NIST CSRC Glossary"
  ],
  "url": "https://mlchart.com/terminology/cybersecurity/dac/"
}