Home › Identity & Access Management
Risk-Based Access Control Explained — Access Control Models (Part 7)
Identity & Access ManagementCISSP
Risk-Based Access Control is the most dynamic model in the access-control family — instead of reading permissions from a fixed policy, it calculates the risk of every request in real time and adapts the decision on the spot. In this final part of the series, we break down how the risk score works, the factors that feed it, and why adaptive step-up MFA and fraud detection are its signature use cases — all mapped to how the CISSP reference books actually treat it.
What you will learn
- What risk-based (adaptive) access control is and why it's the most dynamic model
- How the risk decision works: likelihood × impact compared to a threshold
- The four risk factors: user context, action severity, resource sensitivity, and risk history
- The learning loop — how past outcomes sharpen future risk estimates
- Real examples: step-up MFA, hospital ER vs pharmacy access, impossible-travel logins, and financial fraud detection
- Binary vs machine-learning implementations, and how it's enforced
- How risk-based differs from ABAC — recomputed risk vs static written policy
- Exam tips: when risk-based is the right answer (and when it isn't)