Discretionary Access Control (DAC) is an access control model in which the owner of a resource decides who may use it and what they may do with it. The standard file permissions on Windows and Unix or Linux are the everyday example: whoever owns a file sets the read, write, and execute rights and can pass those rights to other users at their own discretion.
DAC is flexible and easy to administer, which is exactly why it struggles at scale. Owners tend to grant more access than needed, permissions drift as files are copied and shared, and no central authority reviews who can reach what. Malware running as a user also inherits that user’s discretion, so it can hand out access the owner never intended. For environments that enforce strict classification, DAC alone is too loose and gets paired with or replaced by stronger models.
How is DAC tested on the CISSP?
DAC is core material in Domain 5 (Identity and Access Management). You should be able to contrast it with mandatory access control and role based access control, and know which environments suit each one. Review Domain 5: Identity and Access Management for the access control models.