Mandatory Access Control (MAC) is an access control model in which a central authority, not the individual data owner, decides who can reach a resource based on security labels. Every subject (a user or process) and every object (a file or device) carries a classification, and the system enforces access by comparing the two.
Because permissions are set by policy rather than by users sharing files at will, MAC is the strictest of the standard models. You see it in military and intelligence systems where a document marked Top Secret is unreadable by anyone cleared only to Secret, no matter who wants to share it. SELinux brings the same idea to Linux. The tradeoff is rigidity: MAC is administratively heavy and inflexible for fast-moving commercial environments, which is why most businesses default to role-based access control instead. Do not confuse MAC with discretionary access control, where owners grant permissions themselves.
How is mandatory access control tested on the CISSP?
It appears in Domain 5, Identity and Access Management. Expect questions that ask you to distinguish MAC from DAC, RBAC, and ABAC, and to recognize label-based enforcement and the Bell-LaPadula model as MAC concepts.