What is the difference between Zutritt, Zugang, and Zugriff (physical access, logical access, and data access)?
Zutritt is physical entry to a location, Zugang is logical access to a system, and Zugriff is permission to use specific data or functions.
* The three access layers — Zutritt (physical entry) → Zugang (logical login) → Zugriff (data permissions). *
These three German terms represent distinct layers of access control:
| Layer | German | English | Controls | Example |
|---|---|---|---|---|
| Zutritt | Zutritt | Physical access / entry | Doors, badges, guards, fences | Entering a server room |
| Zugang | Zugang | Logical access / login | Username/password, MFA, VPN | Logging into a workstation |
| Zugriff | Zugriff | Data access / permissions | ACLs, RBAC, file permissions | Reading a confidential document |
They build on each other:
- First you need Zutritt — physical access to the building/room
- Then you need Zugang — ability to log into a system
- Finally you need Zugriff — authorization to access specific resources
Key principle: Each layer should be independently controlled. Even if someone has physical access to a server room (Zutritt), they shouldn't automatically be able to log in (Zugang) or read all data (Zugriff).
Tip: Think Z-Z-Z from outside in: Zutritt (door) → Zugang (login) → Zugriff (data).
Go deeper:
Access control (Wikipedia EN) — physical vs logical access and the models (ACL, RBAC) that enforce each layer.