A condition existing when access control is applied to all users and components of an information system (IS. )