Example methods for controlling access of a terminal to a network and a network element are described. One example method includes detecting whether a target terminal is exposed to a security threat and sending a message to a storage function network element based on a detection result. The message includes device information and network access indication information, the device information indicates at least one terminal including the target terminal, and the network access indication information indicates that the at least one terminal is allowed or forbidden to access a network. Thus the security function network element outputs an allowed or forbidden indication to the storage function network element, and the storage function network element controls, based on the foregoing indication, access of the terminal to the network.