A method and system for securing access to configuration information stored in universal plug and play data models are provided. The method includes receiving a request to operate on at least one node of a data model from a Control Point (CP), where the data model includes a plurality of nodes and each of the plurality of nodes represents configuration information, determining a role associated with the CP, determining whether the role of CP is in a recommended role list, allowing, if the role is present, the CP to operate on the at least one node, and determining, if the role is not present, whether the CP has a role appropriate for operating on the at least one node based on ACL data associated with the at least one node. Accordingly, the CP is allowed to operate on the at least one node or an error message is returned on a display of the CP.