diff --git a/core/modules/field/tests/src/Unit/FieldStorageConfigAccessControlHandlerTest.php b/core/modules/field/tests/src/Unit/FieldStorageConfigAccessControlHandlerTest.php
new file mode 100644
index 0000000..4da8121
--- /dev/null
+++ b/core/modules/field/tests/src/Unit/FieldStorageConfigAccessControlHandlerTest.php
@@ -0,0 +1,168 @@
+<?php
+
+namespace Drupal\Tests\field\Unit;
+
+use Drupal\Component\Uuid\UuidInterface;
+use Drupal\Core\Cache\Context\CacheContextsManager;
+use Drupal\Core\Config\Entity\ConfigEntityTypeInterface;
+use Drupal\Core\DependencyInjection\Container;
+use Drupal\Core\Entity\EntityManagerInterface;
+use Drupal\Core\Entity\EntityStorageInterface;
+use Drupal\Core\Extension\ModuleHandlerInterface;
+use Drupal\Core\Session\AccountInterface;
+use Drupal\field\Entity\FieldStorageConfig;
+use Drupal\field\FieldStorageConfigAccessControlHandler;
+use Drupal\Tests\UnitTestCase;
+
+/**
+ * Tests the field storage config access controller.
+ *
+ * @group field
+ *
+ * @coversDefaultClass \Drupal\field\FieldStorageConfigAccessControlHandler
+ */
+class FieldStorageConfigAccessControlHandlerTest extends UnitTestCase {
+
+  /**
+   * The field storage config access controller to test.
+   *
+   * @var \Drupal\field\FieldStorageConfigAccessControlHandler
+   */
+  protected $accessControlHandler;
+
+  /**
+   * The mock account without field storage config access.
+   *
+   * @var \Drupal\Core\Session\AccountInterface
+   */
+  protected $anon;
+
+  /**
+   * The mock account with field storage config access.
+   *
+   * @var \Drupal\Core\Session\AccountInterface
+   */
+  protected $member;
+
+  /**
+   * The mocked test field storage config.
+   *
+   * @var \Drupal\field\FieldStorageConfigInterface
+   */
+  protected $fieldStorage;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp() {
+    parent::setUp();
+
+    $this->anon = $this->getMock(AccountInterface::class);
+    $this->anon
+      ->expects($this->any())
+      ->method('hasPermission')
+      ->will($this->returnValue(FALSE));
+    $this->anon
+      ->expects($this->any())
+      ->method('id')
+      ->will($this->returnValue(1));
+
+    $this->member = $this->getMock(AccountInterface::class);
+    $this->member
+      ->expects($this->any())
+      ->method('hasPermission')
+      ->will($this->returnValueMap([
+        ['administer node fields', TRUE],
+      ]));
+    $this->member
+      ->expects($this->any())
+      ->method('id')
+      ->will($this->returnValue(2));
+
+    $storageType = $this->getMock(ConfigEntityTypeInterface::class);
+    $storageType
+      ->expects($this->any())
+      ->method('getProvider')
+      ->will($this->returnValue('field'));
+    $storageType
+      ->expects($this->any())
+      ->method('getConfigPrefix')
+      ->will($this->returnValue('field.storage'));
+
+    $entityType = $this->getMock(ConfigEntityTypeInterface::class);
+    $entityType
+      ->expects($this->any())
+      ->method('getProvider')
+      ->will($this->returnValue('node'));
+    $entityType
+      ->expects($this->any())
+      ->method('getConfigPrefix')
+      ->willReturn('node');
+
+    $entityManager = $this->getMock(EntityManagerInterface::class);
+    $entityManager
+      ->expects($this->any())
+      ->method('getDefinition')
+      ->willReturnMap([
+        ['field_storage_config', TRUE, $storageType],
+        ['node', TRUE, $entityType],
+      ]);
+    $entityManager
+      ->expects($this->any())
+      ->method('getStorage')
+      ->willReturnMap([
+        ['field_storage_config', $this->getMock(EntityStorageInterface::class)],
+      ]);
+
+    $module_handler = $this->getMock(ModuleHandlerInterface::class);
+    $module_handler
+      ->expects($this->any())
+      ->method('getImplementations')
+      ->will($this->returnValue([]));
+    $module_handler
+      ->expects($this->any())
+      ->method('invokeAll')
+      ->will($this->returnValue([]));
+
+    $this->accessControlHandler = new FieldStorageConfigAccessControlHandler($storageType);
+    $this->accessControlHandler->setModuleHandler($module_handler);
+
+    $container = new Container();
+    $container->set('entity.manager', $entityManager);
+    $container->set('uuid', $this->getMock(UuidInterface::class));
+    $container->set('cache_contexts_manager', $this->prophesize(CacheContextsManager::class));
+    \Drupal::setContainer($container);
+
+    $this->fieldStorage = new FieldStorageConfig([
+      'field_name' => 'test_field',
+      'entity_type' => 'node',
+      'type' => 'boolean',
+      'id' => 'node.test_field',
+      'uuid' => '6f2f259a-f3c7-42ea-bdd5-111ad1f85ed1',
+    ]);
+  }
+
+  /**
+   * Asserts correct field storage config access grants.
+   */
+  public function checkAccess($operation, $viewer) {
+    return $this->accessControlHandler->access($this->fieldStorage, $operation, $viewer);
+  }
+
+  /**
+   * Ensures field storage config access is working properly.
+   */
+  public function testFieldStorageConfigAccess() {
+    $this->assertFalse($this->checkAccess('view', $this->anon));
+    $this->assertFalse($this->checkAccess('update', $this->anon));
+    $this->assertFalse($this->checkAccess('delete', $this->anon));
+
+    $this->assertTrue($this->checkAccess('view', $this->member));
+    $this->assertTrue($this->checkAccess('update', $this->member));
+    $this->assertTrue($this->checkAccess('delete', $this->member));
+    $this->fieldStorage->setLocked(TRUE)->save();
+    $this->accessControlHandler->resetCache();
+    $this->assertFalse($this->checkAccess('delete', $this->member));
+  }
+
+}