It may be mandated, or company policy, but ultimately it's up to the pilots. Cockpits seem to have quite a bit of security since 9/11[1], with the ability of crew to enter after a 30 second delay if there is not a denial by someone within the cockpit, and the doors are supposedly rated to withstand a grenade.

As we've seen, a plane can be devastating when used as a weapon, so I think it is sensible to deny terrorists to the cockpit at the expense of the passengers. Theoretically, there are few situations where passengers can be forcibly restrained, since they should outnumber any people trying to seize the plane by quite a bit, passengers could (and have[2]) attempted to neutralize the threat themselves (as they understand the possible consequences of waiting out the situation in this era where the goal is not money, but chaos).

1: http://www.bbc.com/news/blogs-magazine-monitor-32070528

2: http://www.cnn.com/2004/US/07/22/911.flight.93/

The cockpit doors have been locked since Sept 12, 2001. It is impossible to open them from the outside without very heavy machinery that could not be operated by a passenger, and even then it can take over half an hour.

Even if we did away with security entirely and let people carry guns on board, there would be literally zero risk of a hijacked plane in the US thanks to the locked doors. (There might be other reasons not to do that, but hijacking fears are not one of them).

And even then, it's arguable that this would still be impossible. 9/11 happened because hijacking protocol never took into account the possibility that the hijackers would use the plane itself as a weapon. The people on the final hijacked plane on 9/11 did know this, because they received calls about the WTC, so they fought back and forced the plane to crash, thwarting the hijackers' plans.