Access control (AC) family of NIST SP 800-53 Rev. 5: account management, access enforcement, information flow, least privilege, session controls, remote, wireless and mobile access, and use of external systems.
The access control policy and procedures control: who writes, approves and reviews the access control policy and its procedures, how often they are updated, and the documents assessors examine for the first control of the AC family.
Managing the full lifecycle of system accounts: permitted account types, account managers, approvals, provisioning and removal, monitoring, notifying managers when people leave or move, periodic account reviews, and the account lists assessors test.
How systems enforce approved logical access authorizations to information and resources, the access control models its enhancements describe (role-based, attribute-based, mandatory and discretionary), and how assessors test the enforcement mechanisms.
Controlling where information may flow inside a system and between connected systems, as distinct from who may access it, under defined flow control policies, plus 30 current enhancements on filters, domains and separation, only one of which (AC-4(4)) is in a baseline.
Separation of duties: identifying duties that must be split among different people and defining system access authorizations so that no single person can misuse privileges without collusion, with how assessors check role assignments.
Least privilege for users and processes: granting only the access needed for assigned tasks, plus the baseline enhancements on privileged accounts, privileged function logging, reviews of user privileges and blocking non-privileged users from privileged functions.
Limiting consecutive failed logon attempts within a time window and the automatic response when the limit is exceeded, such as account or node lockout, a delay or an administrator alert, and how assessors test lockout settings.
System use notification banners: what the logon notice must state, keeping it displayed until users acknowledge it, and the separate conditions for publicly accessible systems, with how assessors check banner content.
Showing users the date and time of their last logon when they log on successfully so they can spot unauthorized use, a control outside the SP 800-53B baselines, with enhancements for failed logons and account changes.
Capping the number of concurrent sessions per account or account type, a high baseline control typically applied to administrators and sensitive applications, and how assessors test session limits.
Device lock after a period of inactivity or on user request, held until the user authenticates again, plus the pattern-hiding display enhancement in the moderate and high baselines.
Automatically ending user logical sessions after defined conditions or trigger events, which the catalog distinguishes from SC-10 network disconnect, plus logout and timeout warning enhancements.
Identifying the few user actions allowed without identification or authentication, such as viewing a public website, and documenting the rationale for them in the system security plan.
Associating security and privacy attributes, such as labels, with information in storage, processing and transmission, defining permitted attributes and values, auditing attribute changes and reviewing attributes; not selected in any SP 800-53B baseline.
Remote access: usage restrictions, connection requirements and authorization for each type of remote access, plus the moderate baseline enhancements on monitoring, encryption, managed access points and remote privileged commands.
Wireless access: configuration and connection requirements and prior authorization for each type of wireless access, plus enhancements on authentication and encryption, disabling wireless capability, user configuration limits and antenna power.
Access control for organization-controlled mobile devices, including when they leave controlled areas: configuration and connection requirements, authorizing device connections, and the full device or container encryption enhancement.
Use of external systems that the organization does not control, such as personal devices or contractor systems: terms and conditions or asserted controls for access and processing, prohibited system types, and limits on authorized use.
Helping authorized users decide whether a sharing partner's access authorizations match the restrictions on information before sharing it, using defined circumstances and automated decision aids.
Controlling content on publicly accessible systems: designating and training who may post, reviewing content before posting and reviewing posted content regularly for nonpublic information to remove.
Protecting data storage objects such as database records and fields against unauthorized data mining with defined detection and protection techniques; not selected in any SP 800-53B baseline.
Making sure access control decisions (authorization decisions) are applied to each access request before enforcement, through procedures or mechanisms, including in distributed architectures; not in any SP 800-53B baseline.
Implementing a reference monitor for defined access control policies: a mechanism that is tamperproof, always invoked and small enough to be analyzed and tested; a design-level control outside the SP 800-53B baselines.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.