Appendix B: NIST 800-53 Controls Low Moderate High Access Controls AC-1 The organization develops, disseminates, and Access Control Policy and reviews/updates [Assignment: organization-defined Procedures frequency]: A formal, documented access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Formal, documented procedures to facilitate the implementation of the access control policy and associated access controls. AC-2 The organization manages information system (1) The organization employs automated mechanisms to Account Mgmt accounts, including: support the management of information system Identifying account types (i.e., individual, group, accounts system, application, guest/anonymous, and (2) The information system automatically terminates temporary); temporary and emergency accounts after Establishing conditions for group membership; [Assignment: organization-defined time period for Identifying authorized users of the information each type of account]. system and specifying access privileges; (3) The information system automatically disables Requiring appropriate approvals for requests to inactive accounts after [Assignment: organization establish accounts; defined time period]. Establishing, activating, modifying, disabling, and (4) The information system automatically audits account removing accounts; creation, modification, disabling, and termination Specifically authorizing and monitoring the use of actions and notifies, required, appropriate guest/anonymous and temporary accounts; individuals. Notifying account managers when temporary accounts are no longer required and when information system users are terminated, transferred, or information system usage or changes; Deactivating: (i) temporary accounts that are no longer required; and (ii) accounts of terminated or transferred users; Granting access to the system based on: (i) a valid access authorization; (ii) intended system usage; and (iii) other attributes required by the organization or associated missions/business functions; and Reviewing accounts [Assignment: frequency]. AC-3 The information system enforces approved Access Enforcement authorizations for logical access to the system in accordance with applicable policy. AC-4 The information system enforces approved authorizations for Information Flow controlling the flow of information within the system and Enforcement between interconnected systems in accordance with applicable policy.
Appendix B: NIST 800-53 Controls Low Moderate High Access Controls AC-1 Access Control Policy and Procedures The organization develops, disseminates, and reviews/updates [Assignment: organization-defined frequency]: A formal, documented access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Formal, documented procedures to facilitate the implementation of the access control policy and associated access controls. AC-2 Account Mgmt The organization manages information system accounts, including: Identifying account types (i.e., individual, group, system, application, guest/anonymous, and temporary); Establishing conditions for group membership; Identifying authorized users of the information system and specifying access privileges; Requiring appropriate approvals for requests to establish accounts; Establishing, activating, modifying, disabling, and removing accounts; Specifically authorizing and monitoring the use of guest/anonymous and temporary accounts; Notifying account managers when temporary accounts are no longer required and when information system users are terminated, transferred, or information system usage or changes; Deactivating: (i) temporary accounts that are no longer required; and (ii) accounts of terminated or transferred users; Granting access to the system based on: (i) a valid access authorization; (ii) intended system usage; and (iii) other attributes required by the organization or associated missions/business functions; and Reviewing accounts [Assignment: frequency]. (1) The organization employs automated mechanisms to support the management of information system accounts (2) The information system automatically terminates temporary and emergency accounts after [Assignment: organization-defined time period for each type of account]. (3) The information system automatically disables inactive accounts after [Assignment: organization defined time period]. (4) The information system automatically audits account creation, modification, disabling, and termination actions and notifies, required, appropriate individuals. AC-3 Access Enforcement The information system enforces approved authorizations for logical access to the system in accordance with applicable policy. AC-4 Information Flow Enforcement The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems in accordance with applicable policy.