AC-19 Access Control for Mobile Devices

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	2 (1 in a baseline)

Related controls: AC-3, AC-4, AC-7, AC-11, AC-17, AC-18, AC-20, CA-9, CM-2, CM-6, IA-2, IA-3, MP-2, MP-4, MP-5, MP-7, PL-4, SC-7, SC-34, SC-43, SI-3, SI-4

Control statement

• a. Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas; and
• b. Authorize the connection of mobile devices to organizational systems.

NIST discussion

A mobile device is a computing device that has a small form factor such that it can easily be carried by a single individual; is designed to operate without a physical connection; possesses local, non-removable or removable data storage; and includes a self-contained power source. Mobile device functionality may also include voice communication capabilities, on-board sensors that allow the device to capture information, and/or built-in features for synchronizing local data with remote locations. Examples include smart phones and tablets. Mobile devices are typically associated with a single individual. The processing, storage, and transmission capability of the mobile device may be comparable to or merely a subset of notebook/desktop systems, depending on the nature and intended purpose of the device. Protection and control of mobile devices is behavior or policy-based and requires users to take physical action to protect and control such devices when outside of controlled areas. Controlled areas are spaces for which organizations provide physical or procedural controls to meet the requirements established for protecting information and systems.

Due to the large variety of mobile devices with different characteristics and capabilities, organizational restrictions may vary for the different classes or types of such devices. Usage restrictions and specific implementation guidance for mobile devices include configuration management, device identification and authentication, implementation of mandatory protective software, scanning devices for malicious code, updating virus protection software, scanning for critical software updates and patches, conducting primary operating system (and possibly other resident software) integrity checks, and disabling unnecessary hardware.

Usage restrictions and authorization to connect may vary among organizational systems. For example, the organization may authorize the connection of mobile devices to its network and impose a set of usage restrictions, while a system owner may withhold authorization for mobile device connection to specific applications or impose additional usage restrictions before allowing mobile device connections to a system. Adequate security for mobile devices goes beyond the requirements specified in AC-19 . Many safeguards for mobile devices are reflected in other controls. AC-20 addresses mobile devices that are not organization-controlled.

Control enhancements

AC-19(4) Restrictions for Classified Information

Baselines: Not in a baseline

• (a) Prohibit the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official; and
• (b) Enforce the following restrictions on individuals permitted by the authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information:
  • (1) Connection of unclassified mobile devices to classified systems is prohibited;
  • (2) Connection of unclassified mobile devices to unclassified systems requires approval from the authorizing official;
  • (3) Use of internal or external modems or wireless interfaces within the unclassified mobile devices is prohibited; and
  • (4) Unclassified mobile devices and the information stored on those devices are subject to random reviews and inspections by [Assignment: organization-defined security officials] , and if classified information is found, the incident handling policy is followed.
• (c) Restrict the connection of classified mobile devices to classified systems in accordance with [Assignment: organization-defined security policies].

Discussion and assessment objectives for AC-19(4)

None.

Determine if:

• AC-19(04)(a) the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information is prohibited unless specifically permitted by the authorizing official;
• AC-19(04)(b)
  • AC-19(04)(b)(01) prohibition of the connection of unclassified mobile devices to classified systems is enforced on individuals permitted by an authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;
  • AC-19(04)(b)(02) approval by the authorizing official for the connection of unclassified mobile devices to unclassified systems is enforced on individuals permitted to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;
  • AC-19(04)(b)(03) prohibition of the use of internal or external modems or wireless interfaces within unclassified mobile devices is enforced on individuals permitted by an authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;
  • AC-19(04)(b)(04)
    • AC-19(04)(b)(04)[01] random review and inspection of unclassified mobile devices and the information stored on those devices by [Assignment: organization-defined security officials] are enforced;
    • AC-19(04)(b)(04)[02] following of the incident handling policy is enforced if classified information is found during a random review and inspection of unclassified mobile devices;
• AC-19(04)(c) the connection of classified mobile devices to classified systems is restricted in accordance with [Assignment: organization-defined security policies].

Examine: Access control policy; incident handling policy; procedures addressing access control for mobile devices; system design documentation; system configuration settings and associated documentation; evidentiary documentation for random inspections and reviews of mobile devices; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel responsible for random reviews/inspections of mobile devices; organizational personnel using mobile devices in facilities containing systems processing, storing, or transmitting classified information; organizational personnel with incident response responsibilities; system/network administrators; organizational personnel with information security responsibilities.

Test: Mechanisms prohibiting the use of internal or external modems or wireless interfaces with mobile devices.

AC-19(5) Full Device or Container-based Encryption

Baselines: Moderate, High

Employ [Selection: full-device encryption; container-based encryption] to protect the confidentiality and integrity of information on [Assignment: organization-defined mobile devices].

Discussion and assessment objectives for AC-19(5)

Container-based encryption provides a more fine-grained approach to data and information encryption on mobile devices, including encrypting selected data structures such as files, records, or fields.

Determine if [Selection: full-device encryption; container-based encryption] is employed to protect the confidentiality and integrity of information on [Assignment: organization-defined mobile devices].

Examine: Access control policy; procedures addressing access control for mobile devices; system design documentation; system configuration settings and associated documentation; encryption mechanisms and associated configuration documentation; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel with access control responsibilities for mobile devices; system/network administrators; organizational personnel with information security responsibilities.

Test: Encryption mechanisms protecting confidentiality and integrity of information on mobile devices.

Withdrawn enhancements: AC-19(1), AC-19(2), AC-19(3).

Assessment objectives (SP 800-53A)

Objectives and methods for AC-19

Determine if:

• AC-19a.
  • AC-19a.[01] configuration requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area;
  • AC-19a.[02] connection requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area;
  • AC-19a.[03] implementation guidance is established for organization-controlled mobile devices, including when such devices are outside of the controlled area;
• AC-19b. the connection of mobile devices to organizational systems is authorized.

Examine: Access control policy; procedures addressing access control for mobile device usage (including restrictions); configuration management plan; system design documentation; system configuration settings and associated documentation; authorizations for mobile device connections to organizational systems; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel using mobile devices to access organizational systems; system/network administrators; organizational personnel with information security responsibilities.

Test: Access control capability for mobile device connections to organizational systems; configurations of mobile devices.

Policy statement

• The Chief Information Security Officer shall establish configuration requirements, connection requirements and implementation guidance for organization-controlled mobile devices, including when devices are outside controlled areas. (AC-19a)
• The System owner shall authorize the connection of mobile devices to the system. (AC-19b)

AC-19(5) Full device or container-based encryption

• The Chief Information Security Officer shall require Select one: full-device encryption; container-based encryption Typical: full-device encryption to protect the confidentiality and integrity of information on Fill in: mobile devices on which to employ encryption Typical: all organization-controlled mobile devices. (AC-19(5))

From the Access Control Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

AC-19 covers organization-controlled mobile devices, such as smartphones and tablets. You set configuration and connection requirements for them, including for when they leave controlled areas, and authorize their connection to the system. The Moderate baseline adds AC-19(5), encrypting the information on them.

Mobile devices the organization does not control fall under AC-20, as NIST’s discussion says. That includes personally owned devices enrolled in device management. NIST’s discussion of AC-20(3) treats personally owned devices as non-organizationally owned, and lists restrictions under which they may be allowed, among them requiring approved controls before they connect, limiting the information, services or applications they reach, and agreeing to terms and conditions of use. The configuration requirements set here under AC-19 can serve as those approved controls. Record in the system security plan that both controls apply to enrolled personal devices.

Common implementations. Mobile device management enrolls each device and enforces a passcode, screen lock (AC-11), encryption (AC-19(5)), a minimum operating system version and approved apps, and can wipe a lost device remotely. Conditional access in the identity provider lets only enrolled, compliant devices reach the system. A work profile or managed container keeps organization data apart from personal apps. The Rules of Behavior tell users to use only issued or approved devices (AC-19) and to report a lost or stolen device immediately.

For detail, NIST SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise (May 2023; final, with no newer revision listed as of September 2026), covers organization-owned and personally owned devices across their life cycle.

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
Full-device or container-based encryption (AC-19(5))	Full-device encryption
Mobile devices to encrypt (AC-19(5))	All organization-controlled mobile devices

AC-19 itself has no parameters. In the Access Control policy, the CISO sets the requirements (item a) and the system owner authorizes mobile device connections to the system (item b). Container-based encryption is the other choice, and suits enrolled personal devices where only the work container is managed.

Evidence assessors ask for.

• The configuration requirements, connection requirements and implementation guidance for mobile devices, including rules for travel and other use outside controlled areas
• Device management profiles and compliance policies showing the passcode, lock, encryption and operating system settings
• The list of enrolled devices with their compliance status, compared with the devices that have connected to the system
• Conditional access rules that block devices that are not enrolled or not compliant
• Records of lost or stolen devices, with the date of each remote wipe

Inheritance. Device management and conditional access are usually common controls, run by the organization’s endpoint and identity teams. NIST’s discussion notes that a system owner may withhold mobile access to a system, or add restrictions, so the system owns that decision and any extra rules.

Common findings.

• Email or applications reachable from unenrolled phones through a protocol or app that conditional access does not cover.
• Devices on unsupported operating system versions still marked compliant.
• Lost devices reported late or never wiped.
• No requirements for devices taken outside controlled areas, such as on international travel.

Enhancements in the Moderate baseline. AC-19(5) full device or container-based encryption. High adds none. AC-19(4), restrictions for classified information, is in no baseline.

Federal systems (as of September 2026). OMB Circular A-130, Appendix I, section 4.i(14), requires agencies to encrypt all FIPS 199 moderate-impact and high-impact information at rest and in transit, unless encrypting is technically infeasible or would demonstrably affect the mission, and the authorizing official accepts the risk with the CIO’s approval. Section 4.i(15) requires validated cryptographic modules. Check that the device encryption behind AC-19(5) uses a validated module; SC-13 covers FIPS 140-3 and the validation program.

Artifacts

• Access Control Decision Worksheet
• Access Control Policy