AC-20 Use of External Systems

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	5 (2 in a baseline)

Related controls: AC-2, AC-3, AC-17, AC-19, CA-3, PL-2, PL-4, SA-9, SC-7

Control statement

• a. [Selection (one or more): establish [Assignment: organization-defined terms and conditions] ; identify [Assignment: organization-defined controls asserted] ] , consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to:
  • 1. Access the system from external systems; and
  • 2. Process, store, or transmit organization-controlled information using external systems; or
• b. Prohibit the use of [Assignment: organization-defined prohibited types of external systems].

NIST discussion

External systems are systems that are used by but not part of organizational systems, and for which the organization has no direct control over the implementation of required controls or the assessment of control effectiveness. External systems include personally owned systems, components, or devices; privately owned computing and communications devices in commercial or public facilities; systems owned or controlled by nonfederal organizations; systems managed by contractors; and federal information systems that are not owned by, operated by, or under the direct supervision or authority of the organization. External systems also include systems owned or operated by other components within the same organization and systems within the organization with different authorization boundaries. Organizations have the option to prohibit the use of any type of external system or prohibit the use of specified types of external systems, (e.g., prohibit the use of any external system that is not organizationally owned or prohibit the use of personally-owned systems).

For some external systems (i.e., systems operated by other organizations), the trust relationships that have been established between those organizations and the originating organization may be such that no explicit terms and conditions are required. Systems within these organizations may not be considered external. These situations occur when, for example, there are pre-existing information exchange agreements (either implicit or explicit) established between organizations or components or when such agreements are specified by applicable laws, executive orders, directives, regulations, policies, or standards. Authorized individuals include organizational personnel, contractors, or other individuals with authorized access to organizational systems and over which organizations have the authority to impose specific rules of behavior regarding system access. Restrictions that organizations impose on authorized individuals need not be uniform, as the restrictions may vary depending on trust relationships between organizations. Therefore, organizations may choose to impose different security restrictions on contractors than on state, local, or tribal governments.

External systems used to access public interfaces to organizational systems are outside the scope of AC-20 . Organizations establish specific terms and conditions for the use of external systems in accordance with organizational security policies and procedures. At a minimum, terms and conditions address the specific types of applications that can be accessed on organizational systems from external systems and the highest security category of information that can be processed, stored, or transmitted on external systems. If the terms and conditions with the owners of the external systems cannot be established, organizations may impose restrictions on organizational personnel using those external systems.

Control enhancements

AC-20(1) Limits on Authorized Use

Baselines: Moderate, High

Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after:

• (a) Verification of the implementation of controls on the external system as specified in the organization’s security and privacy policies and security and privacy plans; or
• (b) Retention of approved system connection or processing agreements with the organizational entity hosting the external system.

Discussion and assessment objectives for AC-20(1)

Limiting authorized use recognizes circumstances where individuals using external systems may need to access organizational systems. Organizations need assurance that the external systems contain the necessary controls so as not to compromise, damage, or otherwise harm organizational systems. Verification that the required controls have been implemented can be achieved by external, independent assessments, attestations, or other means, depending on the confidence level required by organizations.

Determine if:

• AC-20(01)(a) authorized individuals are permitted to use an external system to access the system or to process, store, or transmit organization-controlled information only after verification of the implementation of controls on the external system as specified in the organization’s security and privacy policies and security and privacy plans (if applicable);
• AC-20(01)(b) authorized individuals are permitted to use an external system to access the system or to process, store, or transmit organization-controlled information only after retention of approved system connection or processing agreements with the organizational entity hosting the external system (if applicable).

Examine: Access control policy; procedures addressing the use of external systems; system connection or processing agreements; account management documents; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities.

Test: Mechanisms implementing limits on use of external systems.

AC-20(2) Portable Storage Devices — Restricted Use

Baselines: Moderate, High

Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using [Assignment: organization-defined restrictions].

Discussion and assessment objectives for AC-20(2)

Limits on the use of organization-controlled portable storage devices in external systems include restrictions on how the devices may be used and under what conditions the devices may be used.

Determine if the use of organization-controlled portable storage devices by authorized individuals is restricted on external systems using [Assignment: organization-defined restrictions].

Examine: Access control policy; procedures addressing the use of external systems; system configuration settings and associated documentation; system connection or processing agreements; account management documents; system security plan; other relevant documents or records.

Interview: Organizational personnel with responsibilities for restricting or prohibiting the use of organization-controlled storage devices on external systems; system/network administrators; organizational personnel with information security responsibilities.

Test: Mechanisms implementing restrictions on the use of portable storage devices.

AC-20(3) Non-organizationally Owned Systems — Restricted Use

Baselines: Not in a baseline

Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using [Assignment: organization-defined restrictions].

Discussion and assessment objectives for AC-20(3)

Non-organizationally owned systems or system components include systems or system components owned by other organizations as well as personally owned devices. There are potential risks to using non-organizationally owned systems or components. In some cases, the risk is sufficiently high as to prohibit such use (see AC-20 b. ). In other cases, the use of such systems or system components may be allowed but restricted in some way. Restrictions include requiring the implementation of approved controls prior to authorizing the connection of non-organizationally owned systems and components; limiting access to types of information, services, or applications; using virtualization techniques to limit processing and storage activities to servers or system components provisioned by the organization; and agreeing to the terms and conditions for usage. Organizations consult with the Office of the General Counsel regarding legal issues associated with using personally owned devices, including requirements for conducting forensic analyses during investigations after an incident.

Determine if the use of non-organizationally owned systems or system components to process, store, or transmit organizational information is restricted using [Assignment: organization-defined restrictions].

Examine: Access control policy; procedures addressing the use of external systems; system design documentation; system configuration settings and associated documentation; system connection or processing agreements; account management documents; system audit records, other relevant documents or records.

Interview: Organizational personnel with responsibilities for restricting or prohibiting the use of non-organizationally owned systems, system components, or devices; system/network administrators; organizational personnel with information security responsibilities.

Test: Mechanisms implementing restrictions on the use of non-organizationally owned systems, components, or devices.

AC-20(4) Network Accessible Storage Devices — Prohibited Use

Baselines: Not in a baseline

Prohibit the use of [Assignment: organization-defined network-accessible storage devices] in external systems.

Discussion and assessment objectives for AC-20(4)

Network-accessible storage devices in external systems include online storage devices in public, hybrid, or community cloud-based systems.

Determine if the use of [Assignment: organization-defined network-accessible storage devices] is prohibited in external systems.

Examine: Access control policy; procedures addressing use of network-accessible storage devices in external systems; system design documentation; system configuration settings and associated documentation; system connection or processing agreements; list of network-accessible storage devices prohibited from use in external systems; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel with responsibilities for prohibiting the use of network-accessible storage devices in external systems; system/network administrators; organizational personnel with information security responsibilities.

Test: Mechanisms prohibiting the use of network-accessible storage devices in external systems.

AC-20(5) Portable Storage Devices — Prohibited Use

Baselines: Not in a baseline

Prohibit the use of organization-controlled portable storage devices by authorized individuals on external systems.

Discussion and assessment objectives for AC-20(5)

Limits on the use of organization-controlled portable storage devices in external systems include a complete prohibition of the use of such devices. Prohibiting such use is enforced using technical methods and/or nontechnical (i.e., process-based) methods.

Determine if the use of organization-controlled portable storage devices by authorized individuals is prohibited on external systems.

Examine: Access control policy; procedures addressing use of portable storage devices in external systems; system design documentation; system configuration settings and associated documentation; system connection or processing agreements; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel with responsibilities for prohibiting the use of portable storage devices in external systems; system/network administrators; organizational personnel with information security responsibilities.

Assessment objectives (SP 800-53A)

Objectives and methods for AC-20

Determine if:

• AC-20a.
  • AC-20a.01 [Selection (one or more): establish [Assignment: organization-defined terms and conditions] ; identify [Assignment: organization-defined controls asserted] ] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to access the system from external systems (if applicable);
  • AC-20a.02 [Selection (one or more): establish [Assignment: organization-defined terms and conditions] ; identify [Assignment: organization-defined controls asserted] ] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to process, store, or transmit organization-controlled information using external systems (if applicable);
• AC-20b. the use of [Assignment: organization-defined prohibited types of external systems] is prohibited (if applicable).

Examine: Access control policy; procedures addressing the use of external systems; external systems terms and conditions; list of types of applications accessible from external systems; maximum security categorization for information processed, stored, or transmitted on external systems; system configuration settings and associated documentation; system security plan; other relevant documents or records.

Interview: Organizational personnel with responsibilities for defining terms and conditions for use of external systems to access organizational systems; system/network administrators; organizational personnel with information security responsibilities.

Test: Mechanisms implementing terms and conditions on the use of external systems.

Policy statement

• Before authorized individuals access the system from an external system, or process, store or transmit organization-controlled information on one, the Chief Information Security Officer shall Select one or more: establish [Assignment: organization-defined terms and conditions]; identify [Assignment: organization-defined controls asserted] Typical: establish terms and conditions in a signed agreement with the organization that owns the external system, consistent with the trust relationship with the organization that owns, operates or maintains the external system. (AC-20a)
• Users shall not use Fill in: types of external systems prohibited from use Typical: personally owned devices that the organization does not manage, and public or shared computers to access the system or to process, store or transmit organization-controlled information. (AC-20b)

AC-20(1) Limits on authorized use

• The System owner shall permit authorized individuals to use an external system to access the system, or to process, store or transmit organization-controlled information, only after the controls on the external system are verified against the organization’s policies and plans, or an approved connection or processing agreement is in place with its owner. (AC-20(1))

AC-20(2) Portable storage devices: restricted use

• Authorized individuals shall use organization-controlled portable storage devices on external systems only under Fill in: restrictions on the use of organization-controlled portable storage devices by authorized individuals on external systems Typical: use only of encrypted, organization-issued devices, and only for approved business purposes. (AC-20(2))

From the Access Control Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

AC-20 covers systems your organization does not own or control that people use to reach your system or to handle your information. NIST’s discussion lists personally owned devices, computers in public places, contractors’ and partners’ systems, and other organizations’ systems, including other parts of your own organization with different authorization boundaries. For each type you allow, set terms and conditions or identify the controls it is asserted to have; for the rest, prohibit use.

The Moderate baseline adds AC-20(1), allowing use only after the external system’s controls are verified or an approved agreement is in place, and AC-20(2), restricting organization-controlled portable storage devices on external systems. External systems used only to reach your public interfaces are outside AC-20, as NIST’s discussion says. An external system that provides a service to your system, such as a cloud platform, falls under SA-9, external system services, which NIST lists as a related control. AC-20 is about people using external systems.

Personally owned devices remain external systems when enrolled in device management. NIST’s discussion of AC-20(3), an enhancement in no baseline, lists restrictions under which they may be allowed: approved controls before they connect, limits on the information, services or applications they reach, virtualization that keeps processing and storage on organization-provisioned components, and agreed terms and conditions of use. It also tells organizations to consult their general counsel on legal issues with personally owned devices, such as forensic analysis after an incident. The AC-19 configuration requirements can serve as the approved controls.

Common implementations. A signed agreement with each partner or contractor whose systems your staff use, stating at least what NIST’s discussion names as the minimum: which of your applications may be reached from the external system, and the highest security category of information it may hold. Where the two systems connect, the information exchange agreement can carry these terms. Conditional access in the identity provider that blocks unmanaged devices, which enforces the prohibition in item b. A virtual desktop for contractors, so organization information stays on organization systems. Device control that allows only encrypted, organization-issued portable storage (AC-20(2)).

The Rules of Behavior tell users to use only issued or approved devices and not to send organizational information to personal email, messaging or storage accounts. For telework and personal devices, NIST SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security (July 2016), is still the final version as of September 2026; NIST asked for comments on a Rev. 3 in 2020.

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
Establish terms and conditions, identify controls asserted, or both (a)	Establish terms and conditions in a signed agreement with the organization that owns the external system
Prohibited types of external systems (b)	Personally owned devices that the organization does not manage, and public or shared computers
Restrictions on portable storage devices used on external systems (AC-20(2))	Use only of encrypted, organization-issued devices, and only for approved business purposes

The terms and conditions themselves are written into each agreement, so the typical value selects the first option and leaves the controls-asserted option unused. AC-20(1) has no parameters. In the Access Control policy, the CISO establishes the terms and the system owner permits use only after verification or an agreement.

Evidence assessors ask for.

• The types of external systems allowed, each with its agreement or verification, and the types prohibited
• Signed agreements with the partners and contractors whose systems are used, showing the applications allowed and the highest category of information
• For AC-20(1), the verification: an independent assessment report, an attestation or another record, as NIST’s discussion allows, or the approved connection or processing agreement
• Conditional access or device compliance settings that block unmanaged devices and public computers
• Device control settings for portable storage (AC-20(2)), and the list of issued encrypted drives

Inheritance. Organization-wide agreements, conditional access and device control are usually common controls. The system owns which external systems may reach it and what information may be handled on them, so AC-20 is often a hybrid control.

Common findings.

• Staff moving work files through personal email or personal cloud storage.
• Contractors working on their own laptops with no agreement and no verification of controls.
• Web email or the VPN reachable from any device, despite a policy that prohibits unmanaged devices.
• Agreements that do not state the applications allowed or the highest category of information.
• Any USB drive usable on any computer, organization-issued or not.

Enhancements in the Moderate baseline. AC-20(1) limits on authorized use and AC-20(2) portable storage devices, restricted use. High adds none. AC-20(3) to AC-20(5) are in no baseline.

Federal systems (as of September 2026). Under 32 CFR 2002.14(h), an information system a non-executive branch entity operates on behalf of an agency is subject to the CUI rules as though it were the agency’s own. For other, non-federal systems that hold controlled unclassified information, agencies must use NIST SP 800-171 when setting the requirements to protect its confidentiality. The exceptions are a CUI category whose governing law or policy prescribes its own safeguards, and an agreement that sets requirements above moderate confidentiality. NIST SP 800-171 Rev. 3 (May 2024) is the current revision; write that requirement into the AC-20 agreement, as the PM-17 clause of the PM policy does for every agreement that shares CUI.

Artifacts

• Access Control Decision Worksheet
• Access Control Policy