AC-3 Access Enforcement

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	System	13 (1 in a baseline)

Related controls: AC-2, AC-4, AC-5, AC-6, AC-16, AC-17, AC-18, AC-19, AC-20, AC-21, AC-22, AC-24, AC-25, AT-2, AT-3, AU-9, CA-9, CM-5, CM-11, IA-2, IA-5, IA-6, IA-7, IA-11, IA-13, MA-3, MA-4, MA-5, MP-4, PM-2, PS-3, PT-2, PT-3, SA-17, SC-2, SC-3, SC-4, SC-12, SC-13, SC-28, SC-31, SC-34, SI-4, SI-8

Control statement

Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

NIST discussion

Access control policies control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (i.e., devices, files, records, domains) in organizational systems. In addition to enforcing authorized access at the system level and recognizing that systems can host many applications and services in support of mission and business functions, access enforcement mechanisms can also be employed at the application and service level to provide increased information security and privacy. In contrast to logical access controls that are implemented within the system, physical access controls are addressed by the controls in the Physical and Environmental Protection ( PE ) family.

Control enhancements

AC-3(2) Dual Authorization

Baselines: Not in a baseline

Enforce dual authorization for [Assignment: organization-defined privileged commands and/or other actions].

Discussion and assessment objectives for AC-3(2)

Dual authorization, also known as two-person control, reduces risk related to insider threats. Dual authorization mechanisms require the approval of two authorized individuals to execute. To reduce the risk of collusion, organizations consider rotating dual authorization duties. Organizations consider the risk associated with implementing dual authorization mechanisms when immediate responses are necessary to ensure public and environmental safety.

Determine if dual authorization is enforced for [Assignment: organization-defined privileged commands and/or other actions].

Examine: Access control policy; procedures addressing access enforcement and dual authorization; system design documentation; system configuration settings and associated documentation; list of privileged commands requiring dual authorization; list of actions requiring dual authorization; list of approved authorizations (user privileges); system security plan; other relevant documents or records.

Test: Dual authorization mechanisms implementing access control policy.

AC-3(3) Mandatory Access Control

Baselines: Not in a baseline

Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy, and where the policy:

(a) Is uniformly enforced across the covered subjects and objects within the system;
(b) Specifies that a subject that has been granted access to information is constrained from doing any of the following;
- (1) Passing the information to unauthorized subjects or objects;
- (2) Granting its privileges to other subjects;
- (3) Changing one or more security attributes (specified by the policy) on subjects, objects, the system, or system components;
- (4) Choosing the security attributes and attribute values (specified by the policy) to be associated with newly created or modified objects; and
- (5) Changing the rules governing access control; and
(c) Specifies that [Assignment: organization-defined subjects] may explicitly be granted [Assignment: organization-defined privileges] such that they are not limited by any defined subset (or all) of the above constraints.

Discussion and assessment objectives for AC-3(3)

Mandatory access control is a type of nondiscretionary access control. Mandatory access control policies constrain what actions subjects can take with information obtained from objects for which they have already been granted access. This prevents the subjects from passing the information to unauthorized subjects and objects. Mandatory access control policies constrain actions that subjects can take with respect to the propagation of access control privileges; that is, a subject with a privilege cannot pass that privilege to other subjects. The policy is uniformly enforced over all subjects and objects to which the system has control. Otherwise, the access control policy can be circumvented. This enforcement is provided by an implementation that meets the reference monitor concept as described in AC-25 . The policy is bounded by the system (i.e., once the information is passed outside of the control of the system, additional means may be required to ensure that the constraints on the information remain in effect).

The trusted subjects described above are granted privileges consistent with the concept of least privilege (see AC-6 ). Trusted subjects are only given the minimum privileges necessary for satisfying organizational mission/business needs relative to the above policy. The control is most applicable when there is a mandate that establishes a policy regarding access to controlled unclassified information or classified information and some users of the system are not authorized access to all such information resident in the system. Mandatory access control can operate in conjunction with discretionary access control as described in AC-3(4) . A subject constrained in its operation by mandatory access control policies can still operate under the less rigorous constraints of AC-3(4), but mandatory access control policies take precedence over the less rigorous constraints of AC-3(4). For example, while a mandatory access control policy imposes a constraint that prevents a subject from passing information to another subject operating at a different impact or classification level, AC-3(4) permits the subject to pass the information to any other subject with the same impact or classification level as the subject. Examples of mandatory access control policies include the Bell-LaPadula policy to protect confidentiality of information and the Biba policy to protect the integrity of information.

Determine if:

AC-03(03)[01] [Assignment: organization-defined mandatory access control policy] is enforced over the set of covered subjects specified in the policy;
AC-03(03)[02] [Assignment: organization-defined mandatory access control policy] is enforced over the set of covered objects specified in the policy;
AC-03(03)(a)
- AC-03(03)(a)[01] [Assignment: organization-defined mandatory access control policy] is uniformly enforced across the covered subjects within the system;
- AC-03(03)(a)[02] [Assignment: organization-defined mandatory access control policy] is uniformly enforced across the covered objects within the system;
AC-03(03)(b)
- AC-03(03)(b)(01) [Assignment: organization-defined mandatory access control policy] and [Assignment: organization-defined mandatory access control policy] specifying that a subject that has been granted access to information is constrained from passing the information to unauthorized subjects or objects are enforced;
- AC-03(03)(b)(02) [Assignment: organization-defined mandatory access control policy] and [Assignment: organization-defined mandatory access control policy] specifying that a subject that has been granted access to information is constrained from granting its privileges to other subjects are enforced;
- AC-03(03)(b)(03) [Assignment: organization-defined mandatory access control policy] and [Assignment: organization-defined mandatory access control policy] specifying that a subject that has been granted access to information is constrained from changing one of more security attributes (specified by the policy) on subjects, objects, the system, or system components are enforced;
- AC-03(03)(b)(04) [Assignment: organization-defined mandatory access control policy] and [Assignment: organization-defined mandatory access control policy] specifying that a subject that has been granted access to information is constrained from choosing the security attributes and attribute values (specified by the policy) to be associated with newly created or modified objects are enforced;
- AC-03(03)(b)(05) [Assignment: organization-defined mandatory access control policy] and [Assignment: organization-defined mandatory access control policy] specifying that a subject that has been granted access to information is constrained from changing the rules governing access control are enforced;
AC-03(03)(c) [Assignment: organization-defined mandatory access control policy] and [Assignment: organization-defined mandatory access control policy] specifying that [Assignment: organization-defined subjects] may explicitly be granted [Assignment: organization-defined privileges] such that they are not limited by any defined subset (or all) of the above constraints are enforced.

Examine: Access control policy; mandatory access control policies; procedures addressing access enforcement; system design documentation; system configuration settings and associated documentation; list of subjects and objects (i.e., users and resources) requiring enforcement of mandatory access control policies; system audit records; system security plan; other relevant documents or records.

Test: Automated mechanisms implementing mandatory access control.

AC-3(4) Discretionary Access Control

Baselines: Not in a baseline

Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following:

(a) Pass the information to any other subjects or objects;
(b) Grant its privileges to other subjects;
(c) Change security attributes on subjects, objects, the system, or the system’s components;
(d) Choose the security attributes to be associated with newly created or revised objects; or
(e) Change the rules governing access control.

Discussion and assessment objectives for AC-3(4)

When discretionary access control policies are implemented, subjects are not constrained with regard to what actions they can take with information for which they have already been granted access. Thus, subjects that have been granted access to information are not prevented from passing the information to other subjects or objects (i.e., subjects have the discretion to pass). Discretionary access control can operate in conjunction with mandatory access control as described in AC-3(3) and AC-3(15) . A subject that is constrained in its operation by mandatory access control policies can still operate under the less rigorous constraints of discretionary access control. Therefore, while AC-3(3) imposes constraints that prevent a subject from passing information to another subject operating at a different impact or classification level, AC-3(4) permits the subject to pass the information to any subject at the same impact or classification level. The policy is bounded by the system. Once the information is passed outside of system control, additional means may be required to ensure that the constraints remain in effect. While traditional definitions of discretionary access control require identity-based access control, that limitation is not required for this particular use of discretionary access control.

Determine if:

AC-03(04)[01] [Assignment: organization-defined discretionary access control policy] is enforced over the set of covered subjects specified in the policy;
AC-03(04)[02] [Assignment: organization-defined discretionary access control policy] is enforced over the set of covered objects specified in the policy;
AC-03(04)(a) [Assignment: organization-defined discretionary access control policy] and [Assignment: organization-defined discretionary access control policy] are enforced where the policy specifies that a subject that has been granted access to information can pass the information to any other subjects or objects;
AC-03(04)(b) [Assignment: organization-defined discretionary access control policy] and [Assignment: organization-defined discretionary access control policy] are enforced where the policy specifies that a subject that has been granted access to information can grant its privileges to other subjects;
AC-03(04)(c) [Assignment: organization-defined discretionary access control policy] and [Assignment: organization-defined discretionary access control policy] are enforced where the policy specifies that a subject that has been granted access to information can change security attributes on subjects, objects, the system, or the system’s components;
AC-03(04)(d) [Assignment: organization-defined discretionary access control policy] and [Assignment: organization-defined discretionary access control policy] are enforced where the policy specifies that a subject that has been granted access to information can choose the security attributes to be associated with newly created or revised objects;
AC-03(04)(e) [Assignment: organization-defined discretionary access control policy] and [Assignment: organization-defined discretionary access control policy] are enforced where the policy specifies that a subject that has been granted access to information can change the rules governing access control.

Examine: Access control policy; discretionary access control policies; procedures addressing access enforcement; system design documentation; system configuration settings and associated documentation; list of subjects and objects (i.e., users and resources) requiring enforcement of discretionary access control policies; system audit records; system security plan; other relevant documents or records.

Test: Mechanisms implementing discretionary access control policy.

AC-3(5) Security-relevant Information

Baselines: Not in a baseline

Prevent access to [Assignment: organization-defined security-relevant information] except during secure, non-operable system states.

Discussion and assessment objectives for AC-3(5)

Security-relevant information is information within systems that can potentially impact the operation of security functions or the provision of security services in a manner that could result in failure to enforce system security and privacy policies or maintain the separation of code and data. Security-relevant information includes access control lists, filtering rules for routers or firewalls, configuration parameters for security services, and cryptographic key management information. Secure, non-operable system states include the times in which systems are not performing mission or business-related processing, such as when the system is offline for maintenance, boot-up, troubleshooting, or shut down.

Determine if access to [Assignment: organization-defined security-relevant information] is prevented except during secure, non-operable system states.

Test: Mechanisms preventing access to security-relevant information within the system.

AC-3(7) Role-based Access Control

Baselines: Not in a baseline

Enforce a role-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined roles and users authorized to assume such roles].

Discussion and assessment objectives for AC-3(7)

Role-based access control (RBAC) is an access control policy that enforces access to objects and system functions based on the defined role (i.e., job function) of the subject. Organizations can create specific roles based on job functions and the authorizations (i.e., privileges) to perform needed operations on the systems associated with the organization-defined roles. When users are assigned to specific roles, they inherit the authorizations or privileges defined for those roles. RBAC simplifies privilege administration for organizations because privileges are not assigned directly to every user (which can be a large number of individuals) but are instead acquired through role assignments. RBAC can also increase privacy and security risk if individuals assigned to a role are given access to information beyond what they need to support organizational missions or business functions. RBAC can be implemented as a mandatory or discretionary form of access control. For organizations implementing RBAC with mandatory access controls, the requirements in AC-3(3) define the scope of the subjects and objects covered by the policy.

Determine if:

AC-03(07)[01] a role-based access control policy is enforced over defined subjects;
AC-03(07)[02] a role-based access control policy is enforced over defined objects;
AC-03(07)[03] access is controlled based on [Assignment: organization-defined roles] and [Assignment: organization-defined users authorized to assume such roles].

Examine: Access control policy; role-based access control policies; procedures addressing access enforcement; system design documentation; system configuration settings and associated documentation; list of roles, users, and associated privileges required to control system access; system audit records; system security plan; privacy plan; other relevant documents or records.

Test: Mechanisms implementing role-based access control policy.

AC-3(8) Revocation of Access Authorizations

Baselines: Not in a baseline

Enforce the revocation of access authorizations resulting from changes to the security attributes of subjects and objects based on [Assignment: organization-defined rules].

Discussion and assessment objectives for AC-3(8)

Revocation of access rules may differ based on the types of access revoked. For example, if a subject (i.e., user or process acting on behalf of a user) is removed from a group, access may not be revoked until the next time the object is opened or the next time the subject attempts to access the object. Revocation based on changes to security labels may take effect immediately. Organizations provide alternative approaches on how to make revocations immediate if systems cannot provide such capability and immediate revocation is necessary.

Determine if:

AC-03(08)[01] revocation of access authorizations is enforced, resulting from changes to the security attributes of subjects based on [Assignment: organization-defined rules];
AC-03(08)[02] revocation of access authorizations is enforced resulting from changes to the security attributes of objects based on [Assignment: organization-defined rules].

Test: Mechanisms implementing access enforcement functions.

AC-3(9) Controlled Release

Baselines: Not in a baseline

Release information outside of the system only if:

(a) The receiving [Assignment: organization-defined system or system component] provides [Assignment: organization-defined controls] ; and
(b) [Assignment: organization-defined controls] are used to validate the appropriateness of the information designated for release.

Discussion and assessment objectives for AC-3(9)

Organizations can only directly protect information when it resides within the system. Additional controls may be needed to ensure that organizational information is adequately protected once it is transmitted outside of the system. In situations where the system is unable to determine the adequacy of the protections provided by external entities, as a mitigation measure, organizations procedurally determine whether the external systems are providing adequate controls. The means used to determine the adequacy of controls provided by external systems include conducting periodic assessments (inspections/tests), establishing agreements between the organization and its counterpart organizations, or some other process. The means used by external entities to protect the information received need not be the same as those used by the organization, but the means employed are sufficient to provide consistent adjudication of the security and privacy policy to protect the information and individuals’ privacy.

Controlled release of information requires systems to implement technical or procedural means to validate the information prior to releasing it to external systems. For example, if the system passes information to a system controlled by another organization, technical means are employed to validate that the security and privacy attributes associated with the exported information are appropriate for the receiving system. Alternatively, if the system passes information to a printer in organization-controlled space, procedural means can be employed to ensure that only authorized individuals gain access to the printer.

Determine if:

AC-03(09)(a) information is released outside of the system only if the receiving [Assignment: organization-defined system or system component] provides [Assignment: organization-defined controls];
AC-03(09)(b) information is released outside of the system only if [Assignment: organization-defined controls] are used to validate the appropriateness of the information designated for release.

Examine: Access control policy; procedures addressing access enforcement; system design documentation; system configuration settings and associated documentation; list of security and privacy safeguards provided by receiving system or system components; list of security and privacy safeguards validating appropriateness of information designated for release; system audit records; results of period assessments (inspections/tests) of the external system; information sharing agreements; memoranda of understanding; acquisitions/contractual agreements; system security plan; privacy plan; other relevant documents or records.

Interview: Organizational personnel with access enforcement responsibilities; system/network administrators; organizational personnel with information security and privacy responsibilities; organizational personnel with responsibility for acquisitions/contractual agreements; legal counsel; system developers.

Test: Mechanisms implementing access enforcement functions.

AC-3(10) Audited Override of Access Control Mechanisms

Baselines: Not in a baseline

Employ an audited override of automated access control mechanisms under [Assignment: organization-defined conditions] by [Assignment: organization-defined roles].

Discussion and assessment objectives for AC-3(10)

In certain situations, such as when there is a threat to human life or an event that threatens the organization’s ability to carry out critical missions or business functions, an override capability for access control mechanisms may be needed. Override conditions are defined by organizations and used only in those limited circumstances. Audit events are defined in AU-2 . Audit records are generated in AU-12.

Determine if an audited override of automated access control mechanisms is employed under [Assignment: organization-defined conditions] by [Assignment: organization-defined roles].

Examine: Access control policy; procedures addressing access enforcement; system design documentation; system configuration settings and associated documentation; conditions for employing audited override of automated access control mechanisms; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel with access enforcement responsibilities; system/network administrators; organizational personnel with information security responsibilities.

Test: Mechanisms implementing access enforcement functions.

AC-3(11) Restrict Access to Specific Information Types

Baselines: Not in a baseline

Restrict access to data repositories containing [Assignment: organization-defined information types].

Discussion and assessment objectives for AC-3(11)

Restricting access to specific information is intended to provide flexibility regarding access control of specific information types within a system. For example, role-based access could be employed to allow access to only a specific type of personally identifiable information within a database rather than allowing access to the database in its entirety. Other examples include restricting access to cryptographic keys, authentication information, and selected system information.

Determine if access to data repositories containing [Assignment: organization-defined information types] is restricted.

Interview: Organizational personnel with access enforcement responsibilities; organizational personnel with responsibilities for data repositories; system/network administrators; organizational personnel with information security responsibilities.

Test: Mechanisms implementing access enforcement functions.

AC-3(12) Assert and Enforce Application Access

Baselines: Not in a baseline

(a) Require applications to assert, as part of the installation process, the access needed to the following system applications and functions: [Assignment: organization-defined system applications and functions];
(b) Provide an enforcement mechanism to prevent unauthorized access; and
(c) Approve access changes after initial installation of the application.

Discussion and assessment objectives for AC-3(12)

Asserting and enforcing application access is intended to address applications that need to access existing system applications and functions, including user contacts, global positioning systems, cameras, keyboards, microphones, networks, phones, or other files.

Determine if:

AC-03(12)(a) as part of the installation process, applications are required to assert the access needed to the following system applications and functions: [Assignment: organization-defined system applications and functions];
AC-03(12)(b) an enforcement mechanism to prevent unauthorized access is provided;
AC-03(12)(c) access changes after initial installation of the application are approved.

Interview: Organizational personnel with access enforcement responsibilities; system/network administrators; organizational personnel with information security responsibilities.

Test: Mechanisms implementing access enforcement functions.

AC-3(13) Attribute-based Access Control

Baselines: Not in a baseline

Enforce attribute-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined attributes].

Discussion and assessment objectives for AC-3(13)

Attribute-based access control is an access control policy that restricts system access to authorized users based on specified organizational attributes (e.g., job function, identity), action attributes (e.g., read, write, delete), environmental attributes (e.g., time of day, location), and resource attributes (e.g., classification of a document). Organizations can create rules based on attributes and the authorizations (i.e., privileges) to perform needed operations on the systems associated with organization-defined attributes and rules. When users are assigned to attributes defined in attribute-based access control policies or rules, they can be provisioned to a system with the appropriate privileges or dynamically granted access to a protected resource. Attribute-based access control can be implemented as either a mandatory or discretionary form of access control. When implemented with mandatory access controls, the requirements in AC-3(3) define the scope of the subjects and objects covered by the policy.

Determine if:

AC-03(13)[01] the attribute-based access control policy is enforced over defined subjects;
AC-03(13)[02] the attribute-based access control policy is enforced over defined objects;
AC-03(13)[03] access is controlled based on [Assignment: organization-defined attributes].

Examine: Access control policy; procedures addressing access enforcement; system design documentation; system configuration settings and associated documentation; list of subjects and objects (i.e., users and resources) requiring enforcement of attribute-based access control policies; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel with access enforcement responsibilities; system/network administrators; organizational personnel with information security responsibilities.

Test: Mechanisms implementing access enforcement functions.

AC-3(14) Individual Access

Baselines: Privacy

Provide [Assignment: organization-defined mechanisms] to enable individuals to have access to the following elements of their personally identifiable information: [Assignment: organization-defined elements].

Discussion and assessment objectives for AC-3(14)

Individual access affords individuals the ability to review personally identifiable information about them held within organizational records, regardless of format. Access helps individuals to develop an understanding about how their personally identifiable information is being processed. It can also help individuals ensure that their data is accurate. Access mechanisms can include request forms and application interfaces. For federal agencies, PRIVACT processes can be located in systems of record notices and on agency websites. Access to certain types of records may not be appropriate (e.g., for federal agencies, law enforcement records within a system of records may be exempt from disclosure under the PRIVACT ) or may require certain levels of authentication assurance. Organizational personnel consult with the senior agency official for privacy and legal counsel to determine appropriate mechanisms and access rights or limitations.

Determine if [Assignment: organization-defined mechanisms] are provided to enable individuals to have access to [Assignment: organization-defined elements] of their personally identifiable information.

Examine: Access mechanisms (e.g., request forms and application interfaces); access control policy; procedures addressing access enforcement; system design documentation; system configuration settings and associated documentation; documentation regarding access to an individual’s personally identifiable information; system audit records; system security plan; privacy plan; privacy impact assessment; privacy assessment findings and/or reports; other relevant documents or records.

Test: Mechanisms implementing access enforcement functions; mechanisms enabling individual access to personally identifiable information.

AC-3(15) Discretionary and Mandatory Access Control

Baselines: Not in a baseline

(a) Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy; and
(b) Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy.

Discussion and assessment objectives for AC-3(15)

Simultaneously implementing a mandatory access control policy and a discretionary access control policy can provide additional protection against the unauthorized execution of code by users or processes acting on behalf of users. This helps prevent a single compromised user or process from compromising the entire system.

Determine if:

AC-03(15)(a)
- AC-03(15)(a)[01] [Assignment: organization-defined mandatory access control policy] is enforced over the set of covered subjects specified in the policy;
- AC-03(15)(a)[02] [Assignment: organization-defined mandatory access control policy] is enforced over the set of covered objects specified in the policy;
AC-03(15)(b)
- AC-03(15)(b)[01] [Assignment: organization-defined discretionary access control policy] is enforced over the set of covered subjects specified in the policy;
- AC-03(15)(b)[02] [Assignment: organization-defined discretionary access control policy] is enforced over the set of covered objects specified in the policy.

Examine: Access control policy; procedures addressing access enforcement; system design documentation; system configuration settings and associated documentation; list of subjects and objects (i.e., users and resources) requiring enforcement of mandatory access control policies; list of subjects and objects (i.e., users and resources) requiring enforcement of discretionary access control policies; system audit records; system security plan; other relevant documents or records.

Test: Mechanisms implementing mandatory and discretionary access control policy.

Withdrawn enhancements: AC-3(1), AC-3(6).

Assessment objectives (SP 800-53A)

Objectives and methods for AC-3

Determine if approved authorizations for logical access to information and system resources are enforced in accordance with applicable access control policies.

Examine: Access control policy; procedures addressing access enforcement; system design documentation; system configuration settings and associated documentation; list of approved authorizations (user privileges); system audit records; system security plan; privacy plan; other relevant documents or records.

Test: Mechanisms implementing access control policy.

Policy statement

The System owner shall ensure the system enforces approved authorizations for logical access to information and system resources in accordance with this policy. (AC-3)

AC-3(14) Individual access

For a system that processes personally identifiable information, the System owner shall provide Fill in: mechanisms enabling individuals to have access to elements of their personally identifiable information Typical: a request process described in the privacy notice, with identity verification before any information is released, and a self-service page where the system offers one to enable individuals to have access to the following elements of their personally identifiable information: Fill in: elements of personally identifiable information to which individuals have access Typical: all personally identifiable information about the individual that the system holds, except elements a law, regulation or legal hold exempts from access, as the senior privacy official and legal counsel determine. (AC-3(14))
The Senior privacy official, with legal counsel, shall approve the access mechanisms and any limits on the elements available, and the System owner shall record them in the privacy impact assessment. (AC-3(14))
The System owner shall ensure the identity of each requester, or the authority of their designated representative, is verified at an assurance level suited to the sensitivity of the information before any information is released. (AC-3(14))
The Senior privacy official shall ensure each access request is answered, and that a refusal or a partial release is given in writing with the reason and how to appeal. (AC-3(14))

Federal systems

The Privacy Act requires each agency that maintains a system of records, upon request by any individual to gain access to their record or to any information about them in the system, to permit the individual, and upon request a person of their own choosing to accompany them, to review the record and have a copy made of all or any portion of it in a form comprehensible to them; the agency may require a written statement authorizing discussion of the record in the accompanying person’s presence (5 U.S.C. § 552a(d)(1)). Each system of records notice must describe the agency procedures by which an individual can learn how to gain access to a record about them and how to contest its content (§ 552a(e)(4)(H)). The agency’s Privacy Act rules must establish procedures for notifying individuals whether a system of records contains a record about them, define reasonable times, places and requirements for identifying requesters, establish procedures for disclosure to individuals, and set any fees for copies, excluding the cost of search and review (§ 552a(f)). Nothing in the section allows access to information compiled in reasonable anticipation of a civil action or proceeding (§ 552a(d)(5)), and subsections (j) and (k) let an agency exempt some systems of records from the access provisions by rule. Text checked in the United States Code, 2024 edition, as of October 2026.

For each system of records, the Senior privacy official shall ensure that individuals can review, and have a copy made of, their records in a form comprehensible to them, accompanied by a person of their choosing on request, as 5 U.S.C. § 552a(d)(1) requires, except for information § 552a(d)(5) excludes and systems the agency has exempted by rule under § 552a(j) or (k). (AC-3(14))
The access mechanisms for each system of records shall follow the agency’s Privacy Act rules under 5 U.S.C. § 552a(f), and its system of records notice shall describe them as § 552a(e)(4)(H) requires. (AC-3(14))

From the Access Control Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

AC-3 is the enforcement half of access control: AC-2 decides who gets an account and what they are approved for, and AC-3 makes the system allow exactly that and nothing more. It applies to every layer that makes an access decision, from the operating system and database to the application and the cloud management console.

Common implementations. Role-based access control in the identity provider and each application, with roles mapped to the access authorizations approved under AC-2. File and database permissions granted to groups, not individuals. Cloud identity and access management policies attached to roles, with no standing wildcard permissions. Application authorization checks enforced on the server, not only in the user interface.

Organization-defined parameters. None in the base control.

Evidence assessors ask for.

The access control policy and the role definitions for the system
A sample of accounts compared against their approved access requests
Screenshots or exports of permission settings for key roles, groups and cloud policies
Test results showing a user cannot reach functions or data outside their role

Inheritance. The identity provider and platform permission models are often common controls, but each system owns its own roles and the mapping of roles to data, so AC-3 is usually hybrid.

Common findings.

Permissions granted directly to individuals instead of through roles, so reviews miss them.
Application roles that do not match the approved access requests.
Cloud policies with broad wildcard permissions left over from setup.
Authorization enforced only in the user interface, bypassable through the API.

Enhancements in the Moderate baseline. None. AC-3 has enhancements, but none is in the Low, Moderate or High baseline.

Enhancements in the Privacy baseline. AC-3(14) individual access: give individuals a way to see the personally identifiable information about them that the system holds. NIST’s discussion names request forms and application interfaces as mechanisms, and says access to some records may not be appropriate or may require a certain level of authentication assurance, so personnel consult the senior privacy official and legal counsel on the mechanisms and any limits. Typical values, from the Access Control policy: mechanisms, a request process described in the privacy notice, with identity verification before any information is released, and a self-service page where the system offers one; elements, all personally identifiable information about the individual that the system holds, except elements a law, regulation or legal hold exempts from access, as the senior privacy official and legal counsel determine. The clause has the senior privacy official approve the mechanisms and limits, and the system owner record them in section 8 of the privacy impact assessment; describe the request process in the privacy notice. Assessors ask for the access mechanism, a sample of requests with the identity check and the response, and any refusals with their reasons. Correcting what individuals find is SI-18(4).

Federal systems (as of October 2026). For AC-3(14), the Privacy Act requires each agency that maintains a system of records, on an individual’s request, to let them review their record and have a copy made of all or any portion of it in a form comprehensible to them, accompanied by a person of their choosing on request (5 U.S.C. § 552a(d)(1)). Each system of records notice describes how individuals can learn how to gain access to their records and contest their content (§ 552a(e)(4)(H)), and the agency’s Privacy Act rules set the procedures, the identity requirements and any copying fees (§ 552a(f)). Information compiled in reasonable anticipation of a civil action or proceeding is excluded (§ 552a(d)(5)), and an agency may exempt some systems of records from the access provisions by rule under subsections (j) and (k). The AC-3(14) clause’s federal block carries these into the policy.

Artifacts

Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.