# Access Control Policy

**Template version:** 1.0.0 · **Baseline:** High · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/ac/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The sections before and after Policy statements meet AC-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the AC-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

## Purpose

This policy states what [Organization name] requires for Access Control, and who is accountable for meeting those requirements. (AC-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (AC-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (AC-1a.1(a))
- The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (AC-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (AC-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (AC-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (AC-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (AC-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (AC-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (AC-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (AC-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (AC-1a.1(a))

## Procedures

The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (AC-1a.2)

## Dissemination

- The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the access control policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (AC-1a)
- The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the access control procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (AC-1a)

## Policy statements

> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

### Account management (AC-2)

> **Guidance:** AC-2 makes account management a controlled life cycle: every account has a known type, an owner, an approval and a removal trigger. Each statement below maps to one lettered item of the control. Assessors test these by sampling account requests, recent departures and the last access review, so keep the records each statement implies.

- The [System owner] shall define and document, for each system, the account types allowed and the account types prohibited. (AC-2a)
- The [System owner] shall assign one or more account managers for each system. (AC-2b)
- The [Account manager] shall require [Fill in: prerequisites and criteria for group and role membership. Typical: a completed access request, a signed access agreement and completed security awareness training] before granting group or role membership. (AC-2c)
- The [Account manager] shall record, for each account, the authorized user, group and role membership, access authorizations and [Fill in: attributes (as required) for each account. Typical: an expiration date for temporary accounts, and time-of-day or location restrictions where the system supports them]. (AC-2d)
- The [Account manager] shall create an account only after approval by [Fill in: personnel or roles required to approve requests to create accounts. Typical: the user's supervisor, plus the system owner or data owner for privileged roles]. (AC-2e)
- The [Account manager] shall create, enable, modify, disable and remove accounts in accordance with this policy and the account management procedure. (AC-2f)
- The [Account manager] shall monitor the use of accounts for activity that does not match the account's type or authorization. (AC-2g)
- The [Supervisor] shall notify the account manager and [Fill in: personnel or roles to be notified. Typical: the system owner and the system security officer] within [Fill in: time period within which to notify account managers when accounts are no longer required. Typical: 5 business days] when a user's account is no longer required. (AC-2h.1)
- The [Human resources office] shall notify the account manager and [Fill in: personnel or roles to be notified. Typical: the system owner and the system security officer] within [Fill in: time period within which to notify account managers when users are terminated or transferred. Typical: 24 hours, or the same day for privileged users] when a user is terminated or transferred. (AC-2h.2)
- The [Supervisor] shall notify the account manager and [Fill in: personnel or roles to be notified. Typical: the system owner and the system security officer] within [Fill in: time period within which to notify account managers when system usage or the need to know changes for an individual. Typical: 5 business days] when a user's system usage or need to know changes. (AC-2h.3)
- The [Account manager] shall authorize access only on the basis of a valid access authorization, the intended system usage and [Fill in: attributes needed to authorize system access (as required). Typical: time-of-day, day-of-week or network location restrictions, where needed]. (AC-2i)
- The [System owner] shall review all accounts on the system for compliance with this policy [Fill in: the frequency of account review. Typical: quarterly for privileged accounts and at least annually for all other accounts]. (AC-2j)
- The [Account manager] shall disable or remove each account the review finds is no longer authorized. (AC-2j)
- The [Account manager] shall change the authenticators of a shared or group account when an individual is removed from the group. (AC-2k)
- The [Chief Information Security Officer] shall ensure account management processes are aligned with personnel termination and transfer processes. (AC-2l)

> **Guidance:** Where the organization does not use shared or group accounts, keep the AC-2k statement and note in the system security plan that none are deployed; the assessor will still ask. Evidence for AC-2l is usually an automated feed from the human resources system to the identity provider, or a documented handoff in the [onboarding, transfer and termination checklist](https://kston83.github.io/nist-guide/templates/forms/onboarding-transfer-and-termination-checklist/) (PS-4). The [account management procedure](https://kston83.github.io/nist-guide/templates/procedures/account-management-procedure/) carries out these statements step by step; the [access request form](https://kston83.github.io/nist-guide/templates/forms/access-request-form/) and the [access review record](https://kston83.github.io/nist-guide/templates/forms/access-review-record/) are the records assessors sample for AC-2e and AC-2j.

### Automated system account management (AC-2(1))

- The [System owner] shall support the management of system accounts using [Fill in: automated mechanisms used to support the management of system accounts. Typical: the organization's identity provider and its provisioning workflows]. (AC-2(1))

### Automated temporary and emergency account management (AC-2(2))

- The [System owner] shall ensure the system automatically [Select one: remove; disable. Typical: disable] temporary and emergency accounts after [Fill in: the time period after which to automatically remove or disable temporary or emergency accounts. Typical: 72 hours for emergency accounts, and the end date approved at creation for temporary accounts]. (AC-2(2))

### Disable accounts (AC-2(3))

- The [Account manager] shall disable an account within [Fill in: time period within which to disable accounts. Typical: 1 business day] when the account has expired. (AC-2(3)(a))
- The [Account manager] shall disable an account within [Fill in: time period within which to disable accounts. Typical: 1 business day] when it is no longer associated with a user or individual. (AC-2(3)(b))
- The [Account manager] shall disable an account within [Fill in: time period within which to disable accounts. Typical: 1 business day] when it is in violation of organizational policy. (AC-2(3)(c))
- The [System owner] shall ensure the system disables an account that has been inactive for [Fill in: time period for account inactivity before disabling. Typical: 90 days]. (AC-2(3)(d))

### Automated audit actions (AC-2(4))

- The [System owner] shall ensure the system automatically audits account creation, modification, enabling, disabling and removal actions. (AC-2(4))

### Inactivity logout (AC-2(5))

- Each user shall log out [Fill in: the time period of expected inactivity or description of when to log out. Typical: at the end of each work session, and when leaving the device unattended for longer than the device lock period]. (AC-2(5))

### Usage conditions (AC-2(11))

- The [System owner] shall ensure the system enforces [Fill in: circumstances and/or usage conditions to be enforced for system accounts. Typical: restrictions by time of day, day of week and network location] for [Fill in: system accounts subject to enforcement of circumstances and/or usage conditions. Typical: privileged and emergency accounts]. (AC-2(11))

### Account monitoring for atypical usage (AC-2(12))

- The [System owner] shall ensure system accounts are monitored for [Fill in: atypical usage for which to monitor system accounts. Typical: logons at unusual times or from unusual locations, use of dormant accounts, and repeated failed privilege elevation]. (AC-2(12)(a))
- The [System owner] shall ensure atypical usage of system accounts is reported to [Fill in: personnel or roles to report atypical usage. Typical: the security operations team and the system owner]. (AC-2(12)(b))

### Disable accounts for high-risk individuals (AC-2(13))

- The [Account manager] shall disable the accounts of an individual within [Fill in: time period within which to disable accounts of individuals who are discovered to pose significant risk. Typical: 1 hour] of discovery of [Fill in: significant risks leading to disabling accounts. Typical: credible indicators of insider threat, or notice of an adverse personnel action]. (AC-2(13))

### Access enforcement (AC-3)

> **Guidance:** AC-3 is enforced by the system, not by people: the statement makes the system owner accountable for configuring it. Assessors check that the roles and permissions in the system match the access authorizations approved under AC-2.

- The [System owner] shall ensure the system enforces approved authorizations for logical access to information and system resources in accordance with this policy. (AC-3)

### Information flow enforcement (AC-4)

> **Guidance:** Information flow enforcement decides where information may go, not who may see it: firewall and proxy rules, cross-domain and data loss prevention filters, and cloud network policies. The [Boundary Protection Standard](https://kston83.github.io/nist-guide/templates/standards/boundary-protection-standard/) holds the rules; interconnection agreements (CA-3) approve flows to other systems.

- The [System owner] shall ensure the system enforces approved authorizations for controlling the flow of information within the system and between connected systems based on [Fill in: information flow control policies within the system and between connected systems. Typical: the boundary protection standard and the approved interconnection agreements]. (AC-4)

### Flow control of encrypted information (AC-4(4))

- The [System owner] shall ensure encrypted information is prevented from bypassing [Fill in: information flow control mechanisms that encrypted information is prevented from bypassing. Typical: the boundary firewalls and data loss prevention service] by [Select one or more: decrypting the information; blocking the flow of the encrypted information; terminating communications sessions attempting to pass encrypted information; [Assignment: organization-defined procedure or method]. Typical: decrypting the information at the boundary for inspection]. (AC-4(4))

### Separation of duties (AC-5)

- The [System owner] shall identify and document [Fill in: duties of individuals requiring separation. Typical: requesting and approving access; developing and deploying code to production; administering a system and reviewing its audit logs]. (AC-5a)
- The [System owner] shall define system access authorizations that support separation of those duties. (AC-5b)

### Least privilege (AC-6)

- The [System owner] shall ensure users, and processes acting on behalf of users, are granted only the access necessary to accomplish their assigned organizational tasks. (AC-6)

### Authorize access to security functions (AC-6(1))

- The [System owner] shall authorize access to [Fill in: security functions (deployed in hardware, software, and firmware). Typical: account management, audit configuration, security settings and cryptographic key management] only for [Fill in: individuals and roles with authorized access to security functions and security-relevant information. Typical: the system administrators and security personnel named in the system security plan]. (AC-6(1)(a))
- The [System owner] shall authorize access to [Fill in: security-relevant information for authorized access. Typical: audit logs, security configuration settings and access control lists] only for [Fill in: individuals and roles with authorized access to security functions and security-relevant information. Typical: the system administrators and security personnel named in the system security plan]. (AC-6(1)(b))

### Non-privileged access for nonsecurity functions (AC-6(2))

- Users of accounts or roles with access to [Fill in: security functions or security-relevant information, the access to which requires users to use non-privileged accounts to access non-security functions,. Typical: the security functions and security-relevant information authorized under AC-6(1)] shall use non-privileged accounts or roles when accessing nonsecurity functions such as email and web browsing. (AC-6(2))

### Network access to privileged commands (AC-6(3))

- The [System owner] shall authorize network access to [Fill in: privileged commands to which network access is to be authorized only for compelling operational needs. Typical: all privileged commands] only for [Fill in: compelling operational needs necessitating network access to privileged commands. Typical: administration that cannot be performed from a local console or dedicated management network]. (AC-6(3))
- The [System owner] shall document the rationale for such access in the system security plan. (AC-6(3))

### Privileged accounts (AC-6(5))

- The [System owner] shall restrict privileged accounts on the system to [Fill in: personnel or roles to which privileged accounts on the system are to be restricted. Typical: the system administrators named in the system security plan]. (AC-6(5))

### Review of user privileges (AC-6(7))

- The [System owner] shall review [Fill in: the frequency at which to review the privileges assigned to roles or classes of users. Typical: quarterly for privileged roles and at least annually for all other roles] the privileges assigned to [Fill in: roles or classes of users to which privileges are assigned. Typical: all roles and classes of users on the system] to validate the need for them. (AC-6(7)(a))
- The [Account manager] shall reassign or remove privileges the review finds are not needed for the user's mission and business functions. (AC-6(7)(b))

### Log use of privileged functions (AC-6(9))

- The [System owner] shall ensure the system logs the execution of privileged functions. (AC-6(9))

### Prohibit non-privileged users from executing privileged functions (AC-6(10))

- The [System owner] shall ensure the system prevents non-privileged users from executing privileged functions. (AC-6(10))

### Unsuccessful logon attempts (AC-7)

- The [System owner] shall ensure the system enforces a limit of [Fill in: the number of consecutive invalid logon attempts by a user allowed during a time period. Typical: 3] consecutive invalid logon attempts by a user during [Fill in: the time period to which the number of consecutive invalid logon attempts by a user is limited. Typical: 15 minutes]. (AC-7a)
- The [System owner] shall ensure the system automatically takes the following action when the limit is exceeded: [Select one or more: lock the account or node for [Assignment: organization-defined time period]; lock the account or node until released by an administrator; delay next logon prompt per [Assignment: organization-defined delay algorithm]; notify system administrator; take other [Assignment: organization-defined action]. Typical: lock the account or node for 30 minutes, or until released by an administrator for privileged accounts]. (AC-7b)

### System use notification (AC-8)

> **Guidance:** The banner text is usually approved once by legal counsel and reused on every system. The four notices listed in AC-8a are written for U.S. Government systems; the statements below keep the ones that apply to any organization and move the two government-only notices to the federal section.

- The [System owner] shall ensure the system displays [Fill in: system use notification message or banner to be displayed by the system to users before granting access to the system. Typical: the organization's approved logon banner] to users before granting access. (AC-8a)
- The notice shall state that system usage may be monitored, recorded and subject to audit; that unauthorized use of the system is prohibited; and that use of the system indicates consent to monitoring and recording. (AC-8a)
- The [System owner] shall ensure the notice remains on the screen until users acknowledge the usage conditions and take explicit action to log on to or further access the system. (AC-8b)
- For publicly accessible systems, the [System owner] shall ensure the system displays system use information [Fill in: conditions for system use to be displayed by the system before granting further access. Typical: on the landing page, before users submit any information], before granting further access. (AC-8c.1)
- For publicly accessible systems, the [System owner] shall ensure any references to monitoring, recording or auditing are consistent with the privacy accommodations for such systems. (AC-8c.2)
- For publicly accessible systems, the [System owner] shall ensure the notice describes the authorized uses of the system. (AC-8c.3)

#### Federal systems

SP 800-53 Rev. 5 AC-8a requires the notice on federal systems to state two more things ([AC-8](https://kston83.github.io/nist-guide/controls/ac/ac-8/)).

- The notice shall state that users are accessing a U.S. Government system. (AC-8a.1)
- The notice shall state that unauthorized use of the system is subject to criminal and civil penalties. (AC-8a.3)

### Concurrent session control (AC-10)

- The [System owner] shall ensure the system limits the number of concurrent sessions for [Fill in: accounts and/or account types for which to limit the number of concurrent sessions. Typical: privileged accounts] to [Fill in: the number of concurrent sessions to be allowed for each account and/or account type. Typical: one]. (AC-10)

### Device lock (AC-11)

- The [System owner] shall ensure the system prevents further access by [Select one or more: initiating a device lock after [Assignment: organization-defined time period] of inactivity; requiring the user to initiate a device lock before leaving the system unattended. Typical: initiating a device lock after 15 minutes of inactivity, and requiring the user to initiate a device lock before leaving the system unattended]. (AC-11a)
- The [System owner] shall ensure the device lock remains until the user reestablishes access using the established identification and authentication procedures. (AC-11b)

### Pattern-hiding displays (AC-11(1))

- The [System owner] shall ensure the device lock conceals information previously visible on the display with a publicly viewable image. (AC-11(1))

### Session termination (AC-12)

- The [System owner] shall ensure the system automatically terminates a user session after [Fill in: conditions or trigger events requiring session disconnect. Typical: 30 minutes of inactivity for remote and web sessions, or at the end of the maximum session lifetime]. (AC-12)

### Permitted actions without identification or authentication (AC-14)

- The [System owner] shall identify [Fill in: user actions that can be performed on the system without identification or authentication. Typical: viewing public web pages and the logon page] as the only user actions that can be performed on the system without identification or authentication. (AC-14a)
- The [System owner] shall document those actions, with the supporting rationale, in the system security plan. (AC-14b)

### Remote access (AC-17)

> **Guidance:** The [remote access standard](https://kston83.github.io/nist-guide/templates/standards/remote-access-standard/) is where the CISO documents the usage restrictions, configuration and connection requirements and implementation guidance for each allowed method (AC-17a), along with the AC-17(1) to AC-17(4) requirements. Each system's security plan records which of those methods the system owner has authorized (AC-17b).

- The [Chief Information Security Officer] shall establish and document usage restrictions, configuration and connection requirements, and implementation guidance for each type of remote access allowed. (AC-17a)
- The [System owner] shall authorize each type of remote access to the system before allowing such connections. (AC-17b)

### Remote access monitoring and control (AC-17(1))

- The [System owner] shall employ automated mechanisms to monitor and control remote access methods. (AC-17(1))

### Protection of confidentiality and integrity using encryption (AC-17(2))

- The [System owner] shall ensure cryptographic mechanisms protect the confidentiality and integrity of remote access sessions. (AC-17(2))

### Managed access control points (AC-17(3))

- The [System owner] shall ensure remote access is routed through authorized and managed network access control points. (AC-17(3))

### Remote privileged commands and access (AC-17(4))

- The [System owner] shall authorize the execution of privileged commands via remote access only for [Fill in: needs requiring execution of privileged commands via remote access. Typical: emergency administration outside business hours and administration of cloud-hosted components], and only in a format that provides assessable evidence. (AC-17(4)(a))
- The [System owner] shall authorize access to security-relevant information via remote access only for [Fill in: needs requiring access to security-relevant information via remote access. Typical: investigation of security incidents], and only in a format that provides assessable evidence. (AC-17(4)(a))
- The [System owner] shall document the rationale for such remote access in the system security plan. (AC-17(4)(b))

### Wireless access (AC-18)

- The [Chief Information Security Officer] shall establish configuration requirements, connection requirements and implementation guidance for each type of wireless access. (AC-18a)
- The [System owner] shall authorize each type of wireless access to the system before allowing such connections. (AC-18b)

### Wireless authentication and encryption (AC-18(1))

- The [System owner] shall protect wireless access to the system using authentication of [Select one or more: users; devices. Typical: users and devices] and encryption. (AC-18(1))

### Disable wireless networking (AC-18(3))

- The [System owner] shall ensure wireless networking capabilities embedded in system components are disabled before issuance and deployment when not intended for use. (AC-18(3))

### Restrict configurations by users (AC-18(4))

- The [System owner] shall identify and explicitly authorize the users allowed to independently configure wireless networking capabilities. (AC-18(4))

### Antennas and transmission power levels (AC-18(5))

- The [System owner] shall select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside organization-controlled boundaries. (AC-18(5))

### Access control for mobile devices (AC-19)

- The [Chief Information Security Officer] shall establish configuration requirements, connection requirements and implementation guidance for organization-controlled mobile devices, including when devices are outside controlled areas. (AC-19a)
- The [System owner] shall authorize the connection of mobile devices to the system. (AC-19b)

### Full device or container-based encryption (AC-19(5))

- The [Chief Information Security Officer] shall require [Select one: full-device encryption; container-based encryption. Typical: full-device encryption] to protect the confidentiality and integrity of information on [Fill in: mobile devices on which to employ encryption. Typical: all organization-controlled mobile devices]. (AC-19(5))

### Use of external systems (AC-20)

- Before authorized individuals access the system from an external system, or process, store or transmit organization-controlled information on one, the [Chief Information Security Officer] shall [Select one or more: establish [Assignment: organization-defined terms and conditions]; identify [Assignment: organization-defined controls asserted]. Typical: establish terms and conditions in a signed agreement with the organization that owns the external system], consistent with the trust relationship with the organization that owns, operates or maintains the external system. (AC-20a)
- Users shall not use [Fill in: types of external systems prohibited from use. Typical: personally owned devices that the organization does not manage, and public or shared computers] to access the system or to process, store or transmit organization-controlled information. (AC-20b)

### Limits on authorized use (AC-20(1))

- The [System owner] shall permit authorized individuals to use an external system to access the system, or to process, store or transmit organization-controlled information, only after the controls on the external system are verified against the organization's policies and plans, or an approved connection or processing agreement is in place with its owner. (AC-20(1))

### Portable storage devices: restricted use (AC-20(2))

- Authorized individuals shall use organization-controlled portable storage devices on external systems only under [Fill in: restrictions on the use of organization-controlled portable storage devices by authorized individuals on external systems. Typical: use only of encrypted, organization-issued devices, and only for approved business purposes]. (AC-20(2))

### Information sharing (AC-21)

- The [System owner] shall enable authorized users to determine whether the access authorizations of a sharing partner match the information's access and use restrictions for [Fill in: information-sharing circumstances where user discretion is required to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions. Typical: sharing sensitive or contract-restricted information with partners outside the organization]. (AC-21a)
- The [System owner] shall employ [Fill in: automated mechanisms or manual processes that assist users in making information-sharing and collaboration decisions. Typical: information labels and a data-sharing checklist] to assist users in making information sharing and collaboration decisions. (AC-21b)

### Publicly accessible content (AC-22)

- The [System owner] shall designate the individuals authorized to make information publicly accessible. (AC-22a)
- The [System owner] shall ensure those individuals are trained to keep nonpublic information out of publicly accessible content. (AC-22b)
- The designated individuals shall review proposed content for nonpublic information before posting it on the publicly accessible system. (AC-22c)
- The designated individuals shall review the content on the publicly accessible system for nonpublic information [Fill in: the frequency at which to review the content on the publicly accessible system for non-public information. Typical: quarterly]. (AC-22d)
- The designated individuals shall remove nonpublic information when a review discovers it. (AC-22d)

## Review and update

- The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current access control policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current access control policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (AC-1c.1)
- The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current access control procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (AC-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (AC-1a.1(b))