# Access Control Policy

**Template version:** 1.0.0 · **Baseline:** Low · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/ac/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The sections before and after Policy statements meet AC-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the AC-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

## Purpose

This policy states what [Organization name] requires for Access Control, and who is accountable for meeting those requirements. (AC-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (AC-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (AC-1a.1(a))
- The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (AC-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (AC-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (AC-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (AC-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (AC-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (AC-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (AC-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (AC-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (AC-1a.1(a))

## Procedures

The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (AC-1a.2)

## Dissemination

- The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the access control policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (AC-1a)
- The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the access control procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (AC-1a)

## Policy statements

> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

### Account management (AC-2)

> **Guidance:** AC-2 makes account management a controlled life cycle: every account has a known type, an owner, an approval and a removal trigger. Each statement below maps to one lettered item of the control. Assessors test these by sampling account requests, recent departures and the last access review, so keep the records each statement implies.

- The [System owner] shall define and document, for each system, the account types allowed and the account types prohibited. (AC-2a)
- The [System owner] shall assign one or more account managers for each system. (AC-2b)
- The [Account manager] shall require [Fill in: prerequisites and criteria for group and role membership. Typical: a completed access request, a signed access agreement and completed security awareness training] before granting group or role membership. (AC-2c)
- The [Account manager] shall record, for each account, the authorized user, group and role membership, access authorizations and [Fill in: attributes (as required) for each account. Typical: an expiration date for temporary accounts, and time-of-day or location restrictions where the system supports them]. (AC-2d)
- The [Account manager] shall create an account only after approval by [Fill in: personnel or roles required to approve requests to create accounts. Typical: the user's supervisor, plus the system owner or data owner for privileged roles]. (AC-2e)
- The [Account manager] shall create, enable, modify, disable and remove accounts in accordance with this policy and the account management procedure. (AC-2f)
- The [Account manager] shall monitor the use of accounts for activity that does not match the account's type or authorization. (AC-2g)
- The [Supervisor] shall notify the account manager and [Fill in: personnel or roles to be notified. Typical: the system owner and the system security officer] within [Fill in: time period within which to notify account managers when accounts are no longer required. Typical: 5 business days] when a user's account is no longer required. (AC-2h.1)
- The [Human resources office] shall notify the account manager and [Fill in: personnel or roles to be notified. Typical: the system owner and the system security officer] within [Fill in: time period within which to notify account managers when users are terminated or transferred. Typical: 24 hours, or the same day for privileged users] when a user is terminated or transferred. (AC-2h.2)
- The [Supervisor] shall notify the account manager and [Fill in: personnel or roles to be notified. Typical: the system owner and the system security officer] within [Fill in: time period within which to notify account managers when system usage or the need to know changes for an individual. Typical: 5 business days] when a user's system usage or need to know changes. (AC-2h.3)
- The [Account manager] shall authorize access only on the basis of a valid access authorization, the intended system usage and [Fill in: attributes needed to authorize system access (as required). Typical: time-of-day, day-of-week or network location restrictions, where needed]. (AC-2i)
- The [System owner] shall review all accounts on the system for compliance with this policy [Fill in: the frequency of account review. Typical: quarterly for privileged accounts and at least annually for all other accounts]. (AC-2j)
- The [Account manager] shall disable or remove each account the review finds is no longer authorized. (AC-2j)
- The [Account manager] shall change the authenticators of a shared or group account when an individual is removed from the group. (AC-2k)
- The [Chief Information Security Officer] shall ensure account management processes are aligned with personnel termination and transfer processes. (AC-2l)

> **Guidance:** Where the organization does not use shared or group accounts, keep the AC-2k statement and note in the system security plan that none are deployed; the assessor will still ask. Evidence for AC-2l is usually an automated feed from the human resources system to the identity provider, or a documented handoff in the [onboarding, transfer and termination checklist](https://kston83.github.io/nist-guide/templates/forms/onboarding-transfer-and-termination-checklist/) (PS-4). The [account management procedure](https://kston83.github.io/nist-guide/templates/procedures/account-management-procedure/) carries out these statements step by step; the [access request form](https://kston83.github.io/nist-guide/templates/forms/access-request-form/) and the [access review record](https://kston83.github.io/nist-guide/templates/forms/access-review-record/) are the records assessors sample for AC-2e and AC-2j.

### Access enforcement (AC-3)

> **Guidance:** AC-3 is enforced by the system, not by people: the statement makes the system owner accountable for configuring it. Assessors check that the roles and permissions in the system match the access authorizations approved under AC-2.

- The [System owner] shall ensure the system enforces approved authorizations for logical access to information and system resources in accordance with this policy. (AC-3)

### Unsuccessful logon attempts (AC-7)

- The [System owner] shall ensure the system enforces a limit of [Fill in: the number of consecutive invalid logon attempts by a user allowed during a time period. Typical: 3] consecutive invalid logon attempts by a user during [Fill in: the time period to which the number of consecutive invalid logon attempts by a user is limited. Typical: 15 minutes]. (AC-7a)
- The [System owner] shall ensure the system automatically takes the following action when the limit is exceeded: [Select one or more: lock the account or node for [Assignment: organization-defined time period]; lock the account or node until released by an administrator; delay next logon prompt per [Assignment: organization-defined delay algorithm]; notify system administrator; take other [Assignment: organization-defined action]. Typical: lock the account or node for 30 minutes, or until released by an administrator for privileged accounts]. (AC-7b)

### System use notification (AC-8)

> **Guidance:** The banner text is usually approved once by legal counsel and reused on every system. The four notices listed in AC-8a are written for U.S. Government systems; the statements below keep the ones that apply to any organization and move the two government-only notices to the federal section.

- The [System owner] shall ensure the system displays [Fill in: system use notification message or banner to be displayed by the system to users before granting access to the system. Typical: the organization's approved logon banner] to users before granting access. (AC-8a)
- The notice shall state that system usage may be monitored, recorded and subject to audit; that unauthorized use of the system is prohibited; and that use of the system indicates consent to monitoring and recording. (AC-8a)
- The [System owner] shall ensure the notice remains on the screen until users acknowledge the usage conditions and take explicit action to log on to or further access the system. (AC-8b)
- For publicly accessible systems, the [System owner] shall ensure the system displays system use information [Fill in: conditions for system use to be displayed by the system before granting further access. Typical: on the landing page, before users submit any information], before granting further access. (AC-8c.1)
- For publicly accessible systems, the [System owner] shall ensure any references to monitoring, recording or auditing are consistent with the privacy accommodations for such systems. (AC-8c.2)
- For publicly accessible systems, the [System owner] shall ensure the notice describes the authorized uses of the system. (AC-8c.3)

#### Federal systems

SP 800-53 Rev. 5 AC-8a requires the notice on federal systems to state two more things ([AC-8](https://kston83.github.io/nist-guide/controls/ac/ac-8/)).

- The notice shall state that users are accessing a U.S. Government system. (AC-8a.1)
- The notice shall state that unauthorized use of the system is subject to criminal and civil penalties. (AC-8a.3)

### Permitted actions without identification or authentication (AC-14)

- The [System owner] shall identify [Fill in: user actions that can be performed on the system without identification or authentication. Typical: viewing public web pages and the logon page] as the only user actions that can be performed on the system without identification or authentication. (AC-14a)
- The [System owner] shall document those actions, with the supporting rationale, in the system security plan. (AC-14b)

### Remote access (AC-17)

> **Guidance:** The [remote access standard](https://kston83.github.io/nist-guide/templates/standards/remote-access-standard/) is where the CISO documents the usage restrictions, configuration and connection requirements and implementation guidance for each allowed method (AC-17a), along with the AC-17(1) to AC-17(4) requirements. Each system's security plan records which of those methods the system owner has authorized (AC-17b).

- The [Chief Information Security Officer] shall establish and document usage restrictions, configuration and connection requirements, and implementation guidance for each type of remote access allowed. (AC-17a)
- The [System owner] shall authorize each type of remote access to the system before allowing such connections. (AC-17b)

### Wireless access (AC-18)

- The [Chief Information Security Officer] shall establish configuration requirements, connection requirements and implementation guidance for each type of wireless access. (AC-18a)
- The [System owner] shall authorize each type of wireless access to the system before allowing such connections. (AC-18b)

### Access control for mobile devices (AC-19)

- The [Chief Information Security Officer] shall establish configuration requirements, connection requirements and implementation guidance for organization-controlled mobile devices, including when devices are outside controlled areas. (AC-19a)
- The [System owner] shall authorize the connection of mobile devices to the system. (AC-19b)

### Use of external systems (AC-20)

- Before authorized individuals access the system from an external system, or process, store or transmit organization-controlled information on one, the [Chief Information Security Officer] shall [Select one or more: establish [Assignment: organization-defined terms and conditions]; identify [Assignment: organization-defined controls asserted]. Typical: establish terms and conditions in a signed agreement with the organization that owns the external system], consistent with the trust relationship with the organization that owns, operates or maintains the external system. (AC-20a)
- Users shall not use [Fill in: types of external systems prohibited from use. Typical: personally owned devices that the organization does not manage, and public or shared computers] to access the system or to process, store or transmit organization-controlled information. (AC-20b)

### Publicly accessible content (AC-22)

- The [System owner] shall designate the individuals authorized to make information publicly accessible. (AC-22a)
- The [System owner] shall ensure those individuals are trained to keep nonpublic information out of publicly accessible content. (AC-22b)
- The designated individuals shall review proposed content for nonpublic information before posting it on the publicly accessible system. (AC-22c)
- The designated individuals shall review the content on the publicly accessible system for nonpublic information [Fill in: the frequency at which to review the content on the publicly accessible system for non-public information. Typical: quarterly]. (AC-22d)
- The designated individuals shall remove nonpublic information when a review discovers it. (AC-22d)

## Review and update

- The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current access control policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current access control policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (AC-1c.1)
- The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current access control procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (AC-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (AC-1a.1(b))