# Access Control Policy

**Template version:** 1.0.0 · **Baseline:** Low · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/ac/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

## Purpose

This policy states what [Organization name] requires for Access Control, and who is accountable for meeting those requirements. (AC-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (AC-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (AC-1a.1(a))
- The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (AC-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (AC-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (AC-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (AC-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (AC-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (AC-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (AC-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (AC-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (AC-1a.1(a))

## Procedures

The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (AC-1a.2)

## Dissemination

- The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the access control policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (AC-1a)
- The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the access control procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (AC-1a)

## Policy statements

### Account management (AC-2)

- The [System owner] shall define and document, for each system, the account types allowed and the account types prohibited. (AC-2a)
- The [System owner] shall assign one or more account managers for each system. (AC-2b)
- The [Account manager] shall require [Fill in: prerequisites and criteria for group and role membership. Typical: a completed access request, a signed access agreement and completed security awareness training] before granting group or role membership. (AC-2c)
- The [Account manager] shall record, for each account, the authorized user, group and role membership, access authorizations and [Fill in: attributes (as required) for each account. Typical: an expiration date for temporary accounts, and time-of-day or location restrictions where the system supports them]. (AC-2d)
- The [Account manager] shall create an account only after approval by [Fill in: personnel or roles required to approve requests to create accounts. Typical: the user's supervisor, plus the system owner or data owner for privileged roles]. (AC-2e)
- The [Account manager] shall create, enable, modify, disable and remove accounts in accordance with this policy and the account management procedure. (AC-2f)
- The [Account manager] shall monitor the use of accounts for activity that does not match the account's type or authorization. (AC-2g)
- The [Supervisor] shall notify the account manager and [Fill in: personnel or roles to be notified. Typical: the system owner and the system security officer] within [Fill in: time period within which to notify account managers when accounts are no longer required. Typical: 5 business days] when a user's account is no longer required. (AC-2h.1)
- The [Human resources office] shall notify the account manager and [Fill in: personnel or roles to be notified. Typical: the system owner and the system security officer] within [Fill in: time period within which to notify account managers when users are terminated or transferred. Typical: 24 hours, or the same day for privileged users] when a user is terminated or transferred. (AC-2h.2)
- The [Supervisor] shall notify the account manager and [Fill in: personnel or roles to be notified. Typical: the system owner and the system security officer] within [Fill in: time period within which to notify account managers when system usage or the need to know changes for an individual. Typical: 5 business days] when a user's system usage or need to know changes. (AC-2h.3)
- The [Account manager] shall authorize access only on the basis of a valid access authorization, the intended system usage and [Fill in: attributes needed to authorize system access (as required). Typical: time-of-day, day-of-week or network location restrictions, where needed]. (AC-2i)
- The [System owner] shall review all accounts on the system for compliance with this policy [Fill in: the frequency of account review. Typical: quarterly for privileged accounts and at least annually for all other accounts]. (AC-2j)
- The [Account manager] shall disable or remove each account the review finds is no longer authorized. (AC-2j)
- The [Account manager] shall change the authenticators of a shared or group account when an individual is removed from the group. (AC-2k)
- The [Chief Information Security Officer] shall ensure account management processes are aligned with personnel termination and transfer processes. (AC-2l)

### Access enforcement (AC-3)

- The [System owner] shall ensure the system enforces approved authorizations for logical access to information and system resources in accordance with this policy. (AC-3)

### Unsuccessful logon attempts (AC-7)

- The [System owner] shall ensure the system enforces a limit of [Fill in: the number of consecutive invalid logon attempts by a user allowed during a time period. Typical: 3] consecutive invalid logon attempts by a user during [Fill in: the time period to which the number of consecutive invalid logon attempts by a user is limited. Typical: 15 minutes]. (AC-7a)
- The [System owner] shall ensure the system automatically takes the following action when the limit is exceeded: [Select one or more: lock the account or node for [Assignment: organization-defined time period]; lock the account or node until released by an administrator; delay next logon prompt per [Assignment: organization-defined delay algorithm]; notify system administrator; take other [Assignment: organization-defined action]. Typical: lock the account or node for 30 minutes, or until released by an administrator for privileged accounts]. (AC-7b)

### System use notification (AC-8)

- The [System owner] shall ensure the system displays [Fill in: system use notification message or banner to be displayed by the system to users before granting access to the system. Typical: the organization's approved logon banner] to users before granting access. (AC-8a)
- The notice shall state that system usage may be monitored, recorded and subject to audit; that unauthorized use of the system is prohibited; and that use of the system indicates consent to monitoring and recording. (AC-8a)
- The [System owner] shall ensure the notice remains on the screen until users acknowledge the usage conditions and take explicit action to log on to or further access the system. (AC-8b)
- For publicly accessible systems, the [System owner] shall ensure the system displays system use information [Fill in: conditions for system use to be displayed by the system before granting further access. Typical: on the landing page, before users submit any information], before granting further access. (AC-8c.1)
- For publicly accessible systems, the [System owner] shall ensure any references to monitoring, recording or auditing are consistent with the privacy accommodations for such systems. (AC-8c.2)
- For publicly accessible systems, the [System owner] shall ensure the notice describes the authorized uses of the system. (AC-8c.3)

#### Federal systems

SP 800-53 Rev. 5 AC-8a requires the notice on federal systems to state two more things ([AC-8](https://kston83.github.io/nist-guide/controls/ac/ac-8/)).

- The notice shall state that users are accessing a U.S. Government system. (AC-8a.1)
- The notice shall state that unauthorized use of the system is subject to criminal and civil penalties. (AC-8a.3)

### Permitted actions without identification or authentication (AC-14)

- The [System owner] shall identify [Fill in: user actions that can be performed on the system without identification or authentication. Typical: viewing public web pages and the logon page] as the only user actions that can be performed on the system without identification or authentication. (AC-14a)
- The [System owner] shall document those actions, with the supporting rationale, in the system security plan. (AC-14b)

### Remote access (AC-17)

- The [Chief Information Security Officer] shall establish and document usage restrictions, configuration and connection requirements, and implementation guidance for each type of remote access allowed. (AC-17a)
- The [System owner] shall authorize each type of remote access to the system before allowing such connections. (AC-17b)

### Wireless access (AC-18)

- The [Chief Information Security Officer] shall establish configuration requirements, connection requirements and implementation guidance for each type of wireless access. (AC-18a)
- The [System owner] shall authorize each type of wireless access to the system before allowing such connections. (AC-18b)

### Access control for mobile devices (AC-19)

- The [Chief Information Security Officer] shall establish configuration requirements, connection requirements and implementation guidance for organization-controlled mobile devices, including when devices are outside controlled areas. (AC-19a)
- The [System owner] shall authorize the connection of mobile devices to the system. (AC-19b)

### Use of external systems (AC-20)

- Before authorized individuals access the system from an external system, or process, store or transmit organization-controlled information on one, the [Chief Information Security Officer] shall [Select one or more: establish [Assignment: organization-defined terms and conditions]; identify [Assignment: organization-defined controls asserted]. Typical: establish terms and conditions in a signed agreement with the organization that owns the external system], consistent with the trust relationship with the organization that owns, operates or maintains the external system. (AC-20a)
- Users shall not use [Fill in: types of external systems prohibited from use. Typical: personally owned devices that the organization does not manage, and public or shared computers] to access the system or to process, store or transmit organization-controlled information. (AC-20b)

### Publicly accessible content (AC-22)

- The [System owner] shall designate the individuals authorized to make information publicly accessible. (AC-22a)
- The [System owner] shall ensure those individuals are trained to keep nonpublic information out of publicly accessible content. (AC-22b)
- The designated individuals shall review proposed content for nonpublic information before posting it on the publicly accessible system. (AC-22c)
- The designated individuals shall review the content on the publicly accessible system for nonpublic information [Fill in: the frequency at which to review the content on the publicly accessible system for non-public information. Typical: quarterly]. (AC-22d)
- The designated individuals shall remove nonpublic information when a review discovers it. (AC-22d)

## Review and update

- The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current access control policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current access control policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (AC-1c.1)
- The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current access control procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (AC-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (AC-1a.1(b))