# Access Control Policy

**Template version:** 1.0.0 · **Baseline:** Privacy · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/ac/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

## Purpose

This policy states what [Organization name] requires for Access Control, and who is accountable for meeting those requirements. (AC-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (AC-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (AC-1a.1(a))
- The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (AC-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (AC-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (AC-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (AC-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (AC-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (AC-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (AC-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (AC-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (AC-1a.1(a))

## Procedures

The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (AC-1a.2)

## Dissemination

- The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the access control policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (AC-1a)
- The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the access control procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (AC-1a)

## Policy statements

### Individual access (AC-3(14))

- For a system that processes personally identifiable information, the [System owner] shall provide [Fill in: mechanisms enabling individuals to have access to elements of their personally identifiable information. Typical: a request process described in the privacy notice, with identity verification before any information is released, and a self-service page where the system offers one] to enable individuals to have access to the following elements of their personally identifiable information: [Fill in: elements of personally identifiable information to which individuals have access. Typical: all personally identifiable information about the individual that the system holds, except elements a law, regulation or legal hold exempts from access, as the senior privacy official and legal counsel determine]. (AC-3(14))
- The [Senior privacy official], with legal counsel, shall approve the access mechanisms and any limits on the elements available, and the [System owner] shall record them in the privacy impact assessment. (AC-3(14))
- The [System owner] shall ensure the identity of each requester, or the authority of their designated representative, is verified at an assurance level suited to the sensitivity of the information before any information is released. (AC-3(14))
- The [Senior privacy official] shall ensure each access request is answered, and that a refusal or a partial release is given in writing with the reason and how to appeal. (AC-3(14))

#### Federal systems

The Privacy Act requires each agency that maintains a system of records, upon request by any individual to gain access to their record or to any information about them in the system, to permit the individual, and upon request a person of their own choosing to accompany them, to review the record and have a copy made of all or any portion of it in a form comprehensible to them; the agency may require a written statement authorizing discussion of the record in the accompanying person's presence ([5 U.S.C. § 552a(d)(1)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). Each system of records notice must describe the agency procedures by which an individual can learn how to gain access to a record about them and how to contest its content (§ 552a(e)(4)(H)). The agency's Privacy Act rules must establish procedures for notifying individuals whether a system of records contains a record about them, define reasonable times, places and requirements for identifying requesters, establish procedures for disclosure to individuals, and set any fees for copies, excluding the cost of search and review (§ 552a(f)). Nothing in the section allows access to information compiled in reasonable anticipation of a civil action or proceeding (§ 552a(d)(5)), and subsections (j) and (k) let an agency exempt some systems of records from the access provisions by rule. Text checked in the United States Code, 2024 edition, as of October 2026.

- For each system of records, the [Senior privacy official] shall ensure that individuals can review, and have a copy made of, their records in a form comprehensible to them, accompanied by a person of their choosing on request, as 5 U.S.C. § 552a(d)(1) requires, except for information § 552a(d)(5) excludes and systems the agency has exempted by rule under § 552a(j) or (k). (AC-3(14))
- The access mechanisms for each system of records shall follow the agency's Privacy Act rules under 5 U.S.C. § 552a(f), and its system of records notice shall describe them as § 552a(e)(4)(H) requires. (AC-3(14))

## Review and update

- The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current access control policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current access control policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (AC-1c.1)
- The [Fill in: an official to manage the access control policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current access control procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (AC-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (AC-1a.1(b))