Access Control Policy

Access Control Policy template: Ready-to-adopt Access Control policy template for NIST SP 800-53 Rev. 5, with a statement group for each control and a variant per baseline (Low, Moderate, High, Privacy).

Type	Program stage	Status	Template version	NIST basis
Policy	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The Access Control policy states what the organization requires for access control and who is accountable for it. It meets AC-1 through the sections every family policy shares, and adds one statement group per control. Each baseline variant includes only the controls in that baseline, taken from the NIST SP 800-53B profiles.

Adopt the ready-to-adopt edition: fill every highlighted field, delete any “Federal systems” section that does not apply, and have the accountable official approve it. The annotated edition adds guidance on why each section exists and what assessors look for.

Controls satisfied

“Yes” marks the baseline variants that include the control’s statements. AC-1 is met by the common sections.

Control	Title	Low	Moderate	High	Privacy
AC-1	Policy and Procedures	Yes	Yes	Yes	Yes
AC-2	Account Management	Yes	Yes	Yes
AC-2(1)	Automated System Account Management		Yes	Yes
AC-2(2)	Automated Temporary and Emergency Account Management		Yes	Yes
AC-2(3)	Disable Accounts		Yes	Yes
AC-2(4)	Automated Audit Actions		Yes	Yes
AC-2(5)	Inactivity Logout		Yes	Yes
AC-2(11)	Usage Conditions			Yes
AC-2(12)	Account Monitoring for Atypical Usage			Yes
AC-2(13)	Disable Accounts for High-risk Individuals		Yes	Yes
AC-3	Access Enforcement	Yes	Yes	Yes
AC-3(14)	Individual Access				Yes
AC-4	Information Flow Enforcement		Yes	Yes
AC-4(4)	Flow Control of Encrypted Information			Yes
AC-5	Separation of Duties		Yes	Yes
AC-6	Least Privilege		Yes	Yes
AC-6(1)	Authorize Access to Security Functions		Yes	Yes
AC-6(2)	Non-privileged Access for Nonsecurity Functions		Yes	Yes
AC-6(3)	Network Access to Privileged Commands			Yes
AC-6(5)	Privileged Accounts		Yes	Yes
AC-6(7)	Review of User Privileges		Yes	Yes
AC-6(9)	Log Use of Privileged Functions		Yes	Yes
AC-6(10)	Prohibit Non-privileged Users from Executing Privileged Functions		Yes	Yes
AC-7	Unsuccessful Logon Attempts	Yes	Yes	Yes
AC-8	System Use Notification	Yes	Yes	Yes
AC-10	Concurrent Session Control			Yes
AC-11	Device Lock		Yes	Yes
AC-11(1)	Pattern-hiding Displays		Yes	Yes
AC-12	Session Termination		Yes	Yes
AC-14	Permitted Actions Without Identification or Authentication	Yes	Yes	Yes
AC-17	Remote Access	Yes	Yes	Yes
AC-17(1)	Monitoring and Control		Yes	Yes
AC-17(2)	Protection of Confidentiality and Integrity Using Encryption		Yes	Yes
AC-17(3)	Managed Access Control Points		Yes	Yes
AC-17(4)	Privileged Commands and Access		Yes	Yes
AC-18	Wireless Access	Yes	Yes	Yes
AC-18(1)	Authentication and Encryption		Yes	Yes
AC-18(3)	Disable Wireless Networking		Yes	Yes
AC-18(4)	Restrict Configurations by Users			Yes
AC-18(5)	Antennas and Transmission Power Levels			Yes
AC-19	Access Control for Mobile Devices	Yes	Yes	Yes
AC-19(5)	Full Device or Container-based Encryption		Yes	Yes
AC-20	Use of External Systems	Yes	Yes	Yes
AC-20(1)	Limits on Authorized Use		Yes	Yes
AC-20(2)	Portable Storage Devices — Restricted Use		Yes	Yes
AC-21	Information Sharing		Yes	Yes
AC-22	Publicly Accessible Content	Yes	Yes	Yes

Decisions to make first

The policy has 75 organization-defined parameters across all variants; each appears as a highlighted field with its typical value where one is given. Settle these first:

Decision	Controls	Typical	Who decides
Which account types are allowed on each system, and which are prohibited?	AC-2	Individual, privileged, service and emergency accounts allowed with a named owner; shared and guest accounts prohibited unless the system owner approves an exception.	System owner
Which remote access methods are allowed, and for whom?	AC-17, AC-17(3)	An organization-managed VPN or zero trust access service with multifactor authentication for all remote users; no remote desktop exposed directly to the internet.	Chief Information Security Officer
Which identity provider is the authoritative source for accounts?	AC-2	The organization’s central directory or identity provider, fed by the human resources system.	Chief Information Security Officer

Record your values in the Access Control decision worksheet, which lists every parameter with its typical value.

Downloads

Variant	Ready to adopt	Annotated
Low	Word · Markdown	Word · Markdown
Moderate	Word · Markdown	Word · Markdown
High	Word · Markdown	Word · Markdown
Privacy	Word · Markdown	Word · Markdown

Everything for this family in one file: AC pack (.zip), with every variant and edition of the policy and the decision worksheets.

Preview (Moderate baseline, annotated)

Guidance

The sections before and after Policy statements meet AC-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the AC-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

Purpose

This policy states what Organization name requires for Access Control, and who is accountable for meeting those requirements. (AC-1a.1(a))

Scope

This policy applies at the Select one or more: organization-level; mission/business process-level; system-level Typical: organization-level to every system that Organization name owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (AC-1a.1(a))

Roles and responsibilities

• The Chief Information Security Officer is accountable for this policy and shall approve exceptions to it. (AC-1a.1(a))
• The Fill in: an official to manage the access control policy and procedures Typical: Chief Information Security Officer shall manage the development, documentation and dissemination of this policy and its procedures. (AC-1b)
• Each System owner shall implement this policy for their system and document how in the system security plan. (AC-1a.1(a))
• Each person within scope shall follow this policy and report suspected violations to the Chief Information Security Officer. (AC-1a.1(a))

Management commitment

The Senior leader approves this policy and shall provide the resources needed to implement it. (AC-1a.1(a))

Coordination

The Chief Information Security Officer shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (AC-1a.1(a))

Compliance

• This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to Organization name, including Fill in: laws, regulations and standards that apply to the organization. (AC-1a.1(b))
• The Chief Information Security Officer shall review compliance with this policy through the organization’s assessment and continuous monitoring activities. (AC-1a.1(a))
• An exception to this policy shall be requested in writing, approved by the Chief Information Security Officer, time-limited and recorded with its compensating measures. (AC-1a.1(a))
• Violations of this policy shall be handled through the organization’s sanctions process. (AC-1a.1(a))

Procedures

The Fill in: an official to manage the access control policy and procedures Typical: Chief Information Security Officer shall ensure that documented procedures exist to implement this policy and its associated controls. (AC-1a.2)

Dissemination

• The Fill in: an official to manage the access control policy and procedures Typical: Chief Information Security Officer shall disseminate this policy to Fill in: personnel or roles to whom the access control policy is to be disseminated Typical: everyone within its scope, through the policy library. (AC-1a)
• The Fill in: an official to manage the access control policy and procedures Typical: Chief Information Security Officer shall disseminate the procedures that implement this policy to Fill in: personnel or roles to whom the access control procedures are to be disseminated Typical: the people who carry them out, and the system owners. (AC-1a)

Policy statements

Guidance

Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

Account management (AC-2)

Guidance

AC-2 makes account management a controlled life cycle: every account has a known type, an owner, an approval and a removal trigger. Each statement below maps to one lettered item of the control. Assessors test these by sampling account requests, recent departures and the last access review, so keep the records each statement implies.

• The System owner shall define and document, for each system, the account types allowed and the account types prohibited. (AC-2a)
• The System owner shall assign one or more account managers for each system. (AC-2b)
• The Account manager shall require Fill in: prerequisites and criteria for group and role membership Typical: a completed access request, a signed access agreement and completed security awareness training before granting group or role membership. (AC-2c)
• The Account manager shall record, for each account, the authorized user, group and role membership, access authorizations and Fill in: attributes (as required) for each account Typical: an expiration date for temporary accounts, and time-of-day or location restrictions where the system supports them. (AC-2d)
• The Account manager shall create an account only after approval by Fill in: personnel or roles required to approve requests to create accounts Typical: the user’s supervisor, plus the system owner or data owner for privileged roles. (AC-2e)
• The Account manager shall create, enable, modify, disable and remove accounts in accordance with this policy and the account management procedure. (AC-2f)
• The Account manager shall monitor the use of accounts for activity that does not match the account’s type or authorization. (AC-2g)
• The Supervisor shall notify the account manager and Fill in: personnel or roles to be notified Typical: the system owner and the system security officer within Fill in: time period within which to notify account managers when accounts are no longer required Typical: 5 business days when a user’s account is no longer required. (AC-2h.1)
• The Human resources office shall notify the account manager and Fill in: personnel or roles to be notified Typical: the system owner and the system security officer within Fill in: time period within which to notify account managers when users are terminated or transferred Typical: 24 hours, or the same day for privileged users when a user is terminated or transferred. (AC-2h.2)
• The Supervisor shall notify the account manager and Fill in: personnel or roles to be notified Typical: the system owner and the system security officer within Fill in: time period within which to notify account managers when system usage or the need to know changes for an individual Typical: 5 business days when a user’s system usage or need to know changes. (AC-2h.3)
• The Account manager shall authorize access only on the basis of a valid access authorization, the intended system usage and Fill in: attributes needed to authorize system access (as required) Typical: time-of-day, day-of-week or network location restrictions, where needed. (AC-2i)
• The System owner shall review all accounts on the system for compliance with this policy Fill in: the frequency of account review Typical: quarterly for privileged accounts and at least annually for all other accounts. (AC-2j)
• The Account manager shall disable or remove each account the review finds is no longer authorized. (AC-2j)
• The Account manager shall change the authenticators of a shared or group account when an individual is removed from the group. (AC-2k)
• The Chief Information Security Officer shall ensure account management processes are aligned with personnel termination and transfer processes. (AC-2l)

Guidance

Where the organization does not use shared or group accounts, keep the AC-2k statement and note in the system security plan that none are deployed; the assessor will still ask. Evidence for AC-2l is usually an automated feed from the human resources system to the identity provider, or a documented handoff in the onboarding, transfer and termination checklist (PS-4). The account management procedure carries out these statements step by step; the access request form and the access review record are the records assessors sample for AC-2e and AC-2j.

Automated system account management (AC-2(1))

• The System owner shall support the management of system accounts using Fill in: automated mechanisms used to support the management of system accounts Typical: the organization’s identity provider and its provisioning workflows. (AC-2(1))

Automated temporary and emergency account management (AC-2(2))

• The System owner shall ensure the system automatically Select one: remove; disable Typical: disable temporary and emergency accounts after Fill in: the time period after which to automatically remove or disable temporary or emergency accounts Typical: 72 hours for emergency accounts, and the end date approved at creation for temporary accounts. (AC-2(2))

Disable accounts (AC-2(3))

• The Account manager shall disable an account within Fill in: time period within which to disable accounts Typical: 1 business day when the account has expired. (AC-2(3)(a))
• The Account manager shall disable an account within Fill in: time period within which to disable accounts Typical: 1 business day when it is no longer associated with a user or individual. (AC-2(3)(b))
• The Account manager shall disable an account within Fill in: time period within which to disable accounts Typical: 1 business day when it is in violation of organizational policy. (AC-2(3)(c))
• The System owner shall ensure the system disables an account that has been inactive for Fill in: time period for account inactivity before disabling Typical: 90 days. (AC-2(3)(d))

Automated audit actions (AC-2(4))

• The System owner shall ensure the system automatically audits account creation, modification, enabling, disabling and removal actions. (AC-2(4))

Inactivity logout (AC-2(5))

• Each user shall log out Fill in: the time period of expected inactivity or description of when to log out Typical: at the end of each work session, and when leaving the device unattended for longer than the device lock period. (AC-2(5))

Disable accounts for high-risk individuals (AC-2(13))

• The Account manager shall disable the accounts of an individual within Fill in: time period within which to disable accounts of individuals who are discovered to pose significant risk Typical: 1 hour of discovery of Fill in: significant risks leading to disabling accounts Typical: credible indicators of insider threat, or notice of an adverse personnel action. (AC-2(13))

Access enforcement (AC-3)

Guidance

AC-3 is enforced by the system, not by people: the statement makes the system owner accountable for configuring it. Assessors check that the roles and permissions in the system match the access authorizations approved under AC-2.

• The System owner shall ensure the system enforces approved authorizations for logical access to information and system resources in accordance with this policy. (AC-3)

Information flow enforcement (AC-4)

Guidance

Information flow enforcement decides where information may go, not who may see it: firewall and proxy rules, cross-domain and data loss prevention filters, and cloud network policies. The Boundary Protection Standard holds the rules; interconnection agreements (CA-3) approve flows to other systems.

• The System owner shall ensure the system enforces approved authorizations for controlling the flow of information within the system and between connected systems based on Fill in: information flow control policies within the system and between connected systems Typical: the boundary protection standard and the approved interconnection agreements. (AC-4)

Separation of duties (AC-5)

• The System owner shall identify and document Fill in: duties of individuals requiring separation Typical: requesting and approving access; developing and deploying code to production; administering a system and reviewing its audit logs. (AC-5a)
• The System owner shall define system access authorizations that support separation of those duties. (AC-5b)

Least privilege (AC-6)

• The System owner shall ensure users, and processes acting on behalf of users, are granted only the access necessary to accomplish their assigned organizational tasks. (AC-6)

Authorize access to security functions (AC-6(1))

• The System owner shall authorize access to Fill in: security functions (deployed in hardware, software, and firmware) Typical: account management, audit configuration, security settings and cryptographic key management only for Fill in: individuals and roles with authorized access to security functions and security-relevant information Typical: the system administrators and security personnel named in the system security plan. (AC-6(1)(a))
• The System owner shall authorize access to Fill in: security-relevant information for authorized access Typical: audit logs, security configuration settings and access control lists only for Fill in: individuals and roles with authorized access to security functions and security-relevant information Typical: the system administrators and security personnel named in the system security plan. (AC-6(1)(b))

Non-privileged access for nonsecurity functions (AC-6(2))

• Users of accounts or roles with access to Fill in: security functions or security-relevant information, the access to which requires users to use non-privileged accounts to access non-security functions, Typical: the security functions and security-relevant information authorized under AC-6(1) shall use non-privileged accounts or roles when accessing nonsecurity functions such as email and web browsing. (AC-6(2))

Privileged accounts (AC-6(5))

• The System owner shall restrict privileged accounts on the system to Fill in: personnel or roles to which privileged accounts on the system are to be restricted Typical: the system administrators named in the system security plan. (AC-6(5))

Review of user privileges (AC-6(7))

• The System owner shall review Fill in: the frequency at which to review the privileges assigned to roles or classes of users Typical: quarterly for privileged roles and at least annually for all other roles the privileges assigned to Fill in: roles or classes of users to which privileges are assigned Typical: all roles and classes of users on the system to validate the need for them. (AC-6(7)(a))
• The Account manager shall reassign or remove privileges the review finds are not needed for the user’s mission and business functions. (AC-6(7)(b))

Log use of privileged functions (AC-6(9))

• The System owner shall ensure the system logs the execution of privileged functions. (AC-6(9))

Prohibit non-privileged users from executing privileged functions (AC-6(10))

• The System owner shall ensure the system prevents non-privileged users from executing privileged functions. (AC-6(10))

Unsuccessful logon attempts (AC-7)

• The System owner shall ensure the system enforces a limit of Fill in: the number of consecutive invalid logon attempts by a user allowed during a time period Typical: 3 consecutive invalid logon attempts by a user during Fill in: the time period to which the number of consecutive invalid logon attempts by a user is limited Typical: 15 minutes. (AC-7a)
• The System owner shall ensure the system automatically takes the following action when the limit is exceeded: Select one or more: lock the account or node for [Assignment: organization-defined time period]; lock the account or node until released by an administrator; delay next logon prompt per [Assignment: organization-defined delay algorithm]; notify system administrator; take other [Assignment: organization-defined action] Typical: lock the account or node for 30 minutes, or until released by an administrator for privileged accounts. (AC-7b)

System use notification (AC-8)

Guidance

The banner text is usually approved once by legal counsel and reused on every system. The four notices listed in AC-8a are written for U.S. Government systems; the statements below keep the ones that apply to any organization and move the two government-only notices to the federal section.

• The System owner shall ensure the system displays Fill in: system use notification message or banner to be displayed by the system to users before granting access to the system Typical: the organization’s approved logon banner to users before granting access. (AC-8a)
• The notice shall state that system usage may be monitored, recorded and subject to audit; that unauthorized use of the system is prohibited; and that use of the system indicates consent to monitoring and recording. (AC-8a)
• The System owner shall ensure the notice remains on the screen until users acknowledge the usage conditions and take explicit action to log on to or further access the system. (AC-8b)
• For publicly accessible systems, the System owner shall ensure the system displays system use information Fill in: conditions for system use to be displayed by the system before granting further access Typical: on the landing page, before users submit any information, before granting further access. (AC-8c.1)
• For publicly accessible systems, the System owner shall ensure any references to monitoring, recording or auditing are consistent with the privacy accommodations for such systems. (AC-8c.2)
• For publicly accessible systems, the System owner shall ensure the notice describes the authorized uses of the system. (AC-8c.3)

Federal systems

SP 800-53 Rev. 5 AC-8a requires the notice on federal systems to state two more things (AC-8).

• The notice shall state that users are accessing a U.S. Government system. (AC-8a.1)
• The notice shall state that unauthorized use of the system is subject to criminal and civil penalties. (AC-8a.3)

Device lock (AC-11)

• The System owner shall ensure the system prevents further access by Select one or more: initiating a device lock after [Assignment: organization-defined time period] of inactivity; requiring the user to initiate a device lock before leaving the system unattended Typical: initiating a device lock after 15 minutes of inactivity, and requiring the user to initiate a device lock before leaving the system unattended. (AC-11a)
• The System owner shall ensure the device lock remains until the user reestablishes access using the established identification and authentication procedures. (AC-11b)

Pattern-hiding displays (AC-11(1))

• The System owner shall ensure the device lock conceals information previously visible on the display with a publicly viewable image. (AC-11(1))

Session termination (AC-12)

• The System owner shall ensure the system automatically terminates a user session after Fill in: conditions or trigger events requiring session disconnect Typical: 30 minutes of inactivity for remote and web sessions, or at the end of the maximum session lifetime. (AC-12)

Permitted actions without identification or authentication (AC-14)

• The System owner shall identify Fill in: user actions that can be performed on the system without identification or authentication Typical: viewing public web pages and the logon page as the only user actions that can be performed on the system without identification or authentication. (AC-14a)
• The System owner shall document those actions, with the supporting rationale, in the system security plan. (AC-14b)

Remote access (AC-17)

Guidance

The remote access standard is where the CISO documents the usage restrictions, configuration and connection requirements and implementation guidance for each allowed method (AC-17a), along with the AC-17(1) to AC-17(4) requirements. Each system’s security plan records which of those methods the system owner has authorized (AC-17b).

• The Chief Information Security Officer shall establish and document usage restrictions, configuration and connection requirements, and implementation guidance for each type of remote access allowed. (AC-17a)
• The System owner shall authorize each type of remote access to the system before allowing such connections. (AC-17b)

Remote access monitoring and control (AC-17(1))

• The System owner shall employ automated mechanisms to monitor and control remote access methods. (AC-17(1))

Protection of confidentiality and integrity using encryption (AC-17(2))

• The System owner shall ensure cryptographic mechanisms protect the confidentiality and integrity of remote access sessions. (AC-17(2))

Managed access control points (AC-17(3))

• The System owner shall ensure remote access is routed through authorized and managed network access control points. (AC-17(3))

Remote privileged commands and access (AC-17(4))

• The System owner shall authorize the execution of privileged commands via remote access only for Fill in: needs requiring execution of privileged commands via remote access Typical: emergency administration outside business hours and administration of cloud-hosted components, and only in a format that provides assessable evidence. (AC-17(4)(a))
• The System owner shall authorize access to security-relevant information via remote access only for Fill in: needs requiring access to security-relevant information via remote access Typical: investigation of security incidents, and only in a format that provides assessable evidence. (AC-17(4)(a))
• The System owner shall document the rationale for such remote access in the system security plan. (AC-17(4)(b))

Wireless access (AC-18)

• The Chief Information Security Officer shall establish configuration requirements, connection requirements and implementation guidance for each type of wireless access. (AC-18a)
• The System owner shall authorize each type of wireless access to the system before allowing such connections. (AC-18b)

Wireless authentication and encryption (AC-18(1))

• The System owner shall protect wireless access to the system using authentication of Select one or more: users; devices Typical: users and devices and encryption. (AC-18(1))

Disable wireless networking (AC-18(3))

• The System owner shall ensure wireless networking capabilities embedded in system components are disabled before issuance and deployment when not intended for use. (AC-18(3))

Access control for mobile devices (AC-19)

• The Chief Information Security Officer shall establish configuration requirements, connection requirements and implementation guidance for organization-controlled mobile devices, including when devices are outside controlled areas. (AC-19a)
• The System owner shall authorize the connection of mobile devices to the system. (AC-19b)

Full device or container-based encryption (AC-19(5))

• The Chief Information Security Officer shall require Select one: full-device encryption; container-based encryption Typical: full-device encryption to protect the confidentiality and integrity of information on Fill in: mobile devices on which to employ encryption Typical: all organization-controlled mobile devices. (AC-19(5))

Use of external systems (AC-20)

• Before authorized individuals access the system from an external system, or process, store or transmit organization-controlled information on one, the Chief Information Security Officer shall Select one or more: establish [Assignment: organization-defined terms and conditions]; identify [Assignment: organization-defined controls asserted] Typical: establish terms and conditions in a signed agreement with the organization that owns the external system, consistent with the trust relationship with the organization that owns, operates or maintains the external system. (AC-20a)
• Users shall not use Fill in: types of external systems prohibited from use Typical: personally owned devices that the organization does not manage, and public or shared computers to access the system or to process, store or transmit organization-controlled information. (AC-20b)

Limits on authorized use (AC-20(1))

• The System owner shall permit authorized individuals to use an external system to access the system, or to process, store or transmit organization-controlled information, only after the controls on the external system are verified against the organization’s policies and plans, or an approved connection or processing agreement is in place with its owner. (AC-20(1))

Portable storage devices: restricted use (AC-20(2))

• Authorized individuals shall use organization-controlled portable storage devices on external systems only under Fill in: restrictions on the use of organization-controlled portable storage devices by authorized individuals on external systems Typical: use only of encrypted, organization-issued devices, and only for approved business purposes. (AC-20(2))

Information sharing (AC-21)

• The System owner shall enable authorized users to determine whether the access authorizations of a sharing partner match the information’s access and use restrictions for Fill in: information-sharing circumstances where user discretion is required to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions Typical: sharing sensitive or contract-restricted information with partners outside the organization. (AC-21a)
• The System owner shall employ Fill in: automated mechanisms or manual processes that assist users in making information-sharing and collaboration decisions Typical: information labels and a data-sharing checklist to assist users in making information sharing and collaboration decisions. (AC-21b)

Publicly accessible content (AC-22)

• The System owner shall designate the individuals authorized to make information publicly accessible. (AC-22a)
• The System owner shall ensure those individuals are trained to keep nonpublic information out of publicly accessible content. (AC-22b)
• The designated individuals shall review proposed content for nonpublic information before posting it on the publicly accessible system. (AC-22c)
• The designated individuals shall review the content on the publicly accessible system for nonpublic information Fill in: the frequency at which to review the content on the publicly accessible system for non-public information Typical: quarterly. (AC-22d)
• The designated individuals shall remove nonpublic information when a review discovers it. (AC-22d)

Review and update

• The Fill in: an official to manage the access control policy and procedures Typical: Chief Information Security Officer shall review and update this policy Fill in: the frequency at which the current access control policy is reviewed and updated Typical: annually and following Fill in: events that would require the current access control policy to be reviewed and updated Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines. (AC-1c.1)
• The Fill in: an official to manage the access control policy and procedures Typical: Chief Information Security Officer shall review and update the procedures that implement this policy Fill in: the frequency at which the current access control procedures are reviewed and updated Typical: annually and following Fill in: events that would require procedures to be reviewed and updated Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe. (AC-1c.2)

Federal systems

For federal information systems, this policy also carries out the agency’s information security responsibilities under the Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3554, Federal agency responsibilities) and OMB Circular A-130, Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

• Where the agency’s organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (AC-1a.1(b))