BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

AC-20(03) Non-organizationally Owned Systems — Restricted Use

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
unchanged AC part of AC-20

Title

Non-organizationally Owned Systems — Restricted Use

Control

Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using [Assignment: restrictions].

Discussion

Non-organizationally owned systems or system components include systems or system components owned by other organizations as well as personally owned devices. There are potential risks to using non-organizationally owned systems or components. In some cases, the risk is sufficiently high as to prohibit such use (see [AC-20 b.](#ac-20_smt.b) ). In other cases, the use of such systems or system components may be allowed but restricted in some way. Restrictions include requiring the implementation of approved controls prior to authorizing the connection of non-organizationally owned systems and components; limiting access to types of information, services, or applications; using virtualization techniques to limit processing and storage activities to servers or system components provisioned by the organization; and agreeing to the terms and conditions for usage. Organizations consult with the Office of the General Counsel regarding legal issues associated with using personally owned devices, including requirements for conducting forensic analyses during investigations after an incident.

Parameters

ac-20.03_odp: restrictions

Assessment objective

AC-20(03) the use of non-organizationally owned systems or system components to process, store, or transmit organizational information is restricted using [Assignment: restrictions].

STIG rules that implement this control 0

No followed STIG rule cites a CCI indexed to this control (CCI list 2026-07-14).