NIST SP 800-53 (controls) 5.2.0

1196 requirements · published 2026-10-22
Changes in this version

All AC AT AU CA CM CP IA IR MA MP PE PL PM PS PT RA SA SC SI SR

Controls in this version
Ref	Title	Text
AC-01	Policy and Procedures	a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy that: (a) Addresses purpose
AC-02	Account Management	a. Define and document the types of accounts allowed and specifically prohibited for use within the system; b. Assign account managers; c. Require [Assignment: prerequisites and criteria] for group and role membership; d. Specify: 1. Author
AC-02(01) in AC-2	Automated System Account Management	Support the management of system accounts using [Assignment: automated mechanisms].
AC-02(02) in AC-2	Automated Temporary and Emergency Account Management	Automatically [Selection: remove; disable] temporary and emergency accounts after [Assignment: time period].
AC-02(03) in AC-2	Disable Accounts	Disable accounts within [Assignment: time period] when the accounts: (a) Have expired; (b) Are no longer associated with a user or individual; (c) Are in violation of organizational policy; or (d) Have been inactive for [Assignment: time pe
AC-02(04) in AC-2	Automated Audit Actions	Automatically audit account creation, modification, enabling, disabling, and removal actions.
AC-02(05) in AC-2	Inactivity Logout	Require that users log out when [Assignment: time period of expected inactivity or description of when to log out].
AC-02(06) in AC-2	Dynamic Privilege Management	Implement [Assignment: dynamic privilege management capabilities].
AC-02(07) in AC-2	Privileged User Accounts	(a) Establish and administer privileged user accounts in accordance with [Selection: a role-based access scheme; an attribute-based access scheme]; (b) Monitor privileged role or attribute assignments; (c) Monitor changes to roles or attrib
AC-02(08) in AC-2	Dynamic Account Management	Create, activate, manage, and deactivate [Assignment: system accounts] dynamically.
AC-02(09) in AC-2	Restrictions on Use of Shared and Group Accounts	Only permit the use of shared and group accounts that meet [Assignment: conditions].
AC-02(10) in AC-2	Shared and Group Account Credential Change withdrawn
AC-02(11) in AC-2	Usage Conditions	Enforce [Assignment: circumstances and/or usage conditions] for [Assignment: system accounts].
AC-02(12) in AC-2	Account Monitoring for Atypical Usage	(a) Monitor system accounts for [Assignment: atypical usage] ; and (b) Report atypical usage of system accounts to [Assignment: personnel or roles].
AC-02(13) in AC-2	Disable Accounts for High-risk Individuals	Disable accounts of individuals within [Assignment: time period] of discovery of [Assignment: significant risks].
AC-03	Access Enforcement	Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
AC-03(01) in AC-3	Restricted Access to Privileged Functions withdrawn
AC-03(02) in AC-3	Dual Authorization	Enforce dual authorization for [Assignment: privileged commands and/or other actions].
AC-03(03) in AC-3	Mandatory Access Control	Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy, and where the policy: (a) Is uniformly enforced across the covered subjects and objects within
AC-03(04) in AC-3	Discretionary Access Control	Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information c
AC-03(05) in AC-3	Security-relevant Information	Prevent access to [Assignment: security-relevant information] except during secure, non-operable system states.
AC-03(06) in AC-3	Protection of User and System Information withdrawn
AC-03(07) in AC-3	Role-based Access Control	Enforce a role-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined roles and users authorized to assume such roles].
AC-03(08) in AC-3	Revocation of Access Authorizations	Enforce the revocation of access authorizations resulting from changes to the security attributes of subjects and objects based on [Assignment: rules].
AC-03(09) in AC-3	Controlled Release	Release information outside of the system only if: (a) The receiving [Assignment: system or system component] provides [Assignment: controls] ; and (b) [Assignment: controls] are used to validate the appropriateness of the information desig
AC-03(10) in AC-3	Audited Override of Access Control Mechanisms	Employ an audited override of automated access control mechanisms under [Assignment: conditions] by [Assignment: roles].
AC-03(11) in AC-3	Restrict Access to Specific Information Types	Restrict access to data repositories containing [Assignment: information types].
AC-03(12) in AC-3	Assert and Enforce Application Access	(a) Require applications to assert, as part of the installation process, the access needed to the following system applications and functions: [Assignment: system applications and functions]; (b) Provide an enforcement mechanism to prevent
AC-03(13) in AC-3	Attribute-based Access Control	Enforce attribute-based access control policy over defined subjects and objects and control access based upon [Assignment: attributes].
AC-03(14) in AC-3	Individual Access	Provide [Assignment: mechanisms] to enable individuals to have access to the following elements of their personally identifiable information: [Assignment: elements].
AC-03(15) in AC-3	Discretionary and Mandatory Access Control	(a) Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy; and (b) Enforce [Assignment: organization-defined discretionary access control policy] over
AC-04	Information Flow Enforcement	Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [Assignment: information flow control policies].
AC-04(01) in AC-4	Object Security and Privacy Attributes	Use [Assignment: organization-defined security and privacy attributes] associated with [Assignment: organization-defined information, source, and destination objects] to enforce [Assignment: information flow control policies] as a basis for
AC-04(02) in AC-4	Processing Domains	Use protected processing domains to enforce [Assignment: information flow control policies] as a basis for flow control decisions.
AC-04(03) in AC-4	Dynamic Information Flow Control	Enforce [Assignment: information flow control policies].
AC-04(04) in AC-4	Flow Control of Encrypted Information	Prevent encrypted information from bypassing [Assignment: information flow control mechanisms] by [Selection (one or more): decrypting the information; blocking the flow of the encrypted information; terminating communications sessions atte
AC-04(05) in AC-4	Embedded Data Types	Enforce [Assignment: limitations] on embedding data types within other data types.
AC-04(06) in AC-4	Metadata	Enforce information flow control based on [Assignment: metadata].
AC-04(07) in AC-4	One-way Flow Mechanisms	Enforce one-way information flows through hardware-based flow control mechanisms.
AC-04(08) in AC-4	Security and Privacy Policy Filters	(a) Enforce information flow control using [Assignment: organization-defined security or privacy policy filters] as a basis for flow control decisions for [Assignment: organization-defined information flows] ; and (b) [Selection (one or mor
AC-04(09) in AC-4	Human Reviews	Enforce the use of human reviews for [Assignment: information flows] under the following conditions: [Assignment: conditions].
AC-04(10) in AC-4	Enable and Disable Security or Privacy Policy Filters	Provide the capability for privileged administrators to enable and disable [Assignment: organization-defined security or privacy policy filters] under the following conditions: [Assignment: organization-defined conditions].
AC-04(11) in AC-4	Configuration of Security or Privacy Policy Filters	Provide the capability for privileged administrators to configure [Assignment: organization-defined security or privacy policy filters] to support different security or privacy policies.
AC-04(12) in AC-4	Data Type Identifiers	When transferring information between different security domains, use [Assignment: data type identifiers] to validate data essential for information flow decisions.
AC-04(13) in AC-4	Decomposition into Policy-relevant Subcomponents	When transferring information between different security domains, decompose information into [Assignment: policy-relevant subcomponents] for submission to policy enforcement mechanisms.
AC-04(14) in AC-4	Security or Privacy Policy Filter Constraints	When transferring information between different security domains, implement [Assignment: organization-defined security or privacy policy filters] requiring fully enumerated formats that restrict data structure and content.
AC-04(15) in AC-4	Detection of Unsanctioned Information	When transferring information between different security domains, examine the information for the presence of [Assignment: unsanctioned information] and prohibit the transfer of such information in accordance with the [Assignment: organizat
AC-04(16) in AC-4	Information Transfers on Interconnected Systems withdrawn
AC-04(17) in AC-4	Domain Authentication	Uniquely identify and authenticate source and destination points by [Selection (one or more): organization, system, application, service, individual] for information transfer.
AC-04(18) in AC-4	Security Attribute Binding withdrawn
AC-04(19) in AC-4	Validation of Metadata	When transferring information between different security domains, implement [Assignment: organization-defined security or privacy policy filters] on metadata.
AC-04(20) in AC-4	Approved Solutions	Employ [Assignment: solutions in approved configurations] to control the flow of [Assignment: information] across security domains.
AC-04(21) in AC-4	Physical or Logical Separation of Information Flows	Separate information flows logically or physically using [Assignment: organization-defined mechanisms and/or techniques] to accomplish [Assignment: required separations].
AC-04(22) in AC-4	Access Only	Provide access from a single device to computing platforms, applications, or data residing in multiple different security domains, while preventing information flow between the different security domains.
AC-04(23) in AC-4	Modify Non-releasable Information	When transferring information between different security domains, modify non-releasable information by implementing [Assignment: modification action].
AC-04(24) in AC-4	Internal Normalized Format	When transferring information between different security domains, parse incoming data into an internal normalized format and regenerate the data to be consistent with its intended specification.
AC-04(25) in AC-4	Data Sanitization	When transferring information between different security domains, sanitize data to minimize [Selection (one or more): delivery of malicious content, command and control of malicious code, malicious code augmentation, and steganography-encod
AC-04(26) in AC-4	Audit Filtering Actions	When transferring information between different security domains, record and audit content filtering actions and results for the information being filtered.
AC-04(27) in AC-4	Redundant/Independent Filtering Mechanisms	When transferring information between different security domains, implement content filtering solutions that provide redundant and independent filtering mechanisms for each data type.
AC-04(28) in AC-4	Linear Filter Pipelines	When transferring information between different security domains, implement a linear content filter pipeline that is enforced with discretionary and mandatory access controls.
AC-04(29) in AC-4	Filter Orchestration Engines	When transferring information between different security domains, employ content filter orchestration engines to ensure that: (a) Content filtering mechanisms successfully complete execution without errors; and (b) Content filtering actions
AC-04(30) in AC-4	Filter Mechanisms Using Multiple Processes	When transferring information between different security domains, implement content filtering mechanisms using multiple processes.
AC-04(31) in AC-4	Failed Content Transfer Prevention	When transferring information between different security domains, prevent the transfer of failed content to the receiving domain.
AC-04(32) in AC-4	Process Requirements for Information Transfer	When transferring information between different security domains, the process that transfers information between filter pipelines: (a) Does not filter message content; (b) Validates filtering metadata; (c) Ensures the content associated wit
AC-05	Separation of Duties	a. Identify and document [Assignment: duties of individuals] ; and b. Define system access authorizations to support separation of duties.
AC-06	Least Privilege	Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.
AC-06(01) in AC-6	Authorize Access to Security Functions	Authorize access for [Assignment: individuals and roles] to: (a) [Assignment: organization-defined security functions (deployed in hardware, software, and firmware)] ; and (b) [Assignment: security-relevant information].
AC-06(02) in AC-6	Non-privileged Access for Nonsecurity Functions	Require that users of system accounts (or roles) with access to [Assignment: security functions or security-relevant information] use non-privileged accounts or roles, when accessing nonsecurity functions.
AC-06(03) in AC-6	Network Access to Privileged Commands	Authorize network access to [Assignment: privileged commands] only for [Assignment: compelling operational needs] and document the rationale for such access in the security plan for the system.
AC-06(04) in AC-6	Separate Processing Domains	Provide separate processing domains to enable finer-grained allocation of user privileges.
AC-06(05) in AC-6	Privileged Accounts	Restrict privileged accounts on the system to [Assignment: personnel or roles].
AC-06(06) in AC-6	Privileged Access by Non-organizational Users	Prohibit privileged access to the system by non-organizational users.
AC-06(07) in AC-6	Review of User Privileges	(a) Review [Assignment: frequency] the privileges assigned to [Assignment: roles and classes] to validate the need for such privileges; and (b) Reassign or remove privileges, if necessary, to correctly reflect organizational mission and bus
AC-06(08) in AC-6	Privilege Levels for Code Execution	Prevent the following software from executing at higher privilege levels than users executing the software: [Assignment: software].
AC-06(09) in AC-6	Log Use of Privileged Functions	Log the execution of privileged functions.
AC-06(10) in AC-6	Prohibit Non-privileged Users from Executing Privileged Functions	Prevent non-privileged users from executing privileged functions.
AC-07	Unsuccessful Logon Attempts	a. Enforce a limit of [Assignment: number] consecutive invalid logon attempts by a user during a [Assignment: time period] ; and b. Automatically [Selection (one or more): lock the account or node for {{ insert: param, ac-07_odp.04 }} ; loc
AC-07(01) in AC-7	Automatic Account Lock withdrawn
AC-07(02) in AC-7	Purge or Wipe Mobile Device	Purge or wipe information from [Assignment: mobile devices] based on [Assignment: purging or wiping requirements and techniques] after [Assignment: number] consecutive, unsuccessful device logon attempts.
AC-07(03) in AC-7	Biometric Attempt Limiting	Limit the number of unsuccessful biometric logon attempts to [Assignment: number].
AC-07(04) in AC-7	Use of Alternate Authentication Factor	(a) Allow the use of [Assignment: authentication factors] that are different from the primary authentication factors after the number of organization-defined consecutive invalid logon attempts have been exceeded; and (b) Enforce a limit of
AC-08	System Use Notification	a. Display [Assignment: system use notification] to users before granting access to the system that provides privacy and security notices consistent with applicable laws, executive orders, directives, regulations, policies, standards, and g
AC-09	Previous Logon Notification	Notify the user, upon successful logon to the system, of the date and time of the last logon.
AC-09(01) in AC-9	Unsuccessful Logons	Notify the user, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.
AC-09(02) in AC-9	Successful and Unsuccessful Logons	Notify the user, upon successful logon, of the number of [Selection: successful logons; unsuccessful logon attempts; both] during [Assignment: time period].
AC-09(03) in AC-9	Notification of Account Changes	Notify the user, upon successful logon, of changes to [Assignment: security-related characteristics or parameters] during [Assignment: time period].
AC-09(04) in AC-9	Additional Logon Information	Notify the user, upon successful logon, of the following additional information: [Assignment: additional information].
AC-10	Concurrent Session Control	Limit the number of concurrent sessions for each [Assignment: account and/or account types] to [Assignment: number].
AC-11	Device Lock	a. Prevent further access to the system by [Selection (one or more): initiating a device lock after {{ insert: param, ac-11_odp.02 }} of inactivity; requiring the user to initiate a device lock before leaving the system unattended] ; and b.
AC-11(01) in AC-11	Pattern-hiding Displays	Conceal, via the device lock, information previously visible on the display with a publicly viewable image.
AC-12	Session Termination	Automatically terminate a user session after [Assignment: conditions or trigger events].
AC-12(01) in AC-12	User-initiated Logouts	Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to [Assignment: information resources].
AC-12(02) in AC-12	Termination Message	Display an explicit logout message to users indicating the termination of authenticated communications sessions.
AC-12(03) in AC-12	Timeout Warning Message	Display an explicit message to users indicating that the session will end in [Assignment: time].
AC-13	Supervision and Review — Access Control withdrawn
AC-14	Permitted Actions Without Identification or Authentication	a. Identify [Assignment: user actions] that can be performed on the system without identification or authentication consistent with organizational mission and business functions; and b. Document and provide supporting rationale in the secur
AC-14(01) in AC-14	Necessary Uses withdrawn
AC-15	Automated Marking withdrawn
AC-16	Security and Privacy Attributes	a. Provide the means to associate [Assignment: organization-defined types of security and privacy attributes] with [Assignment: organization-defined security and privacy attribute values] for information in storage, in process, and/or in tr
AC-16(01) in AC-16	Dynamic Attribute Association	Dynamically associate security and privacy attributes with [Assignment: organization-defined subjects and objects] in accordance with the following security and privacy policies as information is created and combined: [Assignment: organizat
AC-16(02) in AC-16	Attribute Value Changes by Authorized Individuals	Provide authorized individuals (or processes acting on behalf of individuals) the capability to define or change the value of associated security and privacy attributes.
AC-16(03) in AC-16	Maintenance of Attribute Associations by System	Maintain the association and integrity of [Assignment: organization-defined security and privacy attributes] to [Assignment: organization-defined subjects and objects].
AC-16(04) in AC-16	Association of Attributes by Authorized Individuals	Provide the capability to associate [Assignment: organization-defined security and privacy attributes] with [Assignment: organization-defined subjects and objects] by authorized individuals (or processes acting on behalf of individuals).
AC-16(05) in AC-16	Attribute Displays on Objects to Be Output	Display security and privacy attributes in human-readable form on each object that the system transmits to output devices to identify [Assignment: instructions] using [Assignment: naming conventions].
AC-16(06) in AC-16	Maintenance of Attribute Association	Require personnel to associate and maintain the association of [Assignment: organization-defined security and privacy attributes] with [Assignment: organization-defined subjects and objects] in accordance with [Assignment: organization-defi
AC-16(07) in AC-16	Consistent Attribute Interpretation	Provide a consistent interpretation of security and privacy attributes transmitted between distributed system components.
AC-16(08) in AC-16	Association Techniques and Technologies	Implement [Assignment: organization-defined techniques and technologies] in associating security and privacy attributes to information.
AC-16(09) in AC-16	Attribute Reassignment — Regrading Mechanisms	Change security and privacy attributes associated with information only via regrading mechanisms validated using [Assignment: organization-defined techniques or procedures].
AC-16(10) in AC-16	Attribute Configuration by Authorized Individuals	Provide authorized individuals the capability to define or change the type and value of security and privacy attributes available for association with subjects and objects.
AC-17	Remote Access	a. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b. Authorize each type of remote access to the system prior to allowing such connec
AC-17(01) in AC-17	Monitoring and Control	Employ automated mechanisms to monitor and control remote access methods.
AC-17(02) in AC-17	Protection of Confidentiality and Integrity Using Encryption	Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.
AC-17(03) in AC-17	Managed Access Control Points	Route remote accesses through authorized and managed network access control points.
AC-17(04) in AC-17	Privileged Commands and Access	(a) Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: [Assignment: organization-defined needs] ; and
AC-17(05) in AC-17	Monitoring for Unauthorized Connections withdrawn
AC-17(06) in AC-17	Protection of Mechanism Information	Protect information about remote access mechanisms from unauthorized use and disclosure.
AC-17(07) in AC-17	Additional Protection for Security Function Access withdrawn
AC-17(08) in AC-17	Disable Nonsecure Network Protocols withdrawn
AC-17(09) in AC-17	Disconnect or Disable Access	Provide the capability to disconnect or disable remote access to the system within [Assignment: time period].
AC-17(10) in AC-17	Authenticate Remote Commands	Implement [Assignment: mechanisms] to authenticate [Assignment: remote commands].
AC-18	Wireless Access	a. Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and b. Authorize each type of wireless access to the system prior to allowing such connections.
AC-18(01) in AC-18	Authentication and Encryption	Protect wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption.
AC-18(02) in AC-18	Monitoring Unauthorized Connections withdrawn
AC-18(03) in AC-18	Disable Wireless Networking	Disable, when not intended for use, wireless networking capabilities embedded within system components prior to issuance and deployment.
AC-18(04) in AC-18	Restrict Configurations by Users	Identify and explicitly authorize users allowed to independently configure wireless networking capabilities.
AC-18(05) in AC-18	Antennas and Transmission Power Levels	Select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.
AC-19	Access Control for Mobile Devices	a. Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas; and b. Authorize the connection of mobil
AC-19(01) in AC-19	Use of Writable and Portable Storage Devices withdrawn
AC-19(02) in AC-19	Use of Personally Owned Portable Storage Devices withdrawn
AC-19(03) in AC-19	Use of Portable Storage Devices with No Identifiable Owner withdrawn
AC-19(04) in AC-19	Restrictions for Classified Information	(a) Prohibit the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official; and (b) Enforce the following restri
AC-19(05) in AC-19	Full Device or Container-based Encryption	Employ [Selection: full-device encryption; container-based encryption] to protect the confidentiality and integrity of information on [Assignment: mobile devices].
AC-20	Use of External Systems	a. [Selection (one or more): establish {{ insert: param, ac-20_odp.02 }} ; identify {{ insert: param, ac-20_odp.03 }} ] , consistent with the trust relationships established with other organizations owning, operating, and/or maintaining ext
AC-20(01) in AC-20	Limits on Authorized Use	Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after: (a) Verification of the implementation of controls on the external system as spec
AC-20(02) in AC-20	Portable Storage Devices — Restricted Use	Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using [Assignment: restrictions].
AC-20(03) in AC-20	Non-organizationally Owned Systems — Restricted Use	Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using [Assignment: restrictions].
AC-20(04) in AC-20	Network Accessible Storage Devices — Prohibited Use	Prohibit the use of [Assignment: network-accessible storage devices] in external systems.
AC-20(05) in AC-20	Portable Storage Devices — Prohibited Use	Prohibit the use of organization-controlled portable storage devices by authorized individuals on external systems.
AC-21	Information Sharing	a. Enable authorized users to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for [Assignment: information-sharing circumstances] ; and b. Employ [Assignment: automat
AC-21(01) in AC-21	Automated Decision Support	Employ [Assignment: automated mechanisms] to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.
AC-21(02) in AC-21	Information Search and Retrieval	Implement information search and retrieval services that enforce [Assignment: information-sharing restrictions].
AC-22	Publicly Accessible Content	a. Designate individuals authorized to make information publicly accessible; b. Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information; c. Review the proposed content of informatio
AC-23	Data Mining Protection	Employ [Assignment: techniques] for [Assignment: data storage objects] to detect and protect against unauthorized data mining.
AC-24	Access Control Decisions	[Selection (one or more): establish procedures; implement mechanisms] to ensure [Assignment: access control decisions] are applied to each access request prior to access enforcement.
AC-24(01) in AC-24	Transmit Access Authorization Information	Transmit [Assignment: access authorization information] using [Assignment: controls] to [Assignment: systems] that enforce access control decisions.
AC-24(02) in AC-24	No User or Process Identity	Enforce access control decisions based on [Assignment: organization-defined security or privacy attributes] that do not include the identity of the user or process acting on behalf of the user.
AC-25	Reference Monitor	Implement a reference monitor for [Assignment: access control policies] that is tamperproof, always invoked, and small enough to be subject to analysis and testing, the completeness of which can be assured.

147 of 1196.