BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

AC-24 Access Control Decisions

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
unchanged AC

Title

Access Control Decisions

Control

[Selection (one or more): establish procedures; implement mechanisms] to ensure [Assignment: access control decisions] are applied to each access request prior to access enforcement.

Discussion

Access control decisions (also known as authorization decisions) occur when authorization information is applied to specific accesses. In contrast, access enforcement occurs when systems enforce access control decisions. While it is common to have access control decisions and access enforcement implemented by the same entity, it is not required, and it is not always an optimal implementation choice. For some architectures and distributed systems, different entities may make access control decisions and enforce access.

Parameters

ac-24_odp.01: [establish procedures; implement mechanisms]
ac-24_odp.02: access control decisions

Related controls

ac-2, ac-3

Assessment objective

AC-24 [Selection (one or more): establish procedures; implement mechanisms] are taken to ensure that [Assignment: access control decisions] are applied to each access request prior to access enforcement.

STIG rules that implement this control 0

No followed STIG rule cites a CCI indexed to this control (CCI list 2026-07-14).