`AC-03` Access Enforcement

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version

unchanged AC Low baseline Moderate baseline High baseline

Title

Access Enforcement

Control

Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Discussion

Access control policies control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (i.e., devices, files, records, domains) in organizational systems. In addition to enforcing authorized access at the system level and recognizing that systems can host many applications and services in support of mission and business functions, access enforcement mechanisms can also be employed at the application and service level to provide increased information security and privacy. In contrast to logical access controls that are implemented within the system, physical access controls are addressed by the controls in the Physical and Environmental Protection ( [PE](#pe) ) family.

Related controls

ac-16, ac-17, ac-18, ac-19, ac-2, ac-20, ac-21, ac-22, ac-24, ac-25, ac-4, ac-5, ac-6, at-2, at-3, au-9, ca-9, cm-11, cm-5, ia-11, ia-13, ia-2, ia-5, ia-6, ia-7, ma-3, ma-4, ma-5, mp-4, pm-2, ps-3, pt-2, pt-3, sa-17, sc-12, sc-13, sc-2, sc-28, sc-3, sc-31, sc-34, sc-4, si-4, si-8

Assessment objective

AC-03 approved authorizations for logical access to information and system resources are enforced in accordance with applicable access control policies.

STIG rules that implement this control 139

Apple macOS 15 (Sequoia) V1R8

APPL-15-000033 CAT II The macOS system must disable FileVault automatic login.
APPL-15-002001 CAT II The macOS system must disable Server Message Block (SMB) sharing.
APPL-15-002003 CAT II The macOS system must disable Network File System (NFS) service.
APPL-15-002006 CAT II The macOS system must disable Unix-to-Unix Copy Protocol (UUCP) service.
APPL-15-002008 CAT II The macOS system must disable the built-in web server.
APPL-15-002009 CAT II The macOS system must disable AirDrop.
APPL-15-002022 CAT II The macOS system must disable Remote Apple Events.
APPL-15-002038 CAT I The macOS system must disable Trivial File Transfer Protocol (TFTP) service.
APPL-15-002050 CAT II The macOS system must disable Screen Sharing and Apple Remote Desktop.
APPL-15-002100 CAT II The macOS system must disable Media Sharing.
APPL-15-002110 CAT II The macOS system must disable Bluetooth Sharing.
APPL-15-002271 CAT II The macOS system must disable iPhone Mirroring.
APPL-15-005001 CAT I The macOS system must ensure System Integrity Protection is enabled.
APPL-15-005058 CAT II The macOS system must disable Handoff.
APPL-15-005070 CAT II The macOS system must enable Authenticated Root.

Apple macOS 26 (Tahoe) V1R4

APPL-26-000033 CAT II The macOS system must disable FileVault automatic login.
APPL-26-002001 CAT II The macOS system must disable Server Message Block (SMB) sharing.
APPL-26-002003 CAT II The macOS system must disable Network File System (NFS) service.
APPL-26-002006 CAT II The macOS system must disable Unix-to-Unix Copy Protocol (UUCP) service.
APPL-26-002008 CAT II The macOS system must disable the built-in web server.
APPL-26-002009 CAT II The macOS system must disable AirDrop.
APPL-26-002022 CAT II The macOS system must disable Remote Apple Events.
APPL-26-002038 CAT I The macOS system must disable Trivial File Transfer Protocol (TFTP) service.
APPL-26-002050 CAT II The macOS system must disable Screen Sharing and Apple Remote Desktop.
APPL-26-002100 CAT II The macOS system must disable Media Sharing.
APPL-26-002110 CAT II The macOS system must disable Bluetooth Sharing.
APPL-26-002271 CAT II The macOS system must disable iPhone Mirroring.
APPL-26-005001 CAT I The macOS system must ensure System Integrity Protection (SIP) is enabled.
APPL-26-005058 CAT II The macOS system must disable Handoff.
APPL-26-005070 CAT II The macOS system must enable Authenticated Root.

Application Security and Development V6R5

APSC-DV-000460 CAT I The application must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Canonical Ubuntu 22.04 LTS V2R10

UBTU-22-212010 CAT I Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes.

Canonical Ubuntu 24.04 LTS V1R7

UBTU-24-102000 CAT I Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes.

Microsoft Windows 11 V2R11

WN11-00-000050 CAT I Local volumes must be formatted using NTFS.
WN11-UR-000010 CAT II The "Access this computer from the network" user right must only be assigned to the Administrators and Remote Desktop Users groups.
WN11-UR-000025 CAT II The "Allow log on locally" user right must only be assigned to the Administrators and Users groups.
WN11-UR-000070 CAT II The "Deny access to this computer from the network" user right on workstations must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems.
WN11-UR-000075 CAT II The "Deny log on as a batch job" user right on domain-joined workstations must be configured to prevent access from highly privileged domain accounts.
WN11-UR-000080 CAT II The "Deny log on as a service" user right on Windows 11 domain-joined workstations must be configured to prevent access from highly privileged domain accounts.
WN11-UR-000085 CAT II The "Deny log on locally" user right on workstations must be configured to prevent access from highly privileged domain accounts on domain systems and unauthenticated access on all systems.
WN11-UR-000090 CAT II The "Deny log on through Remote Desktop Services" user right on Windows 11 workstations must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems.

Microsoft Windows Server 2022 V2R11

WN22-00-000130 CAT I Windows Server 2022 local volumes must use a format that supports NTFS attributes.
WN22-00-000180 CAT III Windows Server 2022 nonadministrative accounts or groups must only have print permissions on printer shares.
WN22-DC-000340 CAT II Windows Server 2022 Access this computer from the network user right must only be assigned to the Administrators, Authenticated Users, and Enterprise Domain Controllers groups on domain controllers.
WN22-DC-000360 CAT II Windows Server 2022 Allow log on through Remote Desktop Services user right must only be assigned to the Administrators group on domain controllers.
WN22-DC-000370 CAT II Windows Server 2022 Deny access to this computer from the network user right on domain controllers must be configured to prevent unauthenticated access.
WN22-DC-000380 CAT II Windows Server 2022 Deny log on as a batch job user right on domain controllers must be configured to prevent unauthenticated access.
WN22-DC-000390 CAT II Windows Server 2022 Deny log on as a service user right must be configured to include no accounts or groups (blank) on domain controllers.
WN22-DC-000400 CAT II Windows Server 2022 Deny log on locally user right on domain controllers must be configured to prevent unauthenticated access.
WN22-DC-000406 CAT II Windows Server 2022 must be configured for name-based strong mappings for certificates.
WN22-MS-000070 CAT II Windows Server 2022 Access this computer from the network user right must only be assigned to the Administrators and Authenticated Users groups on domain-joined member servers and standalone or nondomain-joined systems.
WN22-MS-000080 CAT II Windows Server 2022 Deny access to this computer from the network user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and local accounts and from unauthenticated access on all systems.
WN22-MS-000090 CAT II Windows Server 2022 Deny log on as a batch job user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and from unauthenticated access on all systems.
WN22-MS-000100 CAT II Windows Server 2022 Deny log on as a service user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts. No other groups or accounts must be assigned this right.
WN22-MS-000110 CAT II Windows Server 2022 Deny log on locally user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and from unauthenticated access on all systems.
WN22-UR-000030 CAT II Windows Server 2022 Allow log on locally user right must only be assigned to the Administrators group.

Microsoft Windows Server 2025 V1R4

WN25-00-000130 CAT I Windows Server 2025 local volumes must use a format that supports New Technology File System (NTFS) attributes.
WN25-00-000180 CAT III Windows Server 2025 nonadministrative accounts or groups must only have print permissions on printer shares.
WN25-CC-000530 CAT II Windows Server 2025 must have PowerShell Transcription enabled.
WN25-DC-000340 CAT II The Windows Server 2025 "Access this computer from the network" user right must only be assigned to the Administrators, Authenticated Users, and Enterprise Domain Controllers groups on domain controllers.
WN25-DC-000360 CAT II The Windows Server 2025 "Allow log on through Remote Desktop Services" user right must only be assigned to the Administrators group on domain controllers.
WN25-DC-000370 CAT II The Windows Server 2025 "Deny access to this computer from the network" user right on domain controllers must be configured to prevent unauthenticated access.
WN25-DC-000380 CAT II The Windows Server 2025 "Deny log on as a batch job" user right on domain controllers must be configured to prevent unauthenticated access.
WN25-DC-000390 CAT II The Windows Server 2025 "Deny log on as a service" user right must be configured to include no accounts or groups (blank) on domain controllers.
WN25-DC-000400 CAT II The Windows Server 2025 "Deny log on locally" user right on domain controllers must be configured to prevent unauthenticated access.
WN25-DC-000406 CAT II Windows Server 2025 must be configured for name-based strong mappings for certificates.
WN25-MS-000070 CAT II Windows Server 2025 "Access this computer from the network" user right must only be assigned to the Administrators and Authenticated Users groups on domain-joined member servers and stand-alone or nondomain-joined systems.
WN25-MS-000080 CAT II The Windows Server 2025 "Deny access to this computer from the network" user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and local accounts and from unauthenticated access on all systems.
WN25-MS-000090 CAT II Windows Server 2025 Deny log on as a batch job user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and from unauthenticated access on all systems.
WN25-MS-000100 CAT II The Windows Server 2025 "Deny log on as a service" user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts. No other groups or accounts must be assigned this right.
WN25-MS-000110 CAT II The Windows Server 2025 "Deny log on locally" user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and from unauthenticated access on all systems.
WN25-UR-000030 CAT II The Windows Server 2025 "Allow log on locally" user right must only be assigned to the Administrators group.

Red Hat Enterprise Linux 10 V1R3

RHEL-10-400000 CAT II RHEL 10 must be configured so that the "/etc/group" file is owned by root.
RHEL-10-400005 CAT II RHEL 10 must be configured so that the "/etc/group" file is group-owned by "root".
RHEL-10-400010 CAT II RHEL 10 must be configured so that the "/etc/group-" file is owned by "root".
RHEL-10-400015 CAT II RHEL 10 must be configured so that the "/etc/group-" file is group-owned by "root".
RHEL-10-400020 CAT II RHEL 10 must be configured so that the "/etc/gshadow" file is owned by "root".
RHEL-10-400025 CAT II RHEL 10 must be configured so that the "/etc/gshadow" file is group-owned by "root".
RHEL-10-400030 CAT II RHEL 10 must be configured so that the "/etc/gshadow-" file is owned by "root".
RHEL-10-400035 CAT II RHEL 10 must be configured so that the "/etc/gshadow-" file is group-owned by "root".
RHEL-10-400040 CAT II RHEL 10 must be configured so that the "/etc/passwd" file is owned by "root".
RHEL-10-400045 CAT II RHEL 10 must be configured so that the "/etc/passwd" file is group-owned by "root".
RHEL-10-400050 CAT II RHEL 10 must be configured so that the "/etc/passwd-" file is owned by "root".
RHEL-10-400055 CAT II RHEL 10 must be configured so that the "/etc/passwd-" file is group-owned by "root".
RHEL-10-400060 CAT II RHEL 10 must be configured so that the "/etc/shadow" file is owned by "root".
RHEL-10-400065 CAT II RHEL 10 must be configured so that the "/etc/shadow" file is group-owned by "root".
RHEL-10-400070 CAT II RHEL 10 must be configured so that the "/etc/shadow-" file is owned by "root".
RHEL-10-400075 CAT II RHEL 10 must be configured so that the "/etc/shadow-" file is group-owned by "root".
RHEL-10-400135 CAT II RHEL 10 must be configured so that cron configuration files directories are group-owned by root.
RHEL-10-400145 CAT II RHEL 10 must be configured so that all system device files are correctly labeled to prevent unauthorized modification.
RHEL-10-400150 CAT II RHEL 10 must be configured so that the Secure Shell (SSH) server configuration file is group-owned by "root".
RHEL-10-400155 CAT II RHEL 10 must be configured so that the Secure Shell (SSH) server configuration file is owned by "root".
RHEL-10-400160 CAT II RHEL 10 must ensure that all local interactive user home directories are group-owned by the home directory owner's primary group.
RHEL-10-400235 CAT II RHEL 10 must enforce mode "0740" or less permissive for local initialization files.
RHEL-10-400240 CAT II RHEL 10 must enforce mode "0750" or less permissive for local interactive user home directories.
RHEL-10-400245 CAT II RHEL 10 must enforce mode "0644" or less permissive for the "/etc/group" file to prevent unauthorized access.
RHEL-10-400250 CAT II RHEL 10 must enforce mode "0644" or less permissive for the "/etc/group-" file to prevent unauthorized access.
RHEL-10-400255 CAT II RHEL 10 must enforce mode "0000" or less permissive for the "/etc/gshadow" file to prevent unauthorized access.
RHEL-10-400260 CAT II RHEL 10 must enforce mode "0000" or less permissive for the "/etc/gshadow-" file to prevent unauthorized access.
RHEL-10-400265 CAT II RHEL 10 must enforce mode "0644" or less permissive for the "/etc/passwd" file to prevent unauthorized access.
RHEL-10-400270 CAT II RHEL 10 must enforce mode "0644" or less permissive for "/etc/passwd-" file to prevent unauthorized access.
RHEL-10-400275 CAT II RHEL 10 must enforce mode "0000" or less permissive for "/etc/shadow-" file to prevent unauthorized access.
RHEL-10-400285 CAT II RHEL 10 must be configured so that all local files and directories have a valid group owner.
RHEL-10-400290 CAT II RHEL 10 must be configured so that all local files and directories must have a valid owner.
RHEL-10-400295 CAT II RHEL 10 must enforce mode "0000" for "/etc/shadow" to prevent unauthorized access.
RHEL-10-400310 CAT II RHEL 10 must set the umask value to "077" for all local interactive user accounts.
RHEL-10-400315 CAT II RHEL 10 must define default permissions for the bash shell.
RHEL-10-400320 CAT II RHEL 10 must define default permissions for the c shell.
RHEL-10-400325 CAT II RHEL 10 must define default permissions for all authenticated users in such a way that the user can read and modify only their own files.
RHEL-10-400330 CAT II RHEL 10 must define default permissions for the system default profile.
RHEL-10-400335 CAT II RHEL 10 must enforce that all local initialization files configured by systemd-tmpfiles have mode "0600" or less permissive.
RHEL-10-400340 CAT II RHEL 10 must enforce mode "0600" or less permissive for Secure Shell (SSH) private host key files.
RHEL-10-400345 CAT II RHEL 10 must enforce "root" group ownership of the "/boot/grub2/grub.cfg" file.
RHEL-10-400350 CAT II RHEL 10 must enforce "root" ownership of the "/boot/grub2/grub.cfg" file.
RHEL-10-400365 CAT II RHEL 10 must prevent code from being executed on file systems that contain user home directories.
RHEL-10-500005 CAT II RHEL 10 must enable auditing of processes that start prior to the audit daemon.
RHEL-10-600000 CAT II RHEL 10 must require authentication upon booting into single-user and maintenance modes.
RHEL-10-600010 CAT II RHEL 10 must require a unique superusers name upon booting into single-user and maintenance modes.
RHEL-10-600400 CAT II RHEL 10 must allow only the root account to have unrestricted access to the system.
RHEL-10-600450 CAT II RHEL 10 must not have unauthorized accounts.
RHEL-10-700010 CAT II RHEL 10 must display the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via a Secure Shell (SSH) login.
RHEL-10-700100 CAT II RHEL 10 must prevent special devices on file systems that are imported via Network File System (NFS).
RHEL-10-700105 CAT II RHEL 10 must prevent code from being executed on file systems that are imported via Network File System (NFS).
RHEL-10-700110 CAT II RHEL 10 must prevent files with the "setuid" and "setgid" bit set from being executed on file systems that are imported via Network File System (NFS).
RHEL-10-700115 CAT II RHEL 10 must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS.
RHEL-10-700130 CAT II RHEL 10 must prevent files with the "setuid" and "setgid" bit set from being executed on the "/boot/efi" directory.
RHEL-10-700590 CAT II RHEL 10 must be configured so that Secure Shell (SSH) server configuration files' permissions are not modified.
RHEL-10-700630 CAT II RHEL 10 must not allow a noncertificate trusted host Secure Shell (SSH) login to the system.
RHEL-10-700680 CAT II RHEL 10 must not have a "shosts.equiv" file on the system.
RHEL-10-700690 CAT II RHEL 10 must not have any ".shosts" files on the system.
RHEL-10-700720 CAT I RHEL 10 must not allow unattended or automatic login via the graphical user interface.
RHEL-10-700800 CAT II RHEL 10 must ensure effective dconf policy matches the policy keyfiles.
RHEL-10-701250 CAT II RHEL 10 must require authentication to access emergency mode.
RHEL-10-701260 CAT II RHEL 10 must require authentication to access single-user mode.
RHEL-10-800070 CAT II RHEL 10 must not have unauthorized IP tunnels configured.

Red Hat Enterprise Linux 9 V2R10

RHEL-09-212010 CAT II RHEL 9 must require authentication upon booting into single-user and maintenance modes.
RHEL-09-212020 CAT I RHEL 9 must require a unique superusers name upon booting into single-user and maintenance modes.
RHEL-09-611195 CAT II RHEL 9 must require authentication to access emergency mode.
RHEL-09-611200 CAT II RHEL 9 must require authentication to access single-user mode.

AC-03 Access Enforcement