BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

AC-03(15) Discretionary and Mandatory Access Control

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
unchanged AC part of AC-3

Title

Discretionary and Mandatory Access Control

Control

(a) Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy; and
(b) Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy.

Discussion

Simultaneously implementing a mandatory access control policy and a discretionary access control policy can provide additional protection against the unauthorized execution of code by users or processes acting on behalf of users. This helps prevent a single compromised user or process from compromising the entire system.

Parameters

ac-3.15_prm_1: organization-defined mandatory access control policy
ac-3.15_prm_2: organization-defined discretionary access control policy
ac-03.15_odp.01: mandatory access control policy
ac-03.15_odp.02: mandatory access control policy
ac-03.15_odp.03: discretionary access control policy
ac-03.15_odp.04: discretionary access control policy

Related controls

ac-4, sc-2, sc-3

STIG rules that implement this control 0

No followed STIG rule cites a CCI indexed to this control (CCI list 2026-07-14).