NIST SP 800-53 AC Family: Controls and Evidence

The Access Control (AC) family is the largest operational family in SP 800-53, and most AC findings come from a handful of controls whose organisation-defined parameters were never set or never tested against the real account population. This guide covers the AC controls that carry most of the assessment weight: account management, access enforcement, separation of duties, least privilege, logon and session controls, remote access and external systems. For each it gives what the control text requires, which baselines select it, the parameters you must decide and the evidence an assessor will expect. It is written for control owners, IAM and platform teams, system security plan authors and assessors. For the catalogue as a whole, see the NIST SP 800-53 Guide.

Key takeaways

AC-2 is a lifecycle, not a list. Its twelve statement items run from defining permitted account types to aligning account removal with HR termination. Moderate adds automated management, automatic removal of temporary and emergency accounts, disabling of inactive accounts and automatic audit of account changes.
Least privilege is not in the Low baseline. AC-6 and its enhancements start at Moderate. Low systems still need AC-2 and AC-3, but if you rely on Low you should consider adding AC-6(5) for privileged accounts by tailoring.
Privileged access has its own enhancements. AC-6(1), (2), (5), (7), (9) and (10) at Moderate cover who may use security functions, separate admin accounts, privileged account restriction, privilege review, logging privileged functions and blocking non-privileged users from them.
Parameters are the control. AC-2(3) inactivity periods, AC-7 lockout values, AC-11 lock time and AC-12 termination conditions are yours to set. An assessor tests the system against the value you wrote down.
Non-human accounts are accounts. AC-2 covers system, service, application and temporary accounts. Service accounts need owners, approvals, reviews and removal like any user, and they are the population most often missing from evidence.

The AC family at a glance

Baseline allocation is from NIST's OSCAL Release 5.2.0 baseline profiles (L = Low, M = Moderate, H = High). The table lists the base controls you will meet in a Low, Moderate or High system; AC-9, AC-16, AC-23, AC-24 and AC-25 are outside the baselines.

Control	Title	Baselines	Enhancements selected in baselines
AC-1	Policy and Procedures	L, M, H	None
AC-2	Account Management	L, M, H	(1), (2), (3), (4), (5), (13) at M, H; (11), (12) at H
AC-3	Access Enforcement	L, M, H	None in L, M, H (AC-3(14) in the privacy baseline)
AC-4	Information Flow Enforcement	M, H	(4) at H
AC-5	Separation of Duties	M, H	None
AC-6	Least Privilege	M, H	(1), (2), (5), (7), (9), (10) at M, H; (3) at H
AC-7	Unsuccessful Logon Attempts	L, M, H	None
AC-8	System Use Notification	L, M, H	None
AC-10	Concurrent Session Control	H	None
AC-11	Device Lock	M, H	(1) at M, H
AC-12	Session Termination	M, H	None
AC-14	Permitted Actions Without Identification or Authentication	L, M, H	None
AC-17	Remote Access	L, M, H	(1), (2), (3), (4) at M, H
AC-18	Wireless Access	L, M, H	(1), (3) at M, H; (4), (5) at H
AC-19	Access Control for Mobile Devices	L, M, H	(5) at M, H
AC-20	Use of External Systems	L, M, H	(1), (2) at M, H
AC-21	Information Sharing	M, H	None
AC-22	Publicly Accessible Content	L, M, H	None

To choose or tailor a baseline, see the NIST SP 800-53B Control Baselines and Tailoring Guide.

AC-2 Account Management and its enhancements

AC-2 asks you to define permitted and prohibited account types, assign account managers, set prerequisites for group and role membership, specify authorised users, memberships and privileges, require approval to create accounts, create and remove accounts according to your procedures, monitor use, notify account managers when accounts are no longer needed or users leave or move, authorise access on valid authorisation and intended use, review accounts on a frequency you set, change shared account authenticators when members leave, and align with personnel termination and transfer processes.

Item or enhancement	Parameter you must set	Value NHI Mgmt Group recommends
AC-2(h) notification	Time to notify when accounts are not needed, users leave or move, or need-to-know changes	Same business day for leavers; 5 working days for movers
AC-2(j) review	Account review frequency	Quarterly for privileged and service accounts; twice yearly for standard users
AC-2(2) temporary and emergency accounts	Remove or disable, and after what period	Disable automatically within 72 hours, with an expiry set at creation
AC-2(3) disable accounts	Time to disable expired, orphaned, non-compliant or inactive accounts, and the inactivity period	Disable after 45 days inactive for users, matching CIS Safeguard 5.3; for service accounts, alert at 30 days and disable after owner confirmation
AC-2(5) inactivity logout	When users must log out	End of shift, and on leaving a shared workstation
AC-2(13) high-risk individuals	Time to disable after discovery of the defined risk	Within 1 hour of HR or security instruction

The values are our recommendations, not NIST text; set your own and record them in the system security plan. CISA's Cross-Sector Cybersecurity Performance Goals set the same leaver expectation in goal 2.D, Revoking Credentials for Departing Employees. AC-2(1) asks for automated mechanisms to support account management, which in practice means an identity governance tool or SCIM provisioning from an authoritative source. AC-2(4) asks for automatic audit of account creation, modification, enabling, disabling and removal. AC-2(12) (High) adds monitoring for atypical account use and reporting it to defined people.

Inactive accounts are a recurring root cause. The VPN account used against Colonial Pipeline was no longer in use but had never been disabled; see the Colonial Pipeline Ransomware Attack 2021. For process design, see the Joiner-Mover-Leaver Guide and, for service accounts, the NHI Dormancy Detection guide.

AC-3, AC-5 and AC-6: enforcement, separation and least privilege

AC-3 Access Enforcement: enforce approved authorisations for logical access according to your policies. The enforcement mechanism is the evidence: role assignments in the identity provider, cloud IAM policies, database grants and file permissions. Optional enhancements include AC-3(7) role-based and AC-3(13) attribute-based access control.
AC-5 Separation of Duties: identify and document the duties you separate and define authorisations to support it. Typical pairs: requesting and approving access, developing and deploying code, administering and auditing logs. See the Segregation of Duties Guide.
AC-6 Least Privilege: allow only the access needed for assigned tasks, for users and for processes acting on their behalf.

AC-6 enhancement	Requirement	Typical implementation
(1) Authorize Access to Security Functions	Explicitly authorise access to defined security functions and security-relevant information	Named list of security roles with approvers
(2) Non-privileged Access for Nonsecurity Functions	Users with security function access use non-privileged accounts for other work	Separate admin accounts; no email or browsing from them
(3) Network Access to Privileged Commands (H)	Allow network access to privileged commands only for defined needs, with rationale in the plan	Privileged access through a managed jump host or PAM gateway
(5) Privileged Accounts	Restrict privileged accounts to defined personnel or roles	Just-in-time elevation; small count of standing admins
(7) Review of User Privileges	Review privileges on a set frequency and remove or reassign	Access certification campaigns with recorded removals
(9) Log Use of Privileged Functions	Log execution of privileged functions	Admin activity and command logging to the SIEM
(10) Prohibit Non-privileged Users from Executing Privileged Functions	Prevent non-privileged users from executing privileged functions	No local admin for standard users; application control

For techniques, see the Least Privilege Techniques Guide and the Privileged Access Management Guide.

Logon, lock and session controls: AC-7, AC-8, AC-11, AC-12, AC-14

AC-7 Unsuccessful Logon Attempts: limit consecutive invalid attempts in a time window and then lock the account or node, or delay the next prompt. Lockout thresholds that are too low invite denial of service; pair a moderate threshold with throttling and MFA. See the Account Lockout and Brute-Force Protection Guide.
AC-8 System Use Notification: display a notice before access. The control text is written for US Government systems; non-federal organisations adapt the wording with legal advice.
AC-11 Device Lock: lock after a defined inactivity period or on user request, and keep it locked until re-authentication. AC-11(1) hides the screen contents. CIS Safeguard 4.3 gives 15 minutes or less for general-purpose operating systems and 2 minutes or less for mobile devices, a usable default.
AC-12 Session Termination: end a user session automatically after defined conditions, such as inactivity or time of day. This is distinct from AC-11 and from network disconnect under SC-10.
AC-14 Permitted Actions Without Identification or Authentication: list the actions anyone can take without signing in, such as viewing a public page, and record the rationale in the plan.

Remote, wireless, mobile and external access: AC-17 to AC-22

AC-17 Remote Access: document usage restrictions and configuration for each remote access type and authorise each before connection. Moderate adds automated monitoring and control (1), encryption of sessions (2), routing through managed access control points (3) and restricting privileged commands over remote access to documented needs (4). MFA for remote access comes from IA-2. See the Remote Access Identity Guide.
AC-18 and AC-19: configuration and connection requirements and prior authorisation for wireless access and for organisation-controlled mobile devices; AC-19(5) adds full-device or container-based encryption at Moderate.
AC-20 Use of External Systems: set terms for access from, or processing on, external systems, or prohibit it. AC-20(1) limits use until controls are verified or agreements exist; AC-20(2) restricts portable storage. This is the control behind personal device and third-party SaaS decisions.
AC-21 and AC-22: help users make sharing decisions, and control who may publish content publicly with review before and after posting.

How to evidence AC controls

The SP 800-53A procedures in NIST's OSCAL catalogue ask assessors to examine policy, procedures, configuration and lists (for AC-2, the list of active accounts with the person each belongs to, recently disabled accounts and accounts with changed privileges), interview account managers and administrators, and test the mechanisms.

Control	Evidence to prepare	Test an assessor may run	Common gap
AC-2	Account inventory with owner and type; approval records; HR leaver list reconciled to disabled accounts	Sample leavers and check disable dates against the AC-2(h) parameter	Service accounts with no owner; contractors missing from HR feed
AC-2(3)	Inactivity report and automated disable job logs	List accounts past the inactivity period that are still enabled	Job runs on the directory but not on SaaS or cloud accounts
AC-2(4)	Audit events for account lifecycle actions	Create and delete a test account and find both events	Events logged but not retained or forwarded
AC-5	Separation matrix; role assignments	Find users holding both sides of a separated pair	Matrix exists, nobody checks it
AC-6(5), (7)	Privileged account list mapped to people; review sign-off with removals	Compare privileged roles to the approved list	Reviews approve everything; no removals recorded
AC-6(9)	Privileged activity log samples	Run a privileged action and find it in the SIEM	Cloud control-plane admin actions not collected
AC-7, AC-11, AC-12	Policy exports from the directory and device management	Trigger the lockout and the lock timer	Settings differ between operating systems
AC-17	List of remote access methods with authorisation; gateway configuration	Connect without approval or from an unmanaged device	Vendor remote tools outside the list

For review evidence that stands up, see the Access Reviews Guide and the NIST SP 800-53A Guide.

Implementing the AC family: a phased approach

This order is NHI Mgmt Group's recommendation for a Moderate system.

Set the parameters and the policy. AC-1 policy plus every AC-2, AC-6, AC-7, AC-11 and AC-12 parameter in the system security plan.
Build the account inventory. All human, privileged, service, shared, temporary and emergency accounts across directory, cloud and SaaS, each with an owner and type (AC-2(a), (b)).
Connect the authoritative source. Drive joiner, mover and leaver changes from HR through automated provisioning (AC-2(1), AC-2(l)). Test with a pilot department first and keep manual fallback until reconciliation is clean.
Remove standing privilege. Separate admin accounts (AC-6(2)), reduce standing admins (AC-6(5)) and log privileged functions (AC-6(9)).
Automate inactivity and expiry. Run AC-2(3) in report-only mode for one cycle, review the list with owners, then enforce. Roll back by re-enabling from the audit record, not by pausing the job.
Run the first review. Certify privileged and service accounts (AC-6(7), AC-2(j)) and record removals.

Decision guidance

RBAC or ABAC under AC-3: roles suit stable job functions and are easier to review; attributes suit large or dynamic populations and data-centric rules. Many organisations use roles for coarse access and attributes for conditions.
Small versus large organisations: a small team can meet AC-2 with a directory, a ticket per change and a quarterly export review. Large estates need AC-2(1) automation to keep evidence current.
Lockout versus throttling for AC-7: for internet-facing sign-in, prefer progressive delay and risk-based blocking to hard lockout, and document that choice as the AC-7(b) action.

Detection and measurement

Median time from HR leaver event to account disable, against the AC-2(h) parameter.
Accounts past the inactivity period still enabled, split by human and service accounts.
Standing privileged accounts per system, and share with just-in-time elevation.
Share of privileges removed in each review cycle (zero over several cycles suggests rubber-stamping).
Separation of duties conflicts open at month end.

Alert on account creation outside the provisioning tool, privileged role assignment, and sign-in to accounts flagged as inactive. Route these to monitoring under AU-6 and SI-4.

Where identity fits

Service accounts, workload identities and AI agent credentials fall under AC-2 and AC-6 in the same way as people, but the control text's notification and HR alignment items assume a human. Give each non-human account a human owner, an expiry or review date and a documented purpose, and treat owner departure as an AC-2(h) trigger. See the NHI Ownership Guide.

Framework mapping

SP 800-53 AC	CSF 2.0	SP 800-171 Rev. 3	CIS Controls v8.1
AC-2	PR.AA-01, PR.AA-05	03.01.01	5.1, 5.3, 6.1, 6.2
AC-3	PR.AA-05	03.01.02	3.3, 6.8
AC-5	PR.AA-05	03.01.04	None
AC-6, AC-6(5)	PR.AA-05	03.01.05, 03.01.06, 03.01.07	5.4
AC-7	PR.AA-03	03.01.08	None
AC-11, AC-12	PR.AA-05	03.01.10, 03.01.11	4.3
AC-17	PR.AA-05, PR.IR-01	03.01.12	6.4

Treat these as "intersects with" relationships and confirm them against NIST's published informative references before relying on them; see the Control Mapping Guide.

Common failure patterns

Inventory without service accounts: the AC-2 list covers people only, so service, shared and emergency accounts never get reviewed.
Disable job scoped to one directory: AC-2(3) runs on the on-premises directory while SaaS, cloud and VPN accounts keep working.
Reviews that approve everything: AC-6(7) evidence shows sign-off but no removals, which assessors increasingly treat as ineffective.
Admins working from privileged accounts: email and browsing from accounts with security function access, against AC-6(2).
Remote access sprawl: vendor support tools and legacy VPN profiles outside the AC-17 authorised list.

Practitioner checklist

Record every AC organisation-defined parameter in the system security plan.
Build one account inventory across directory, cloud, SaaS and remote access, with owner and type.
Drive leaver disablement from HR and measure time to disable.
Automate inactivity disablement and include service accounts with owner confirmation.
Separate admin accounts from daily accounts and minimise standing privilege.
Log privileged functions and account lifecycle events to monitoring.
Run privileged and service account reviews and keep the removal records.
List and authorise every remote access method, including vendor tools.

NIST SP 800-53 AC Access Control: Key Controls, Enhancements and How to Evidence Them