{"data":{"id":"AC-03","name":"Access Enforcement","family":"AC","family_name":"Access Control","withdrawn":false,"description":"Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.","supplemental_guidance":"Access control policies control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (i.e., devices, files, records, domains) in organizational systems. In addition to enforcing authorized access at the system level and recognizing that systems can host many applications and services in support of mission and business functions, access enforcement mechanisms can also be employed at the application and service level to provide increased information security and privacy. In contrast to logical access controls that are implemented within the system, physical access controls are addressed by the controls in the Physical and Environmental Protection (PE) family.","enhancements":[{"id":"AC-03(01)","name":"Restricted Access to Privileged Functions","withdrawn":true,"incorporated_into":["AC-06"]},{"id":"AC-03(02)","name":"Dual Authorization","statement":"Enforce dual authorization for [Assignment: organization-defined privileged commands and/or other organization-defined actions].","baselines":[]},{"id":"AC-03(03)","name":"Mandatory Access Control","statement":"Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy, and where the policy:\na. Is uniformly enforced across the covered subjects and objects within the system;\nb. Specifies that a subject that has been granted access to information is constrained from doing any of the following;\n1. Passing the information to unauthorized subjects or objects;\n2. Granting its privileges to other subjects;\n3. Changing one or more security attributes (specified by the policy) on subjects, objects, the system, or system components;\n4. Choosing the security attributes and attribute values (specified by the policy) to be associated with newly created or modified objects; and\n5. Changing the rules governing access control; and\nc. Specifies that [Assignment: organization-defined subjects] may explicitly be granted [Assignment: organization-defined privileges] such that they are not limited by any defined subset (or all) of the above constraints.","baselines":[]},{"id":"AC-03(04)","name":"Discretionary Access Control","statement":"Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following:\na. Pass the information to any other subjects or objects;\nb. Grant its privileges to other subjects;\nc. Change security attributes on subjects, objects, the system, or the system’s components;\nd. Choose the security attributes to be associated with newly created or revised objects; or\ne. Change the rules governing access control.","baselines":[]},{"id":"AC-03(05)","name":"Security-relevant Information","statement":"Prevent access to [Assignment: organization-defined security-relevant information] except during secure, non-operable system states.","baselines":[]},{"id":"AC-03(06)","name":"Protection of User and System Information","withdrawn":true,"incorporated_into":["MP-04","SC-28"]},{"id":"AC-03(07)","name":"Role-based Access Control","statement":"Enforce a role-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined roles and users authorized to assume such roles].","baselines":[]},{"id":"AC-03(08)","name":"Revocation of Access Authorizations","statement":"Enforce the revocation of access authorizations resulting from changes to the security attributes of subjects and objects based on [Assignment: organization-defined rules governing the timing of revocations of access authorizations].","baselines":[]},{"id":"AC-03(09)","name":"Controlled Release","statement":"Release information outside of the system only if:\na. The receiving [Assignment: organization-defined system or system component] provides [Assignment: organization-defined controls]; and\nb. [Assignment: organization-defined controls] are used to validate the appropriateness of the information designated for release.","baselines":[]},{"id":"AC-03(10)","name":"Audited Override of Access Control Mechanisms","statement":"Employ an audited override of automated access control mechanisms under [Assignment: organization-defined conditions] by [Assignment: organization-defined roles].","baselines":[]},{"id":"AC-03(11)","name":"Restrict Access to Specific Information Types","statement":"Restrict access to data repositories containing [Assignment: organization-defined information types].","baselines":[]},{"id":"AC-03(12)","name":"Assert and Enforce Application Access","statement":"a. Require applications to assert, as part of the installation process, the access needed to the following system applications and functions: [Assignment: organization-defined system applications and functions];\nb. Provide an enforcement mechanism to prevent unauthorized access; and\nc. Approve access changes after initial installation of the application.","baselines":[]},{"id":"AC-03(13)","name":"Attribute-based Access Control","statement":"Enforce attribute-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined attributes to assume access permissions].","baselines":[]},{"id":"AC-03(14)","name":"Individual Access","statement":"Provide [Assignment: organization-defined mechanisms] to enable individuals to have access to the following elements of their personally identifiable information: [Assignment: organization-defined elements].","baselines":["privacy"]},{"id":"AC-03(15)","name":"Discretionary and Mandatory Access Control","statement":"a. Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy; and\nb. Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy.","baselines":[]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"AC-03","name":"Access Enforcement","description":"Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.","discussion":"Access control policies control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (i.e., devices, files, records, domains) in organizational systems. In addition to enforcing authorized access at the system level and recognizing that systems can host many applications and services in support of mission and business functions, access enforcement mechanisms can also be employed at the application and service level to provide increased information security and privacy. In contrast to logical access controls that are implemented within the system, physical access controls are addressed by the controls in the Physical and Environmental Protection (PE) family.","related_controls":["AC-02","AC-04","AC-05","AC-06","AC-16","AC-17","AC-18","AC-19","AC-20","AC-21","AC-22","AC-24","AC-25","AT-02","AT-03","AU-09","CA-09","CM-05","CM-11","IA-02","IA-05","IA-06","IA-07","IA-11","IA-13","MA-03","MA-04","MA-05","MP-04","PM-02","PS-03","PT-02","PT-03","SA-17","SC-02","SC-03","SC-04","SC-12","SC-13","SC-28","SC-31","SC-34","SI-04","SI-08"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":""}},"compliance_mappings":{"iso_27001_2022":["A.5.15","A.5.33","A.8.3","A.8.4","A.8.18","A.8.20","A.8.26"],"iso_27002_2022":["5.15","8.3","8.4"],"cobit_2019":["DSS05","DSS06"],"pci_dss_v4":["1.2.8","3.4","7.2","7.3"],"nist_csf_2":["PR.AA-05","PR.DS-01","PR.DS-10","PR.IR-01"],"cis_controls_v8":["CIS 3.3","CIS 6","CIS 6.7","CIS 6.8","CIS 13.9"],"soc2_tsc":["CC6.1","CC6.6","CC6.6-POF2"],"finos_ccc":["CCC-C05","CCC-C11"],"iso_42001_2023":["A.9.2","A.9.4"],"iec_62443":["3-3 SR 2.1","3-3 SR 4.1"],"asd_e8":["E8-8 ML3"],"nis2":["Art. 21(2)(i)"],"apra_cps_234":["Para 22-23"],"mas_trm":["9","15"],"pra_op_resilience":[],"bsi_grundschutz":["ORP.4","SYS.1.1","SYS.2.1"],"anssi":["Hygiene.14","Hygiene.15","Hygiene.17","SecNumCloud.10.3"],"osfi_b13":["B-13.3.2"],"finma_circular":["IV.B.d(59)","IV.B.d(60)","IV.C(61)"],"gdpr":["Art.5(1)(f)","Art.25(2)","Art.32(1)(b)"],"dora":["Art.9(4)(c)"],"bio2":["5.15","8.3","8.4"],"rbi_csf":["Annex1.8","ITGRCA.19"],"fisc":["FISC.T2","FISC.T5","FISC.T11"],"lgpd_bcb":["BCB.Art.3","BCB.OpenFinance","BCB.PIX","LGPD.Art.11","LGPD.Art.46"],"hkma_tme1":["TME1.8.1","TME1.10.3","TME1.11.2"],"mlps_2":["8.1.3.2","8.1.4.2","8.2","8.4","8.5"],"dnb_good_practice":["DNB.12.3","DNB.17.2","DNB.20.1"],"cra":["CRA.I.2d"],"swift_cscf":["SWIFT.2.9","SWIFT.2.11A","SWIFT.5.1","SWIFT.5.4","SWIFT.6.3"],"cbb_tm":["TM-6"],"cbuae":["CR-4"],"nca_ecc":["2-2","2-7"],"qatar_nia":["AC"],"sama_csf":["3.1"],"uae_ia":["T9"],"bog_cisd":["CISD-IX","CISD-VIII"],"bom_ctrm":["3.3"],"cbe_csf":["CTO-1","CTO-5"],"cbn_csf":["Part3.2","Part5.2"],"popia":["s19"],"sa_js2":["JS2-7.1"],"bcbs_239":["Principle 11"],"bot_cyber":["Ch2.2"],"cpmi_pfmi":["CG.PR","PFMI.P17"],"eba_ict":["3.4.2"],"ecb_croe":["CROE.2.3.1"],"ffiec_is":["II.C.7(b)","II.C.13(a)","II.C.15","II.C.15(a)","II.C.15(b)","II.C.18"],"hipaa_sr":["§164.308(a)(3)(i)","§164.308(a)(3)(ii)(A)","§164.308(a)(4)(i)","§164.308(a)(4)(ii)(B)","§164.308(a)(4)(ii)(C)","§164.310(b)","§164.312(a)(1)","§164.312(a)(2)(i)","§164.312(a)(2)(ii)","§164.314(b)(2)"],"iosco_cyber":["PROT-1"],"nydfs_500":["500.7"],"sebi_cscrf":["PR.AA"],"cmmc_2":["AC"],"nerc_cip":["CIP-003-9","CIP-004-7","CIP-005-7","CIP-007-6","CIP-011-3","CIP-012-2"],"nrc_73_54":["73.54(c)(1)","RG5.71-A-AC"],"tsa_psd":["SD-2 Sec B"],"ieee_1686":["5.1","5.9"],"ferc_cip":[],"doe_c2m2":["ACCESS"],"api_1164":["Sec 6"],"awia":["AWWA Sec 3"],"iaea_nss":["Sec 5.3"],"pci_pts":[],"fips_140":[],"cbest":["CBEST.9"],"tiber_eu":["TIBER.CONF"],"pci_hsm":["4","8"],"common_criteria":["CC Part 2 — FDP"],"isae_3402":["Clause 4"],"fca_sysc_13":["SYSC 13.7.3"],"fda_21_cfr_11":["§11.10(d)","§11.10(g)"],"fda_cyber":["SA-1","SA-4"],"hitrust_csf":["01.a","01.c","13.e"],"iso_27799":["9.1","9.5","H.4"],"lloyds_ms":["MS1.1","MS2.1","MS5.1","MS6.1","MS8.3"],"naic_ds":["4-access","4B"],"nhs_dspt":["NDG-1.1","NDG-4.1"],"pra_ss1_23":["P3.3","P3.6","P-IT.1"],"solvency_ii":["DR.266-DataSec","EIOPA-ICT-4.4"],"owasp_masvs_v2":["MASVS-AUTH-1","MASVS-AUTH-3","MASVS-PLATFORM-1","MASVS-PRIVACY-1","MASVS-PRIVACY-4","MASVS-STORAGE-1"],"csa_ccm_v4":["DSP-17","IAM-16"],"csa_aicm":["DSP-17","IAM-16","MDS-07"],"ccss_v9":["1.03.5","1.05.1"],"mica":["Art.40(1)","Art.55(1)","Art.62(9)","Art.63(1)","Art.67(1)","Art.97(1)"],"basel_sco60":["SCO60.61","SCO60.62","SCO60.66"],"bssc":["GSP-11","KMS-06","KMS-09","NOS-05","TIS-07"],"sec_custody_digital":["SEC-CD-02","SEC-CD-05"],"dpdpa":["Act.8(5)","Act.11","Rules.6(1)(b)","Rules.Sch1.B.3-4","Rules.Sch1.B.7","Rules.Sch2"],"nist_ai_rmf_1":[],"eu_ai_act":["Art.4a","Art.15(5)","Art.55(1)(d)"]},"metadata":{"last_reviewed":"2026-10-26","review_notes":"2026-10-03: iso_27001_2022 A.5.33, A.8.18, A.8.20, A.8.26 added from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR entry 155), which OSA's mapping now takes as its base. 2026-10-03: nist_csf_2 PR.IR-01 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base. 2026-10-26: hipaa_sr §164.310(b), §164.312(a)(2)(i), §164.312(a)(2)(ii) added from NIST's HIPAA Security Rule to SP 800-53 Rev 5.1.1 crosswalk (OLIR entry 110), which OSA's mapping now takes as its base. 2026-10-26: nerc_cip CIP-003-9, CIP-004-7, CIP-005-7, CIP-012-1 added from NIST and NERC's SP 800-53 Rev 5.2.0 to NERC CIP crosswalk (OLIR entry 232), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-001","SP-002","SP-004","SP-005","SP-008","SP-011","SP-013","SP-020","SP-022","SP-023","SP-027","SP-028","SP-029","SP-030","SP-032","SP-033","SP-037","SP-039","SP-040","SP-041","SP-042","SP-044","SP-047","SP-050","SP-051","SP-052","SP-053","SP-054"],"attack":{"techniques":279,"route":"/api/v1/controls/AC-03?fields=attack"}}}