{"data":{"id":"AC-16","name":"Security and Privacy Attributes","family":"AC","family_name":"Access Control","withdrawn":false,"description":"a. Provide the means to associate [Assignment: organization-defined types of security and privacy attributes] with [Assignment: organization-defined security and privacy attribute values] for information in storage, in process, and/or in transmission;\nb. Ensure that the attribute associations are made and retained with the information;\nc. Establish the following permitted security and privacy attributes from the attributes defined in AC-16a for [Assignment: organization-defined systems]: [Assignment: organization-defined security and privacy attributes];\nd. Determine the following permitted attribute values or ranges for each of the established attributes: [Assignment: organization-defined attribute values or ranges for established attributes];\ne. Audit changes to attributes; and\nf. Review [Assignment: organization-defined security and privacy attributes] for applicability [Assignment: organization-defined frequency].","supplemental_guidance":"Information is represented internally within systems using abstractions known as data structures. Internal data structures can represent different types of entities, both active and passive. Active entities, also known as subjects, are typically associated with individuals, devices, or processes acting on behalf of individuals. Passive entities, also known as objects, are typically associated with data structures, such as records, buffers, tables, files, inter-process pipes, and communications ports. Security attributes, a form of metadata, are abstractions that represent the basic properties or characteristics of active and passive entities with respect to safeguarding information. Privacy attributes, which may be used independently or in conjunction with security attributes, represent the basic properties or characteristics of active or passive entities with respect to the management of personally identifiable information. Attributes can be either explicitly or implicitly associated with the information contained in organizational systems or system components.\n\nAttributes may be associated with active entities (i.e., subjects) that have the potential to send or receive information, cause information to flow among objects, or change the system state. These attributes may also be associated with passive entities (i.e., objects) that contain or receive information. The association of attributes to subjects and objects by a system is referred to as binding and is inclusive of setting the attribute value and the attribute type. Attributes, when bound to data or information, permit the enforcement of security and privacy policies for access control and information flow control, including data retention limits, permitted uses of personally identifiable information, and identification of personal information within data objects. Such enforcement occurs through organizational processes or system functions or mechanisms. The binding techniques implemented by systems affect the strength of attribute binding to information. Binding strength and the assurance associated with binding techniques play important parts in the trust that organizations have in the information flow enforcement process. The binding techniques affect the number and degree of additional reviews required by organizations. The content or assigned values of attributes can directly affect the ability of individuals to access organizational information.\n\nOrganizations can define the types of attributes needed for systems to support missions or business functions. There are many values that can be assigned to a security attribute. By specifying the permitted attribute ranges and values, organizations ensure that attribute values are meaningful and relevant. Labeling refers to the association of attributes with the subjects and objects represented by the internal data structures within systems. This facilitates system-based enforcement of information security and privacy policies. Labels include classification of information in accordance with legal and compliance requirements (e.g., top secret, secret, confidential, controlled unclassified), information impact level; high value asset information, access authorizations, nationality; data life cycle protection (i.e., encryption and data expiration), personally identifiable information processing permissions, including individual consent to personally identifiable information processing, and contractor affiliation. A related term to labeling is marking. Marking refers to the association of attributes with objects in a human-readable form and displayed on system media. Marking enables manual, procedural, or process-based enforcement of information security and privacy policies. Security and privacy labels may have the same value as media markings (e.g., top secret, secret, confidential). See MP-03 (Media Marking).","enhancements":[{"id":"AC-16(01)","name":"Dynamic Attribute Association","statement":"Dynamically associate security and privacy attributes with [Assignment: organization-defined subjects and objects] in accordance with the following security and privacy policies as information is created and combined: [Assignment: organization-defined security and privacy policies].","baselines":[]},{"id":"AC-16(02)","name":"Attribute Value Changes by Authorized Individuals","statement":"Provide authorized individuals (or processes acting on behalf of individuals) the capability to define or change the value of associated security and privacy attributes.","baselines":[]},{"id":"AC-16(03)","name":"Maintenance of Attribute Associations by System","statement":"Maintain the association and integrity of [Assignment: organization-defined security and privacy attributes] to [Assignment: organization-defined subjects and objects].","baselines":[]},{"id":"AC-16(04)","name":"Association of Attributes by Authorized Individuals","statement":"Provide the capability to associate [Assignment: organization-defined security and privacy attributes] with [Assignment: organization-defined subjects and objects] by authorized individuals (or processes acting on behalf of individuals).","baselines":[]},{"id":"AC-16(05)","name":"Attribute Displays on Objects to Be Output","statement":"Display security and privacy attributes in human-readable form on each object that the system transmits to output devices to identify [Assignment: organization-defined special dissemination, handling, or distribution instructions] using [Assignment: organization-defined human-readable, standard naming conventions].","baselines":[]},{"id":"AC-16(06)","name":"Maintenance of Attribute Association","statement":"Require personnel to associate and maintain the association of [Assignment: organization-defined security and privacy attributes] with [Assignment: organization-defined subjects and objects] in accordance with [Assignment: organization-defined security and privacy policies].","baselines":[]},{"id":"AC-16(07)","name":"Consistent Attribute Interpretation","statement":"Provide a consistent interpretation of security and privacy attributes transmitted between distributed system components.","baselines":[]},{"id":"AC-16(08)","name":"Association Techniques and Technologies","statement":"Implement [Assignment: organization-defined techniques and technologies] in associating security and privacy attributes to information.","baselines":[]},{"id":"AC-16(09)","name":"Attribute Reassignment — Regrading Mechanisms","statement":"Change security and privacy attributes associated with information only via regrading mechanisms validated using [Assignment: organization-defined techniques or procedures].","baselines":[]},{"id":"AC-16(10)","name":"Attribute Configuration by Authorized Individuals","statement":"Provide authorized individuals the capability to define or change the type and value of security and privacy attributes available for association with subjects and objects.","baselines":[]}],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"nist_800_53":{"rev5":{"id":"AC-16","name":"Security and Privacy Attributes","description":"a. Provide the means to associate [Assignment: organization-defined types of security and privacy attributes] with [Assignment: organization-defined security and privacy attribute values] for information in storage, in process, and/or in transmission;\nb. Ensure that the attribute associations are made and retained with the information;\nc. Establish the following permitted security and privacy attributes from the attributes defined in AC-16a for [Assignment: organization-defined systems]: [Assignment: organization-defined security and privacy attributes];\nd. Determine the following permitted attribute values or ranges for each of the established attributes: [Assignment: organization-defined attribute values or ranges for established attributes];\ne. Audit changes to attributes; and\nf. Review [Assignment: organization-defined security and privacy attributes] for applicability [Assignment: organization-defined frequency].","discussion":"Information is represented internally within systems using abstractions known as data structures. Internal data structures can represent different types of entities, both active and passive. Active entities, also known as subjects, are typically associated with individuals, devices, or processes acting on behalf of individuals. Passive entities, also known as objects, are typically associated with data structures, such as records, buffers, tables, files, inter-process pipes, and communications ports. Security attributes, a form of metadata, are abstractions that represent the basic properties or characteristics of active and passive entities with respect to safeguarding information. Privacy attributes, which may be used independently or in conjunction with security attributes, represent the basic properties or characteristics of active or passive entities with respect to the management of personally identifiable information. Attributes can be either explicitly or implicitly associated with the information contained in organizational systems or system components.\n\nAttributes may be associated with active entities (i.e., subjects) that have the potential to send or receive information, cause information to flow among objects, or change the system state. These attributes may also be associated with passive entities (i.e., objects) that contain or receive information. The association of attributes to subjects and objects by a system is referred to as binding and is inclusive of setting the attribute value and the attribute type. Attributes, when bound to data or information, permit the enforcement of security and privacy policies for access control and information flow control, including data retention limits, permitted uses of personally identifiable information, and identification of personal information within data objects. Such enforcement occurs through organizational processes or system functions or mechanisms. The binding techniques implemented by systems affect the strength of attribute binding to information. Binding strength and the assurance associated with binding techniques play important parts in the trust that organizations have in the information flow enforcement process. The binding techniques affect the number and degree of additional reviews required by organizations. The content or assigned values of attributes can directly affect the ability of individuals to access organizational information.\n\nOrganizations can define the types of attributes needed for systems to support missions or business functions. There are many values that can be assigned to a security attribute. By specifying the permitted attribute ranges and values, organizations ensure that attribute values are meaningful and relevant. Labeling refers to the association of attributes with the subjects and objects represented by the internal data structures within systems. This facilitates system-based enforcement of information security and privacy policies. Labels include classification of information in accordance with legal and compliance requirements (e.g., top secret, secret, confidential, controlled unclassified), information impact level; high value asset information, access authorizations, nationality; data life cycle protection (i.e., encryption and data expiration), personally identifiable information processing permissions, including individual consent to personally identifiable information processing, and contractor affiliation. A related term to labeling is marking. Marking refers to the association of attributes with objects in a human-readable form and displayed on system media. Marking enables manual, procedural, or process-based enforcement of information security and privacy policies. Security and privacy labels may have the same value as media markings (e.g., top secret, secret, confidential). See MP-03 (Media Marking).","related_controls":["AC-03","AC-04","AC-06","AC-21","AC-25","AU-02","AU-10","MP-03","PE-22","PT-02","PT-03","PT-04","SC-11","SC-16","SI-12","SI-18"],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Title changed from 'Security Attributes' Adds privacy to parameters Adds control text for auditing changes to attributes Adds control text and parameters for reviewing security and privacy attributes at a specified frequency Discussion includes new attributes and incorporates discussion about security attribute binding from withdrawn control AC-04(18)"}},"compliance_mappings":{"iso_27001_2022":["A.5.13"],"iso_27002_2022":["5.12","5.13"],"cobit_2019":["DSS05"],"pci_dss_v4":[],"nist_csf_2":["PR.AA-05"],"cis_controls_v8":[],"soc2_tsc":[],"finos_ccc":["CCC-C16"],"iso_42001_2023":["A.7.4","A.7.5"],"iec_62443":[],"asd_e8":[],"nis2":["Art. 21(2)(i)"],"apra_cps_234":[],"mas_trm":["9"],"pra_op_resilience":[],"bsi_grundschutz":["ORP.4"],"anssi":["Hygiene.8"],"osfi_b13":["B-13.3.2"],"finma_circular":["IV.D(78)","IV.D(79)","IV.D(80)"],"gdpr":["Art.5(1)(e)","Art.9(1)"],"dora":["Art.8(1)","Art.8(4)"],"bio2":["5.12","5.13"],"rbi_csf":[],"fisc":["FISC.O9","FISC.T5"],"lgpd_bcb":["LGPD.Art.11"],"hkma_tme1":["TME1.7.2"],"mlps_2":[],"dnb_good_practice":["DNB.2.2","DNB.6.1","DNB.12.3"],"cra":[],"swift_cscf":[],"cbb_tm":["TM-6","TM-9"],"cbuae":["CR-5"],"nca_ecc":["2-7"],"qatar_nia":["AC","AM"],"sama_csf":["3.1"],"uae_ia":["T4","T9"],"bog_cisd":["CISD-V"],"cbe_csf":["CTO-2"],"cbn_csf":["Part3.4"],"popia":["s26-27","s28-33"],"sa_js2":["JS2-6.1"],"bcbs_239":["Principle 11"],"bot_cyber":["Ch2.2"],"iosco_cyber":["ID-4"],"cmmc_2":["AC"],"nerc_cip":["CIP-011-3"],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":["CC Part 2 — FDP"],"isae_3402":[],"fca_sysc_13":[],"fda_21_cfr_11":["§11.10(g)"],"fda_cyber":[],"hitrust_csf":["07.b"],"iso_27799":["5.3","8.2"],"lloyds_ms":["MS7.1","MS8.7"],"naic_ds":[],"nhs_dspt":["NDG-4.4"],"pra_ss1_23":[],"solvency_ii":["DR.266-DataSec","EIOPA-ICT-4.3"],"owasp_masvs_v2":[],"csa_ccm_v4":["DSP-04","DSP-06","IAM-16"],"csa_aicm":["DSP-04","DSP-06","IAM-16"],"ccss_v9":[],"mica":[],"basel_sco60":["SCO60.70"],"bssc":[],"sec_custody_digital":[],"dpdpa":[],"nist_ai_rmf_1":[],"eu_ai_act":["Art.50(2)","Art.50(4)"],"hipaa_sr":["§164.310(b)"]},"metadata":{"last_reviewed":"2026-10-26","review_notes":"2026-10-03: nist_csf_2 PR.AA-05 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base. 2026-10-03: baselines LMH to ---, from NIST SP 800-53B Release 5.2.0. 2026-10-26: hipaa_sr §164.310(b) added from NIST's HIPAA Security Rule to SP 800-53 Rev 5.1.1 crosswalk (OLIR entry 110), which OSA's mapping now takes as its base. 2026-10-26: nerc_cip CIP-011-3 added from NIST and NERC's SP 800-53 Rev 5.2.0 to NERC CIP crosswalk (OLIR entry 232), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-013","SP-044","SP-052"],"attack":{"techniques":57,"route":"/api/v1/controls/AC-16?fields=attack"}}}