{"data":{"id":"AC-20","name":"Use of External Systems","family":"AC","family_name":"Access Control","withdrawn":false,"description":"a. [Selection (one or more): Establish [Assignment: organization-defined terms and conditions]; Identify [Assignment: organization-defined controls asserted to be implemented on external systems]], consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to:\n1. Access the system from external systems; and\n2. Process, store, or transmit organization-controlled information using external systems; or\nb. Prohibit the use of [Assignment: organizationally-defined types of external systems].","supplemental_guidance":"External systems are systems that are used by but not part of organizational systems, and for which the organization has no direct control over the implementation of required controls or the assessment of control effectiveness. External systems include personally owned systems, components, or devices; privately owned computing and communications devices in commercial or public facilities; systems owned or controlled by nonfederal organizations; systems managed by contractors; and federal information systems that are not owned by, operated by, or under the direct supervision or authority of the organization. External systems also include systems owned or operated by other components within the same organization and systems within the organization with different authorization boundaries. Organizations have the option to prohibit the use of any type of external system or prohibit the use of specified types of external systems, (e.g., prohibit the use of any external system that is not organizationally owned or prohibit the use of personally-owned systems).\n\nFor some external systems (i.e., systems operated by other organizations), the trust relationships that have been established between those organizations and the originating organization may be such that no explicit terms and conditions are required. Systems within these organizations may not be considered external. These situations occur when, for example, there are pre-existing information exchange agreements (either implicit or explicit) established between organizations or components or when such agreements are specified by applicable laws, executive orders, directives, regulations, policies, or standards. Authorized individuals include organizational personnel, contractors, or other individuals with authorized access to organizational systems and over which organizations have the authority to impose specific rules of behavior regarding system access. Restrictions that organizations impose on authorized individuals need not be uniform, as the restrictions may vary depending on trust relationships between organizations. Therefore, organizations may choose to impose different security restrictions on contractors than on state, local, or tribal governments.\n\nExternal systems used to access public interfaces to organizational systems are outside the scope of AC-20. Organizations establish specific terms and conditions for the use of external systems in accordance with organizational security policies and procedures. At a minimum, terms and conditions address the specific types of applications that can be accessed on organizational systems from external systems and the highest security category of information that can be processed, stored, or transmitted on external systems. If the terms and conditions with the owners of the external systems cannot be established, organizations may impose restrictions on organizational personnel using those external systems.","enhancements":[{"id":"AC-20(01)","name":"Limits on Authorized Use","statement":"Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after:\na. Verification of the implementation of controls on the external system as specified in the organization’s security and privacy policies and security and privacy plans; or\nb. Retention of approved system connection or processing agreements with the organizational entity hosting the external system.","baselines":["moderate","high"]},{"id":"AC-20(02)","name":"Portable Storage Devices — Restricted Use","statement":"Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using [Assignment: organization-defined restrictions].","baselines":["moderate","high"]},{"id":"AC-20(03)","name":"Non-organizationally Owned Systems — Restricted Use","statement":"Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using [Assignment: organization-defined restrictions].","baselines":[]},{"id":"AC-20(04)","name":"Network Accessible Storage Devices — Prohibited Use","statement":"Prohibit the use of [Assignment: organization-defined network accessible storage devices] in external systems.","baselines":[]},{"id":"AC-20(05)","name":"Portable Storage Devices — Prohibited Use","statement":"Prohibit the use of organization-controlled portable storage devices by authorized individuals on external systems.","baselines":[]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"AC-20","name":"Use of External Systems","description":"a. [Selection (one or more): Establish [Assignment: organization-defined terms and conditions]; Identify [Assignment: organization-defined controls asserted to be implemented on external systems]], consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to:\n1. Access the system from external systems; and\n2. Process, store, or transmit organization-controlled information using external systems; or\nb. Prohibit the use of [Assignment: organizationally-defined types of external systems].","discussion":"External systems are systems that are used by but not part of organizational systems, and for which the organization has no direct control over the implementation of required controls or the assessment of control effectiveness. External systems include personally owned systems, components, or devices; privately owned computing and communications devices in commercial or public facilities; systems owned or controlled by nonfederal organizations; systems managed by contractors; and federal information systems that are not owned by, operated by, or under the direct supervision or authority of the organization. External systems also include systems owned or operated by other components within the same organization and systems within the organization with different authorization boundaries. Organizations have the option to prohibit the use of any type of external system or prohibit the use of specified types of external systems, (e.g., prohibit the use of any external system that is not organizationally owned or prohibit the use of personally-owned systems).\n\nFor some external systems (i.e., systems operated by other organizations), the trust relationships that have been established between those organizations and the originating organization may be such that no explicit terms and conditions are required. Systems within these organizations may not be considered external. These situations occur when, for example, there are pre-existing information exchange agreements (either implicit or explicit) established between organizations or components or when such agreements are specified by applicable laws, executive orders, directives, regulations, policies, or standards. Authorized individuals include organizational personnel, contractors, or other individuals with authorized access to organizational systems and over which organizations have the authority to impose specific rules of behavior regarding system access. Restrictions that organizations impose on authorized individuals need not be uniform, as the restrictions may vary depending on trust relationships between organizations. Therefore, organizations may choose to impose different security restrictions on contractors than on state, local, or tribal governments.\n\nExternal systems used to access public interfaces to organizational systems are outside the scope of AC-20. Organizations establish specific terms and conditions for the use of external systems in accordance with organizational security policies and procedures. At a minimum, terms and conditions address the specific types of applications that can be accessed on organizational systems from external systems and the highest security category of information that can be processed, stored, or transmitted on external systems. If the terms and conditions with the owners of the external systems cannot be established, organizations may impose restrictions on organizational personnel using those external systems.","related_controls":["AC-02","AC-03","AC-17","AC-19","CA-03","PL-02","PL-04","SA-09","SC-07"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Title changed from 'Use of External Information Systems' Added parameter incorporates original text into a selection list  Added parameter defines external systems prohibited from use  Discussion adds reference to privacy and expands on organizational options regarding use or prohibition of external systems"}},"compliance_mappings":{"iso_27001_2022":["A.5.10","A.5.14","A.5.23","A.7.9","A.8.20"],"iso_27002_2022":["5.10","5.14","5.23"],"cobit_2019":["DSS05"],"pci_dss_v4":["1.5","12.2"],"nist_csf_2":["ID.AM-02","ID.AM-04"],"cis_controls_v8":["CIS 13.5"],"soc2_tsc":["CC6.7"],"finos_ccc":["CCC-C05"],"iso_42001_2023":["A.10.2"],"iec_62443":[],"asd_e8":[],"nis2":["Art. 21(2)(i)"],"apra_cps_234":[],"mas_trm":["9"],"pra_op_resilience":["SS2/21-9.1","SS2/21-14.1"],"bsi_grundschutz":["ORP.4"],"anssi":["Hygiene.9","Hygiene.22","SecNumCloud.16.1"],"osfi_b13":["B-13.3.2","B-13.4.1"],"finma_circular":["IV.B.d(59)","IV.F(100)","V(101)"],"gdpr":["Art.28(1)","Art.28(3)(a)","Art.32(1)(b)"],"dora":["Art.28(1)(a)","Art.28(5)"],"bio2":["5.10","5.14","5.23"],"rbi_csf":["Annex1.8","ITGRCA.20"],"fisc":["FISC.O6","FISC.T9","FISC.T13"],"lgpd_bcb":["BCB.Art.11"],"hkma_tme1":["TME1.8.5","TME1.12.4"],"mlps_2":["8.1.3.1"],"dnb_good_practice":[],"cra":[],"swift_cscf":["SWIFT.1.4"],"cbb_tm":["TM-6","TM-15"],"cbuae":["CR-4"],"nca_ecc":["2-6","4-2"],"qatar_nia":["AC","CS"],"sama_csf":["3.8","4.3"],"uae_ia":["T8","T9"],"bog_cisd":["CISD-VIII","CISD-XI","CISD-XII","CISD-XIII"],"bom_ctrm":["3.2"],"cbe_csf":["CTO-1","CTO-11"],"cbn_csf":["Part2.4","Part3.2"],"sa_js2":["JS2-7.1"],"bcbs_239":["Principle 14"],"bot_cyber":["Ch2.6","Ch5.2"],"cpmi_pfmi":["CG.PR"],"eba_ict":["3.2.3"],"ecb_croe":["CROE.2.2.3"],"ffiec_is":["II.C.6","II.C.13(e)","II.C.15(c)","II.C.16"],"hipaa_sr":["§164.310(b)"],"iosco_cyber":["PFMI-20"],"nydfs_500":["500.7","500.11"],"sebi_cscrf":["PR.CS"],"cmmc_2":["AC"],"nerc_cip":["CIP-003-9","CIP-004-7","CIP-005-7","CIP-010-4","CIP-011-3","CIP-013-2"],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":["Sec 5.3"],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":["Clause 7","Clause 8"],"fca_sysc_13":["SYSC 13.7.3"],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":["01.b","01.d","05.c"],"iso_27799":["6.3","8.3","13.2","15.2","H.2"],"lloyds_ms":["MS6.1","MS8.3","MS13.1"],"naic_ds":["4-access","4D"],"nhs_dspt":["NDG-9.7"],"pra_ss1_23":[],"solvency_ii":["Art.49(1)","DR.272","EIOPA-Cloud-GL3"],"owasp_masvs_v2":[],"csa_ccm_v4":["HRS-02","UEM-14"],"csa_aicm":["HRS-02","UEM-14"],"ccss_v9":[],"mica":[],"basel_sco60":[],"bssc":[],"sec_custody_digital":["SEC-CD-10"],"dpdpa":[],"nist_ai_rmf_1":[],"eu_ai_act":[]},"metadata":{"last_reviewed":"2026-10-26","review_notes":"2026-10-03: iso_27001_2022 A.7.9, A.8.20 added from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR entry 155), which OSA's mapping now takes as its base. 2026-10-03: nist_csf_2 ID.AM-02, ID.AM-04 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base. 2026-10-26: nerc_cip CIP-003-9, CIP-004-7, CIP-010-4, CIP-011-3, CIP-013-2 added from NIST and NERC's SP 800-53 Rev 5.2.0 to NERC CIP crosswalk (OLIR entry 232), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-013","SP-015","SP-019","SP-021","SP-022","SP-025","SP-029","SP-030","SP-046"],"attack":{"techniques":64,"route":"/api/v1/controls/AC-20?fields=attack"}}}