AC-3 Access Enforcement
Control
Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
Discussion
Access control policies control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (i.e., devices, files, records, domains) in organizational systems. In addition to enforcing authorized access at the system level and recognizing that systems can host many applications and services in support of mission and business functions, access enforcement mechanisms can also be employed at the application and service level to provide increased information security and privacy. In contrast to logical access controls that are implemented within the system, physical access controls are addressed by the controls in the Physical and Environmental Protection ( [PE](#pe) ) family.
Control enhancements (15)
- AC-3(1)Restricted Access to Privileged Functions
- AC-3(2)Dual Authorization
- AC-3(3)Mandatory Access Control
- AC-3(4)Discretionary Access Control
- AC-3(5)Security-relevant Information
- AC-3(6)Protection of User and System Information
- AC-3(7)Role-based Access Control
- AC-3(8)Revocation of Access Authorizations
- AC-3(9)Controlled Release
- AC-3(10)Audited Override of Access Control Mechanisms
- AC-3(11)Restrict Access to Specific Information Types
- AC-3(12)Assert and Enforce Application Access
- AC-3(13)Attribute-based Access Control
- AC-3(14)Individual AccessPRIVACY
- AC-3(15)Discretionary and Mandatory Access Control
Related controls
Need AC-3 implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.