Information Technology (IT) 

Access Control (AC) Standard

February 9, 2024

U.S. Department of Education (ED)

Office of the Chief Information Officer (OCIO)

Information Assurance Services (IAS)

Questions about the policies outlined in this document should be directed to Information 

Assurance Services (IAS) at OCIO_IAS@ed.gov
Information Technology (IT) Access Control (AC) Standard

Version 5.5 i

APPROVAL

____________________________________________________

Steven Hernandez

Director, IAS/Chief Information Security Officer (CISO)
Information Technology (IT) Access Control (AC) Standard

Version 5.5 ii

Revision History

The table below identifies all changes that have been incorporated into this document.

Version Date Summary of Changes

1.0 12/22/2021

Initial draft of new standard which combines National Institute 

of Standards and Technology (NIST) Special Publication (SP)

800-53, Revision (Rev.) 5 controls, including ED specific 

control parameter values, with existing policy standards.

1.1 1/14/2022 Update to incorporate feedback from Information Assurance 

Services (IAS), Governance, Risk and Policy (GRP) Team.

1.2 1/31/2022

Update to incorporate feedback from IAS; address new security 

measures required by Executive Order (EO) 14028, including 

Office of Management and Budget (OMB) regulations and 

memoranda and updated NIST guidance issued to comply with 

EO 14028.

1.3 2/11/2022 Update AC-2(j)

1.4 12/13/2022

Annual review. Clean up formatting and numbering throughout

and update broken links. Add footnote to high value asset 

(HVA) control reference in Section 2. Updated AC-2c and AC2d to provide clarity. Added control overlay to include AC-2(3), 

AC-5, and AC-6 to the ED Low system baseline. Added control 

overlay AC-2(2). Updated AC-10 and AC-19(5). Added AC20(3) control overlays ED-01 through ED-03.

5.5 2/9/2024

Aligned document major version number to align with NIST SP 

800-53 revision number. Clean up formatting and numbering 

throughout and update broken links. Section 2, Standards was 

updated to include the description of incorporating 

organizationally defined parameters (ODP) for controls that 

may be necessary from external control overlays (e.g., High 

Value Assets [HVA]). Updated Section 4, Acronyms as 

appropriate. Updated language in controls AC-02(01), AC02(02), AC-02(03), AC-02(12), AC-03(14), AC-04, AC-05 ED02, AC-05 ED-04, AC-05 ED-06, AC-06(02), AC-06(07), AC06(07) ED-01, AC-08, AC-11, AC-12, AC-20, AC-20(03) ED02, AC-20(03) ED-03, and AC-21. Added controls AC-02(07), 

AC-02(09), AC-03(09), AC-02(11), AC-04(21), AC-06(06), 

AC-06(08), AC-07(02), AC-12(01), AC-17(09), AC-20(05), 

and AC-23. Added “leading zeros” to control identifiers in

alignment with patch release of NIST SP 800-53 (Release 5.1.1)

to applicable controls, enhancements, and overlays.
Information Technology (IT) Access Control (AC) Standard

Version 5.5 iii

Table of Contents

1 INTRODUCTION ................................................................................................................................1

1.1 Purpose..........................................................................................................................................1

1.2 Scope.............................................................................................................................................1

2 STANDARDS.......................................................................................................................................2

2.1 AC-01 Policy and Procedures (P, L, M, H) ..................................................................................3

2.2 AC-02 Account Management (L, M, H and Control Overlay) .....................................................4

2.3 AC-03 Access Enforcement (L, M, H) .........................................................................................7

2.4 AC-04 Information Flow Enforcement (M, H).............................................................................8

2.5 AC-05 Separation of Duties (M, H and Control Overlay)............................................................8

2.6 AC-06 Least Privilege (M, H and Control Overlay)...................................................................10

2.7 AC-07 Unsuccessful Logon Attempts (L, M, H)........................................................................12

2.8 AC-08 System Use Notification (L, M, H and Control Overlay) ...............................................12

2.9 AC-10 Concurrent Session Control (H)......................................................................................13

2.10 AC-11 Device Lock (M, H)........................................................................................................13

2.11 AC-12 Session Termination (M, H)............................................................................................13

2.12 AC-14 Permitted Actions Without Identification or Authentication (L, M, H)..........................14

2.13 AC-17 Remote Access (L, M, H) ...............................................................................................14

2.14 AC-18 Wireless Access (L, M, H)..............................................................................................15

2.15 AC-19 Access Control for Mobile Devices (L, M, H)................................................................15

2.16 AC-20 Use of External Systems (L, M, H).................................................................................15

2.17 AC-21 Information Sharing (M, H) ............................................................................................17

2.18 AC-22 Publicly Accessible Content (L, M, H)...........................................................................17

2.19 AC-23 Data Mining Protection ...................................................................................................17

3 RISK ACCEPTANCE/POLICY EXCEPTIONS ...............................................................................18

4 ACRONYMS......................................................................................................................................19

APPENDIX A - BASELINE CONTROL PARAMETER SUMMARY....................................................21

APPENDIX B - USER NOTIFICATION WARNING BANNER.............................................................40
Information Technology (IT) Access Control (AC) Standard

Version 5.5 1

1 INTRODUCTION

This governance document establishes U.S. Department of Education (ED or Department)

information technology (IT) system access control standards necessary to improve the efficiency 

of operation or security of Department information systems and comply with Federal laws, 

regulations, Executive Orders (EO), Emergency Directives, Binding Operational Directives

(BOD), and Department Administrative Communications System Directives (ACSD) and 

Handbooks. In doing so, these standards supersede any prior governance documentation 

establishing such standards.

1.1 Purpose

The Federal Information Security Modernization Act (FISMA)

1

and implementing governance 

Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic 

Resource2, requires each federal agency to develop, document, and implement an agency-wide 

program to provide information security for the information and information systems that support 

the operations and assets of the agency, including those provided or managed by another agency, 

contractor, or other source, and services that are either fully or partially provided, including 

agency-hosted, outsourced, and cloud-based solutions. Federal Information Processing Standard

(FIPS) Publication (PUB) 200, Minimum Security Requirements for Federal Information and 

Information Systems3, mandates the use of National Institute of Standards and Technology (NIST) 

Special Publication (SP) 800-53, Security and Privacy Controls for Information Systems and 

Organizations4, as amended, as baseline information system controls.

1.2 Scope

These standards apply to all information and information systems that support the operations and 

assets of the Department, including those provided or managed by another agency, contractor, or 

other source, as well as services that are either fully or partially provided, including Departmenthosted, outsourced, and cloud-based solutions. Principal Offices, employees, contractors, external 

service providers and system users are required to comply with these access control standards.

1 Public Law 113-283-Dec. 18, 2014, https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf

2 Office of Management and Budget (OMB) Circular A-130, 

https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf

3 FIPS PUB 200, https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.200.pdf

4 NIST SP 800-53, Rev. 5, https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
Information Technology (IT) Access Control (AC) Standard

Version 5.5 2

2 STANDARDS

The Department standards for IT system access controls are organized to follow the order in which 

controls are presented in the current version of NIST SP 800-53. To define a control baseline for 

Department information systems, a FIPS PUB 199 categorization level (e.g., Low [L], Moderate 

[M] and High [H]) is assigned to each requirement. This designator indicates a requirement applies 

to information systems categorized at that FIPS PUB 199 impact-level. Designators are also used 

to indicate when NIST SP 800-53 Privacy (P) baseline controls are required. To manage risk to 

within the Department’s risk tolerance and appetite, control overlays are provided when the 

Department requires implementation of control(s) that are not required by the FIPS PUB 199 

impact-level or privacy baseline.

In addition to the controls required by this standard, high value assets (HVAs) must implement 

and comply with the current version of the HVA Control Overlay5issued and maintained by the 

U.S. Department of Homeland Security (DHS), Cybersecurity & Infrastructure Security Agency

(CISA). Systems that process federal tax information (FTI) must implement and comply with the 

Internal Revenue Service (IRS) Publication 10756, Tax Information Security Guidelines for 

Federal, State and Local Agencies: Safeguards for Protecting Federal Tax Returns and Return 

Information. Systems that are Federal Risk and Authorization Management Program (FedRAMP) 

authorized must implement and comply with the FedRAMP identified baselines7.

Throughout the standard, there are controls captured that have not been scoped to any specific 

security or privacy baseline. This is intentional as all controls for identified external overlays and 

baselines (e.g., FedRAMP, IRS, HVA), that may apply to systems within the Department, have 

been incorporated into the standard. This ensures the organization defined parameters (ODPs) for 

controls within the Department have been clearly defined in a consistent manner.

Based upon an assessment of risk and determination that the level of protection for the securityrelevant information within a system is not adversely impacted, media protection controls 

identified in the current version of NIST SP 800-53B that support only the confidentiality security 

objective may be downgraded to the corresponding media protection control in a lower baseline 

(or modified or eliminated if not defined in a lower baseline).

This standard directly supports the Department’s integration of the NIST Cybersecurity 

Framework (CSF) and NIST Privacy Framework (PF) by using business drivers to guide 

cybersecurity activities and considering cybersecurity risks as part of the Department’s risk 

management processes. Refer to APPENDIX A - BASELINE CONTROL PARAMETER

SUMMARY for a summary of controls by baseline and corresponding NIST CSF and NIST PF

categories and subcategories.

5 HVA Control Overlay https://www.cisa.gov/resources-tools/resources/high-value-asset-control-overlay

6

IRS Publication 1075 https://www.irs.gov/pub/irs-pdf/p1075.pdf

7 FedRAMP baselines https://www.fedramp.gov/baselines/
Information Technology (IT) Access Control (AC) Standard

Version 5.5 3

2.1 AC-01 Policy and Procedures (P, L, M, H)

Develop, document, and disseminate to all ED employees, contractors, and users authorized to 

access to ED information systems, or systems/services operated or maintained on behalf of ED, or 

ED information as defined in ACSD-OCIO-0048, Cybersecurity Policy, a department-level access 

control policy (e.g., this document) that:

(a) addresses purpose, scope, roles, responsibilities, management commitment, coordination 

among organizational entities, and compliance; and

(b) is consistent with applicable laws, executive orders, directives, regulations, policies, 

standards, and guidelines.

(c) authorizes the Department Chief Information Security Officer (CISO) and Department 

Chief Information Officer (CIO) to issue subordinate standards, procedures, and memos, 

with the same authority and enforcement as ACSD-OCIO-004, Cybersecurity Policy.

The Department CISO in conjunction with the Senior Agency Official for Privacy (SAOP) are 

designated to manage the development, documentation, and dissemination of the Department-level 

IT system access control policy.

Review and update the policy annually (i.e., each fiscal year) and following the identification of 

evolving threats, issuance of new or significantly changed existing Federal laws, executive orders, 

directives, regulations, and ED policies, identification of emerging technology and information 

technology service delivery models and determination that adjustments are deemed necessary to 

improve its effectiveness based upon feedback from Principal Office personnel.

The Office of the Chief Information Officer (OCIO), Information Assurance Services (IAS) 

manage the development, documentation, and dissemination of the Department-level IT system

access control standard operating procedures in support of this policy standard. IAS Branch Chiefs

shall review these access control procedures annually (i.e., each fiscal year) and following the 

identification of evolving threats, issuance of new or significantly changed existing Federal laws, 

executive orders, directives, regulations, and ED policies, identification of emerging technology 

and information technology service delivery models and determination that adjustments are 

deemed necessary to improve its effectiveness based upon feedback from Principal Office 

personnel.

Principal Office Information System Owners (ISO) and Information System Security Officers

(ISSOs) are required to manage the development, documentation, and dissemination of system 

specific procedures to facilitate the implementation of the Department’s IT system access control 

policy, and the associated access controls. The ISO and ISSO review access control procedures 

annually (i.e., each fiscal year) and following the identification of evolving threats, issuance of 

new or significantly changed existing Federal laws, executive orders, directives, regulations, and 

8 Also known as OCIO: 3-112
Information Technology (IT) Access Control (AC) Standard

Version 5.5 4

ED policies, identification of emerging technology and information technology service delivery 

models and determination that adjustments are deemed necessary to improve its effectiveness 

based upon feedback from Principal Office personnel.

2.2 AC-02 Account Management (L, M, H and Control Overlay)

a. Define and document the types of accounts allowed and specifically prohibited for use within 

the system.

b. Assign account managers.

c. Require ISO and ISSO to document recommended prerequisites and criteria (based on defined 

user role(s) matrix in the System Security Plan (SSP) System Description Narrative: Types of 

Users) and require implementation of these prerequisites and criteria for group and role 

membership.

d. Specify:

1. Authorized users of the system.

2. Group and role membership.

3. Access authorizations (i.e., privileges) and the following attributes as defined in the user 

role(s) matrix in SSP System Description Narrative: User Types: Internal or External; 

Privileged (P), Non-Privileged (NP), or No Logical Access (NLA); Sensitivity Level9in 

accordance with control PS-2; Authorized Privileges; and Functions Performed for each 

account.

e. Require approvals by ISO, ISSO, or assigned delegate for requests to create accounts.

f. Create, enable, modify, disable, and remove accounts in accordance with least privilege and 

separation of duties, and Department policies and supporting standards, including the standards 

within this document.

g. Monitor the use of accounts.

h. Notify account managers and assigned help desks, support services teams, ISO, ISSO, or 

assigned delegate(s), when applicable, within:

1. As soon as possible but no later than one business day after notification received with 

actions for privileged users prioritized, when accounts are no longer required;

2. As soon as possible but no later than one business day after notification received with 

actions for privileged users prioritized, when users are terminated or transferred; and

9 Position Sensitivity And Risk (opm.gov)
Information Technology (IT) Access Control (AC) Standard

Version 5.5 5

3. As soon as possible but no later than one business day after notification received with 

actions for privileged users prioritized, when system usage or need-to-know changes for 

an individual.

i. Authorize access to the system based on:

1. A valid access authorization;

2. Intended system usage; and

3. Requested roles/privileges.

j. Review accounts for compliance with account management requirements monthly for HVAs

and High impact systems and quarterly for Moderate and Low impact systems. Based upon the 

review, modify, or remove accounts, as necessary, to correctly reflect organizational mission 

and business need. Not applicable to cloud service providers or Shared Services.

k. Establish and implement a process for changing shared or group account authenticators (if 

deployed) when individuals are removed from the group.

l. Align account management processes with personnel termination and transfer process.

Control Overlay AC-02 ED-01 (L, M, H): Uniquely identify and authenticate each service 

attempting to access EO-critical software or EO-critical software platforms.

Control Overlay AC-02 ED-02 (L, M, H): Follow privileged access management principles for 

network-based administration of EO-critical software and EO-critical software platforms by

requiring unique identification of each administrator.

2.2.1 AC-02(01) Account Management | Automated System Account Management (M, H)

Support the management of system accounts using internal system functions, ED Identity, 

Credential, and Access Management (ICAM), single sign on, or recommended automated 

mechanisms approved by the ED Authorizing Official (AO) and with email, telephonic, and text 

messaging notifications sent to system personnel, including the ISO and ISSO, when functionality 

is available.

2.2.2 AC-02(02) Account Management | Automated Temporary and Emergency Account 

Management (M, H and Control Overlay)

Automatically disable temporary and emergency accounts after identification that the 

temporary/emergency access is no longer required, not to exceed one business day.

Control Overlay AC-02(02) ED-01 (L, M, H): Document, approve and govern emergency/break 

glass accounts required to support administration of Department mission critical infrastructure.
Information Technology (IT) Access Control (AC) Standard

Version 5.5 6

2.2.3 AC-02(03) Account Management | Disable Accounts (M, H and Control Overlay)

Disable accounts within as soon as possible but no later than one business day when the accounts:

a. Have expired;

b. Are no longer associated with a user or individual;

c. Are in violation of organizational policy; or

d. Have been inactive for ninety (90) days for Moderate systems and 30 days for High systems 

and HVAs. If no automated capability is available, manual methods must be implemented 

and documented in the SSP. ISSOs are responsible for ensuring inactive accounts are 

disabled if the system cannot do so automatically.

Control Overlay AC-02(03) ED-01 (L): Disable accounts within as soon as possible but no later 

than one business day when the accounts:

a. Have expired;

b. Are no longer associated with a user or individual;

c. Are in violation of organizational policy; or

d. Have been inactive for ninety (90) days for Low systems. If no automated capability is 

available, manual methods must be implemented and documented in the SSP. ISSOs are 

responsible for ensuring inactive accounts are disabled if the system cannot do so 

automatically.

2.2.4 AC-02(04) Account Management | Automated Audit Actions (M, H)

Automatically audit account creation, modification, enabling, disabling, and removal actions.

2.2.5 AC-02(05) Account Management | Inactivity Logout (M, H)

Require that users log out when they expect to be inactive for more than 12 hours.

2.2.6 AC-02(07) Account Management | Privileged User Accounts

a. Establish and administer privileged user accounts in accordance with a role-based access 

scheme, and only one local account to be used as the account of last resort in the event the 

authentication service is unavailable;

b. Monitor privileged role or attribute assignments;

c. Monitor changes to roles or attributes; and

d. Revoke access when privileged role or attribute assignments are no longer appropriate.
Information Technology (IT) Access Control (AC) Standard

Version 5.5 7

2.2.7 AC-02(09) Account Management | Restrictions on Use of Shared and Group 

Accounts

Only permit the use of shared and group accounts that meet a defined need with business 

justification explaining why such accounts are necessary and the conditions for establishing shared 

and group accounts.

2.2.8 AC-02(11) Account Management | Usage Conditions (H)

Enforce ISSO recommended circumstances and/or usage conditions which determine when system 

accounts can be used such as restricting usage to certain days of the week, time of day, or specific 

durations of time approved by the ISO for privileged user, temporary and emergency accounts.

2.2.9 AC-02(12) Account Management | Account Monitoring for Atypical Usage (H)

a. Monitor system accounts for atypical times of day and originating internet protocol (IP)

address for a known privileged account user that are inconsistent with normal usage patterns;

and

b. Report atypical usage of system accounts to the ED Security Operations Center (EDSOC) and 

ISSO.

2.2.10 AC-02(13) Account Management | Disable Accounts for High-Risk Individuals (M, 

H)

Disable accounts of individuals within twenty-four (24) hours of discovery of a security incident 

reported to or under investigation by the EDSOC. Accounts can be directed to be disabled by the 

CIO/CISO/ED Information System Security Manager (ISSM)/ISSO/ISO/Contracting Officer’s 

Representative (COR)/EDSOC in reference to a security incident. If automated disabling 

capability is unavailable, manual methods must be implemented and documented in the SSP. 

ISSOs are responsible for ensuring inactive accounts are disabled.

2.3 AC-03 Access Enforcement (L, M, H)

Enforce approved authorizations for logical access to information and system resources in 

accordance with applicable access control policies.

2.3.1 AC-03(09) Access Enforcement | Controlled Release

Release information outside of the system only if:

a. The receiving system or system component provides a level of protection commensurate 

with the confidentiality, integrity, and availability impact levels of the information being 

shared; and

b. A documented manual process or automated tools are used to validate the appropriateness 

of the information designated for release.
Information Technology (IT) Access Control (AC) Standard

Version 5.5 8

2.3.2 AC-03(11) Access Enforcement | Restrict Access to Specific Information Types

Restrict access to data repositories containing cryptographic keys, authentication information, and 

sensitive information requiring extra protection (e.g., personally identifiable information, federal 

tax information).

2.3.3 AC-03(14) Access Enforcement | Individual Access (P)

Provide a self-service mechanism (e.g., application interface) and/or the Department's Privacy Act 

Request Form to enable individuals to have access to the following elements of their personally 

identifiable information those elements identified in privacy disclosures with the SAOP and Office 

of the General Counsel (OGC) consulted to determine appropriate mechanisms and access rights 

or limitations.

2.4 AC-04 Information Flow Enforcement (M, H)

Enforce approved authorizations for controlling the flow of information within the system and 

between connected systems based on the approved enterprise zero trust architecture (ZTA) 

services (e.g., Web Service Security [WS Security], WS-Security Policy, WS Trust, WS Policy 

Framework, Security Assertion Markup Language [SAML], Extensible Access Control Markup 

Language [XACML]).

2.4.1 AC-04(04) Information Flow Enforcement | Flow Control of Encrypted Information

(H)

Prevent encrypted information from bypassing authorized information flow control mechanisms 

available for use by decrypting the information; blocking the flow of the encrypted information; 

or terminating communications sessions attempting to pass encrypted information.

2.4.2 AC-04(21) Information Flow Enforcement | Physical or Logical Separation of 

Information Flows

Separate information flows logically or physically using defined mechanisms and/or techniques to 

accomplish business or mission required separations by types of information.

2.5 AC-05 Separation of Duties (M, H and Control Overlay)

a. Identify and document within the system description narrative, all system user roles, privileges,

and duties assigned to each role, the specific duties and privileges that each role cannot 

perform, and rationale for why they are incompatible; and

b. Define system access authorizations to support separation of duties.

Control Overlay AC-05 ED-01 (M, H): Separate duties so that critical IT functions are segregated 

to prevent any one person from having the authority or ability to harm or circumvent normal checks 

and balances of a development or an operational system or the services it provides, whether by 

accident, omission, or intentional act.
Information Technology (IT) Access Control (AC) Standard

Version 5.5 9

Control Overlay AC-05 ED-02 (M, H): Consider and document user roles, privileges, and duties 

that are potential for fraudulent activity during assignment and review of system access privileges.

Control Overlay AC-05 ED-03 (M, H): Determine assignment of roles by ISOs and designees to 

ensure:

a. At least two people are involved within each process or sub-process

b. Two people are involved in certain controls, where necessary (i.e., at times a single control 

may be split into activities that are assigned to different individuals)

Control Overlay AC-05 ED-04 (M, H): Ensure system development roles for financial systems 

categorized as HVAs are distinctly segregated from production environments. Per ACSD-OFO00310

, Financial Management, a financial system is an information system comprised of one or 

more applications that are used for any of the following:

a. Collecting, processing, maintaining, transmitting, and reporting data about financial

events;

b. Supporting financial planning or budgeting activities;

c. Accumulating and reporting cost information; or

d. Supporting the preparation of financial statements.

Control Overlay AC-05 ED-05 (M, H): Ensure the following incompatible responsibilities are

separated for financial systems:

a. Initiation of a transaction vs. approval of the same transaction

b. Updating of vendor/employee records vs. approval of financial transactions related to that 

vendor/employee

c. Processing of transactions vs. authorization of access to systems/applications.

Control Overlay AC-05 ED-06 (M, H): Establish mitigating controls in instances in which it is 

impractical to have meaningful separation of duties due to limited staff and ensure these controls 

are rigorously documented and followed. In such cases, direct managerial involvement provides a 

strong deterrent to potential conflicting activities/interests. Examples of such involvement include:

a. Rotation of duties among personnel

b. Increased hands-on supervision

c. Enforced vacations

d. Having a manager perform one aspect of the transaction (e.g., approving invoices)

10 Also known as OFO: 1-103
Information Technology (IT) Access Control (AC) Standard

Version 5.5 10

e. Active review by management of financial data and reports (e.g., reconciliations, voucher

status report, appropriation status reports)

f. A detailed management review of activities involving finances, inventory, and other assets

must be required as a compensating control activity.

g. Increased frequency of audit log review, especially for those logs generated from privileged

user activities.

h. Increase monitoring through behavioral and pattern detection to identify atypical behavior.

Control Overlay AC-05 ED-07 (L):

a. Identify and document within the system description narrative, all system user roles, privileges, 

and duties assigned to each role, the specific duties and privileges that each role cannot 

perform, and rationale for why they are incompatible; and

b. Define system access authorizations to support separation of duties.

2.6 AC-06 Least Privilege (M, H and Control Overlay)

Employ the principle of least privilege, allowing only authorized accesses for users (or processes 

acting on behalf of users) that are necessary to accomplish assigned organizational and system 

specific tasks.

Control Overlay AC-06 ED-01 (L, M, H): Use fine-grained access control for data and resources 

used by EO-critical software and EO-critical software platforms to enforce the principle of least 

privilege to the extent possible.

Control Overlay AC-06 ED-02 (L): Employ the principle of least privilege, allowing only 

authorized accesses for users (or processes acting on behalf of users) that are necessary to 

accomplish assigned organizational tasks.

2.6.1 AC-06(01) Least Privilege | Authorize Access to Security Functions (M, H)

Authorize access for security administrators, system administrators, system security officers, 

system programmers, and other privileged users to:

a. Security functions (deployed in hardware, software, and firmware) including, at a 

minimum:

1. Establishing system accounts, configuring access authorizations (i.e., permissions, 

privileges);

2. Setting/modifying audit logs and auditing behavior.

3. Setting/modifying boundary protection system rules;

4. Configuring/modifying access authorizations (i.e., permissions, privileges);

5. Setting/modifying authentication parameters; and
Information Technology (IT) Access Control (AC) Standard

Version 5.5 11

6. Setting/modifying system configurations and parameters; and

b. Filtering rules for routers or firewalls, configuration parameters for security services, 

cryptographic key management information, and access control lists.

2.6.2 AC-06(02) Least Privilege | Non-privileged Access for Nonsecurity Functions (M, H)

Require that users of system accounts (or roles) with access to security relevant information or 

security functions (examples of security functions include but are not limited to: establishing 

system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to 

be audited, and setting intrusion detection parameters, system programming, system and security 

administration, other privileged functions) use non-privileged accounts or roles, when accessing 

non-security functions.

2.6.3 AC-06(03) Least Privilege | Network Access to Privileged Commands (H)

Authorize network access to all privileged commands (i.e., any command requiring privileges 

above a standard user) only for compelling operational needs as approved by the ISO, ISSO, and 

or the AO, based upon an assessment of risk and document the rationale for such access in the 

security plan for the system.

2.6.4 AC-06(05) Least Privilege | Privileged Accounts (M, H)

Restrict privileged accounts on the system to individuals, services and systems/machines approved 

by the ISO, ISSO, and/or the AO based upon an assessment of risk.

2.6.5 AC-06(06) Least Privilege | Privileged Access by Non-Organizational Users

Prohibit privileged access to the system by non-organizational users.

2.6.6 AC-06(07) Least Privilege | Review of User Privileges (M, H and Control Overlay)

a. Review monthly for HVAs and High impact systems; quarterly for Moderate impact systems 

the privileges assigned to all privileged roles and users to validate the need for such privileges; 

and

b. Reassign or remove privileges, if necessary, to correctly reflect organizational mission and 

business needs.

Control Overlay AC-06(07) ED-01 (L): Review Quarterly for Low impact systems the privileges 

assigned to all privileged roles and users to validate the need for such privileges. Based upon the 

review, reassign or remove privileges, if necessary, to correctly reflect organizational mission and 

business need.

2.6.7 AC-06(08) Least Privilege | Privilege Levels for Code Execution

Prevent the following software from executing at higher privilege levels than users executing the 

software: any software except software explicitly documented, approved, and registered on the 

technology standards and products guide (TSPG).
Information Technology (IT) Access Control (AC) Standard

Version 5.5 12

2.6.8 AC-06(09) Least Privilege | Log Use of Privileged Functions (M, H)

Log the execution of privileged functions.

2.6.9 AC-06(10) Least Privilege | Prohibit Non-Privileged Users from Executing 

Privileged Functions (M, H)

Prevent non-privileged users from executing privileged functions.

2.7 AC-07 Unsuccessful Logon Attempts (L, M, H)

a. Enforce a limit of three (3) consecutive invalid logon attempts by a user during a thirty (30)

minute period with system accounts locked immediately upon any unsuccessful attempt to 

login; and

b. Automatically lock the account or node for thirty (30) minutes unless the user contacts the 

Help Desk to manually unlock the account during the thirty (30) minute period. For system 

accounts and systems unable to set the thirty (30) minute lockout duration, accounts must 

remain locked until being reset by an administrator. After three (3) consecutive account lockouts due to unsuccessful login attempts, the account must be disabled until an administrator

can re-enable it.

2.7.1 AC-07(02) Unsuccessful Logon Attempts | Purge or Wipe Mobile Device

Purge or wipe information from mobile devices based on approved purging or wiping requirements 

and techniques after ten (10) consecutive, unsuccessful device logon attempts.

2.8 AC-08 System Use Notification (L, M, H and Control Overlay)

Except for Institute of Education Sciences (IES) websites that adhere to the Education Science 

Reform Act11, all Principal Office systems must:

a. Display the Department’s approved system use notification message or banner (see 

APPENDIX B - USER NOTIFICATION WARNING BANNER) to users before granting 

access to the system that provides privacy and security notices consistent with applicable 

laws, executive orders, directives, regulations, policies, standards, and guidelines and state 

that:

1. Users are accessing a U.S. Government system;

2. System usage may be monitored, recorded, and subject to audit;

3. Unauthorized use of the system is prohibited and subject to criminal and civil penalties; 

and

4. Use of the system indicates consent to monitoring and recording;

11 Education Sciences Reform Public Law 107-279
Information Technology (IT) Access Control (AC) Standard

Version 5.5 13

b. Retain the notification message or banner on the screen until users acknowledge the usage 

conditions and take explicit actions to log on to or further access the system.

c. For publicly accessible systems:

1. Display system use information when accessed via logon interfaces with human users, 

before granting further access to the publicly accessible system;

2. Display references, if any, to monitoring, recording, or auditing that are consistent with 

privacy accommodations for such systems that generally prohibit those activities; and

3. Include a description of the authorized uses of the system.

Control Overlay AC-08 ED-01 (L, M, H): The System Use Notification or Warning Banner shall 

be documented and implemented before an Authorization to Operate (ATO) is issued or if during 

change management a new site or existing site is changed that would necessitate the re-validation 

that the banner is still implemented and presented to users of internet-accessible production web 

applications and ED websites.

2.9 AC-10 Concurrent Session Control (H)

Limit the number of concurrent sessions for each standard user, power user, privileged user, 

service account and machine account to the number of sessions required by specific role to perform 

essential duties as documented and approved by the ISSO.

2.10 AC-11 Device Lock (M, H)

a. Prevent further access to the system by initiating a device lock after fifteen (15) minutes of 

inactivity and requiring the user to initiate a device lock before leaving the system unattended; 

and

b. Retain the device lock until the user reestablishes access using established identification and 

authentication procedures.

2.10.1 AC-11(01) Device Lock | Pattern-Hiding Displays (M, H)

Conceal, via the device lock, information previously visible on the display with a publicly 

viewable image.

2.11 AC-12 Session Termination (M, H)

Automatically terminate a user session after:

a. Fifteen (15) minutes of session inactivity within user-initiated application sessions;

b. Targeted responses to certain types of incidents; and

c. Time-of-day restrictions on system use, if implemented.
Information Technology (IT) Access Control (AC) Standard

Version 5.5 14

2.11.1 AC-12(01) Session Termination | User-Initiated Logouts

Provide a logout capability for user-initiated communications sessions whenever authentication is 

used to gain access to sensitive information (e.g., personally identifiable information [PII], FTRI).

2.12 AC-14 Permitted Actions Without Identification or Authentication (L, M, 

H)

a. Identify specific actions based upon an assessment of risk that can be performed on the system 

without identification or authentication consistent with organizational mission and business 

functions; and

b. Document and provide supporting rationale in the security plan for the system, user actions not 

requiring identification or authentication.

2.13 AC-17 Remote Access (L, M, H)

a. Establish and document usage restrictions, configuration/connection requirements, and 

implementation guidance for each type of remote access allowed; and

b. Authorize each type of remote access to the system prior to allowing such connections.

2.13.1 AC-17(01) Remote Access | Monitoring and Control (M, H)

Employ automated mechanisms to monitor and control remote access methods.

2.13.2 AC-17(02) Remote Access | Protection of Confidentiality and Integrity Using 

Encryption (M, H)

Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access 

sessions.

2.13.3 AC-17(03) Remote Access | Managed Access Control Points (M, H)

Route remote accesses through authorized and managed network access control points.

2.13.4 AC-17(04) Remote Access | Privileged Commands and Access (M, H)

a. Authorize the execution of privileged commands and access to security-relevant information 

via remote access only in a format that provides assessable evidence and for the following 

needs: ISO, ISSO, and/or AO approved special cases for remote administration and 

maintenance tasks; and

b. Document the rationale for remote access in the security plan for the system.

2.13.5 AC-17(09) Remote Access | Disconnect or Disable Access

Provide the capability to disconnect or disable remote access to the system within timelines 

commensurate with the situational need as identified by the ISO, ISSO, and/or AO.
Information Technology (IT) Access Control (AC) Standard

Version 5.5 15

2.14 AC-18 Wireless Access (L, M, H)

a. Establish configuration requirements, connection requirements, and implementation guidance 

for each type of wireless access; and

b. Authorize each type of wireless access to the system prior to allowing such connections.

2.14.1 AC-18(01) Wireless Access | Authentication and Encryption (M, H)

Protect wireless access to the system using authentication of users and devices and FIPS validated 

encryption.

2.14.2 AC-18(03) Wireless Access | Disable Wireless Networking (M, H)

Disable, when not intended for use, wireless networking capabilities embedded within system 

components prior to issuance and deployment.

2.14.3 AC-18(04) Wireless Access | Restrict Configurations by Users (H)

Identify and explicitly authorize users allowed to independently configure wireless networking 

capabilities.

2.14.4 AC-18(05) Wireless Access | Antennas and Transmission Power Levels (H)

Select radio antennas and calibrate transmission power levels to reduce the probability that signals 

from wireless access points can be received outside of organization-controlled boundaries.

2.15 AC-19 Access Control for Mobile Devices (L, M, H)

a. Establish configuration requirements, connection requirements, and implementation guidance 

for organization-controlled mobile devices, to include when such devices are outside of 

controlled areas; and

b. Authorize the connection of mobile devices to organizational systems.

2.15.1 AC-19(05) Access Control for Mobile Devices | Full Device and Container-based 

Encryption (M, H)

Employ full device encryption whenever possible, or with written AO authorization, container 

encryption when full device is not possible to protect the confidentiality and integrity of 

information on ED-approved and authorized mobile devices and services.

2.16 AC-20 Use of External Systems (L, M, H)

a. Establish, maintain and monitor Interconnection Security Agreements (ISAs), Inter Agency 

Agreements (IAA) and other agreements with external agencies per NIST SP 800-47 and ED 

policies and standards including ACSD-OFO-05112, Interagency Agreements and ACSD12 Also known as OPEDP:1-101
Information Technology (IT) Access Control (AC) Standard

Version 5.5 16

OCIO-00213, Controlled Unclassified Information Program; and establish, maintain and 

monitor other binding agreements with employees and contractors which include ED-defined 

controls to be implemented on personally owned systems, components, or devices consistent 

with trust relationships established with other organizations owning, operating, and/or 

maintaining external systems, allowing authorized individuals to:

1. Access the system from external systems; and

2. Process, store, or transmit organization-controlled information using external systems

b. Prohibit the use of external systems not covered by a current ISA, IAA, or other agreements 

with external agencies.

2.16.1 AC-20(01) Use of External Systems | Limits on Authorized Use (M, H)

Permit authorized individuals to use an external system to access the system or to process, store, 

or transmit organization-controlled information only after:

a. Verification of the implementation of controls on the external system as specified in the 

Department’s security and privacy policies and system specific security and privacy plans; 

or

b. Retention of approved system connection or processing agreements with the organizational 

entity hosting the external system.

2.16.2 AC-20(02) Use of External Systems | Portable Storage Devices — Restricted Use (M, 

H)

Restrict the use of organization-controlled portable storage devices by authorized individuals on 

external systems using governance policies and procedures, and when available automated 

technology which prohibits the use of any external system that is not ED owned or authorized 

including the use of personally owned or corporate-owned systems and services.

2.16.3 AC-20(03) Use of External Systems | Non-Organizationally Owned Systems –

Restricted Use (Control Overlay)

Not applicable to Privacy Baseline or Security Control Baseline for Low, Moderate, or High 

systems; control overlays apply.

Control Overlay AC-20(03) ED-01 (L, M, H): Prohibit conducting official ED business using 

personal or corporate email accounts if an official Department email account has been assigned.

Control Overlay AC-20(03) ED-02 (L, M, H): Prohibit configuring Department email accounts to 

auto-forward to non-ED.gov email addresses, by an email administrator or an end user, without 

formal approval by the Office of the Chief Information Officer (OCIO), Enterprise Technology 

Services (ETS).

13 Also known as OCIO: 3-113
Information Technology (IT) Access Control (AC) Standard

Version 5.5 17

Control Overlay AC-20(03) ED-03 (L, M, H): Prohibit the use of any external system or device

that is not ED owned or authorized including the use of personally owned or corporate-owned 

systems and services unless specifically authorized as an exception by the Enterprise Program 

Management Review (EPMR)/Enterprise Architecture Technology Insertion, also known as EA 

(TI).

2.16.4 AC-20(05) Use of External Systems | Portable Storage Devices – Prohibited Use

Prohibit the use of organization-controlled portable storage devices by authorized individuals on 

external systems.

2.17 AC-21 Information Sharing (M, H)14

a. Enable authorized users to determine whether access authorizations assigned to a sharing 

partner match the information’s access and use restrictions for information that may be 

restricted in some manner based on some formal or administrative determination including but 

not limited to contract-sensitive information, privileged information, proprietary information, 

and personally identifiable information; and

b. Employ non-disclosure agreements (NDAs) and when feasible automated processes which use 

information flow and security attributes to assist users in making information sharing and 

collaboration decisions.

2.18 AC-22 Publicly Accessible Content (L, M, H)

a. Designate individuals authorized to make information publicly accessible;

b. Train authorized individuals to ensure that publicly accessible information does not contain 

nonpublic information;

c. Review the proposed content of information prior to posting onto the publicly accessible 

system to ensure that nonpublic information is not included; and

d. Review the content on the publicly accessible system for nonpublic information annually (i.e., 

each fiscal year) and remove such information, if discovered.

2.19 AC-23 Data Mining Protection 

Employ data mining prevention and detection techniques for data storage objects to detect and 

protect against unauthorized data mining.

14 AC-21 has been identified by NIST SP 800-53B as supporting only confidentiality and may be downgraded to the 

corresponding control in a lower baseline (or modified or eliminated if defined in a lower baseline) only if the 

downgrading action reflects the security category for the supported confidentiality security objective defined impact 

level.
Information Technology (IT) Access Control (AC) Standard

Version 5.5 18

3 RISK ACCEPTANCE/POLICY EXCEPTIONS

Deviations from the Department policies, Instructions, Standards, Procedures or Memos must be 

approved and documented through the Department’s Risk Acceptance process. Deviations that 

introduce additional risks to the enterprise must be submitted through the Department Risk 

Acceptance Form (RAF) and must be approved by the ED CISO (as delegated). Requests must 

justify the reason for the deviation(s)/exception(s) as well as the compensating security controls 

implemented to secure the device or information, if applicable. Policy deviations that do not 

introduce additional risks do not need to be submitted through the Department RAF but will need 

to be approved by the Department CISO (as delegated).
Information Technology (IT) Access Control (AC) Standard

Version 5.5 19

4 ACRONYMS

Acronym Definition

AC Access Control Family

ACSD Administrative Communications System Directive

AO Authorizing Official

ATO Authorization to Operate

BOD Binding Operational Directive

CIO Chief Information Officer

CISA Cybersecurity & Infrastructure Security Agency

CISO Chief Information Security Officer

CM.AW-P Communicate-P: Data Processing Awareness

COR Contracting Officer’s Representative

CSF Cybersecurity Framework

CT.DM-P Control-P: Data Processing Management

CT.DP-P Control-P: Disassociated Processing

CT.PO-P Control-P: Data Processing Policies, Processes, and Procedures

DE.AE Detect: Anomalies and Events

DE.CM Detect: Security Continuous Monitoring

DE.DP Detect: Detection Process

Department U.S. Department of Education

DHS U.S. Department of Homeland Security

EA (TI) Enterprise Architecture Technology Insertion

ED U.S. Department of Education

EDSOC U.S. Department of Education Security Operations Center

EO Executive Order

EPMR Enterprise Program Management Review

ETS Enterprise Technology Services

FedRAMP Federal Risk and Authorization Management Program

FIPS Federal Information Processing Standard

FISMA Federal Information Security Modernization Act

FTI Federal Tax Information

GRP Governance, Risk and Policy

GV.MT-P Govern-P: Monitoring and Review

GV.PO-P Govern-P: Governance Policies, Processes, and Procedures

H High

HVA High Value Asset

IAA Inter Agency Agreement

IAS Information Assurance Services

ICAM Identity, Credential and Access Management

ID.AM Identify: Asset Management

IES Institute of Education Sciences

IP Internet Protocol

IRS Internal Revenue Service

ISA Interconnection Security Agreement

ISO Information system Owner
Information Technology (IT) Access Control (AC) Standard

Version 5.5 20

Acronym Definition

ISSM Information System Security Manager

ISSO Information System Security Officer

IT Information Technology

L Low

M Moderate

NDA Non-disclosure Agreement

NIST National Institute of Standards and Technology

NLA No Logical Access

NP Non-Privileged

OCIO Office of the Chief Information Officer

ODP Organization Defined Parameter

OFO Office of Finance and Operations

OGC Office of the General Counsel

OMB Office of Management and Budget

P Privacy or Privileged

PF Privacy Framework

PII Personally Identifiable Information

PR.AC Protect: Identity Management and Access Control

PR.AC-P Protect-P: Identity Management, Authentication, and Access Control

PR.DS Protect: Data Security

PR.DS-P Protect-P: Data Security

PR.IP Protect: Information Protection Processes & Procedures

PR.PO-P Protect-P: Data Protection Policies, Processes, and Procedures

PR.PT Protect: Protective Technology

PR.PT-P Protect-P: Protective Technology

PUB Publication

RAF Risk Acceptance Form

Rev. Revision

SAOP Senior Agency Office for Privacy

SP Special Publication

SSP System Security Plan

TSPG Technology Standards and Products Guide

ZTA Zero Trust Architecture
Information Technology (IT) Access Control (AC) Standard

Version 5.5 21

APPENDIX A - BASELINE CONTROL PARAMETER

SUMMARY

The applicability for each baseline control parameter is shown below. 

Control 

Identifier

Control/Control 

Enhancement) 

Name

Privacy 

Baseline

Security 

Control 

Baseline

Low

Security 

Control 

Baseline

Moderate

Security 

Control 

Baseline

High

CSF and 

PF 

Category

CSF and PF 

Subcategory

AC-01 Policy and 

Procedures

x x x x PR.AC, 

DE.DP, 

GV.PO-P, 

GV.MT-P, 

CT.PO-P, 

PR.AC-P

PR.AC-3, 

PR.AC-4, 

DE.DP-2, 

GV.PO-P1, 

GV.PO-P3, 

GV.PO-P5, 

GV.MT-P2, 

GV.MT-P6, 

CT.PO-P2, 

CT.PO-P3, 

PR.AC-P3, 

PR.AC-P4

AC-02 Account 

Management

x x x PR.AC, 

DE.CM, 

CT.DM-P, 

PR.AC-P

PR.AC-4, 

DE.CM-3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4

AC-02(01) Account 

Management | 

Automated System 

Account 

Management

x x PR.AC, 

DE.CM, 

CT.DM-P, 

PR.AC-P

PR.AC-4, 

DE.CM-3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4

AC-02(02) Account 

Management | 

Automated 

Temporary and 

Emergency 

Account 

Management

x x PR.AC, 

DE.CM, 

CT.DM-P, 

PR.AC-P

PR.AC-4, 

DE.CM-3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4
Information Technology (IT) Access Control (AC) Standard

Version 5.5 22

Control 

Identifier

Control/Control 

Enhancement) 

Name

Privacy 

Baseline

Security 

Control 

Baseline

Low

Security 

Control 

Baseline

Moderate

Security 

Control 

Baseline

High

CSF and 

PF 

Category

CSF and PF 

Subcategory

AC-02(03) Account 

Management | 

Disable Accounts

x x PR.AC, 

DE.CM, 

CT.DM-P, 

PR.AC-P

PR.AC-4, 

DE.CM-3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4

AC-02(04) Account 

Management | 

Automated Audit 

Actions

x x PR.AC, 

DE.CM, 

CT.DM-P, 

PR.AC-P

PR.AC-4, 

DE.CM-3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4

AC-02(05) Account 

Management | 

Inactivity Logout

x x PR.AC, 

DE.CM, 

CT.DM-P, 

PR.AC-P

PR.AC-4, 

DE.CM-3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4

AC-02(06) Account 

Management | 

Dynamic Privilege 

Management

PR.AC, 

DE.CM, 

CT.DM-P, 

PR.AC-P

PR.AC-4, 

DE.CM-3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4

AC-02(07) Account 

Management | 

Privileged User 

Accounts

PR.AC, 

DE.CM, 

CT.DM-P, 

PR.AC-P

PR.AC-4, 

DE.CM-3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4

AC-02(08) Account 

Management | 

Dynamic Account 

Management

PR.AC, 

DE.CM, 

CT.DM-P, 

PR.AC-P

PR.AC-4, 

DE.CM-3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4
Information Technology (IT) Access Control (AC) Standard

Version 5.5 23

Control 

Identifier

Control/Control 

Enhancement) 

Name

Privacy 

Baseline

Security 

Control 

Baseline

Low

Security 

Control 

Baseline

Moderate

Security 

Control 

Baseline

High

CSF and 

PF 

Category

CSF and PF 

Subcategory

AC-02(09) Account 

Management | 

Restrictions on Use 

of Shared and 

Group Accounts

PR.AC, 

DE.CM, 

CT.DM-P, 

PR.AC-P

PR.AC-4, 

DE.CM-3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4

AC-02(11) Account 

Management | 

Usage Conditions

x PR.AC, 

DE.CM, 

CT.DM-P, 

PR.AC-P

PR.AC-4, 

DE.CM-3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4

AC-02(12) Account 

Management | 

Account 

Monitoring for 

Atypical Usage

x PR.AC, 

DE.CM, 

CT.DM-P, 

PR.AC-P

PR.AC-4, 

DE.CM-3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4

AC-02(13) Account 

Management | 

Disable Accounts 

for High-risk 

Individuals

x x PR.AC, 

DE.CM, 

CT.DM-P, 

PR.AC-P

PR.AC-4, 

DE.CM-3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4

AC-03 Access 

Enforcement

x x x PR.AC, 

PR.PT, 

CT.PO-P, 

CT.DM-P, 

PR.AC-P, 

PR.PT-P

PR.AC-4, 

PR.PT-3, 

CT.PO-P2, 

CT.PO-P3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4, 

PR.PT-P2
Information Technology (IT) Access Control (AC) Standard

Version 5.5 24

Control 

Identifier

Control/Control 

Enhancement) 

Name

Privacy 

Baseline

Security 

Control 

Baseline

Low

Security 

Control 

Baseline

Moderate

Security 

Control 

Baseline

High

CSF and 

PF 

Category

CSF and PF 

Subcategory

AC-03(03) Access 

Enforcement | 

Mandatory Access 

Control

PR.AC, 

PR.PT, 

CT.PO-P, 

CT.DM-P, 

PR.AC-P, 

PR.PT-P

PR.AC-4, 

PR.PT-3, 

CT.PO-P2, 

CT.PO-P3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4, 

PR.PT-P2

AC-03(04) Access 

Enforcement | 

Discretionary 

Access Control

PR.AC, 

PR.PT, 

CT.PO-P, 

CT.DM-P, 

PR.AC-P, 

PR.PT-P

PR.AC-4, 

PR.PT-3, 

CT.PO-P2, 

CT.PO-P3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4, 

PR.PT-P2

AC-03(05) Access 

Enforcement | 

Security-relevant 

Information

PR.AC, 

PR.PT, 

CT.PO-P, 

CT.DM-P, 

PR.AC-P, 

PR.PT-P

PR.AC-4, 

PR.PT-3, 

CT.PO-P2, 

CT.PO-P3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4, 

PR.PT-P2

AC-03(07) Access 

Enforcement | 

Role-based Access 

Control

PR.AC, 

PR.PT, 

CT.PO-P, 

CT.DM-P, 

PR.AC-P, 

PR.PT-P

PR.AC-4, 

PR.PT-3, 

CT.PO-P2, 

CT.PO-P3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4, 

PR.PT-P2
Information Technology (IT) Access Control (AC) Standard

Version 5.5 25

Control 

Identifier

Control/Control 

Enhancement) 

Name

Privacy 

Baseline

Security 

Control 

Baseline

Low

Security 

Control 

Baseline

Moderate

Security 

Control 

Baseline

High

CSF and 

PF 

Category

CSF and PF 

Subcategory

AC-03(08) Access 

Enforcement | 

Revocation of 

Access 

Authorizations

PR.AC, 

PR.PT, 

CT.PO-P, 

CT.DM-P, 

PR.AC-P, 

PR.PT-P

PR.AC-4, 

PR.PT-3, 

CT.PO-P2, 

CT.PO-P3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4, 

PR.PT-P2

AC-03(09) Access 

Enforcement | 

Controlled Release

PR.AC, 

PR.PT, 

CT.PO-P, 

CT.DM-P, 

PR.AC-P, 

PR.PT-P

PR.AC-4, 

PR.PT-3, 

CT.PO-P2, 

CT.PO-P3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4, 

PR.PT-P2

AC-03(10) Access 

Enforcement | 

Audited Override 

of Access Control 

Mechanisms

PR.AC, 

PR.PT, 

CT.PO-P, 

CT.DM-P, 

PR.AC-P, 

PR.PT-P

PR.AC-4, 

PR.PT-3, 

CT.PO-P2, 

CT.PO-P3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4, 

PR.PT-P2

AC-03(11) Access 

Enforcement | 

Restrict Access to 

Specific 

Information Types

PR.AC, 

PR.PT, 

CT.PO-P, 

CT.DM-P, 

PR.AC-P, 

PR.PT-P

PR.AC-4, 

PR.PT-3, 

CT.PO-P2, 

CT.PO-P3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4, 

PR.PT-P2
Information Technology (IT) Access Control (AC) Standard

Version 5.5 26

Control 

Identifier

Control/Control 

Enhancement) 

Name

Privacy 

Baseline

Security 

Control 

Baseline

Low

Security 

Control 

Baseline

Moderate

Security 

Control 

Baseline

High

CSF and 

PF 

Category

CSF and PF 

Subcategory

AC-03(12) Access 

Enforcement | 

Assert and Enforce 

Application Access

PR.AC, 

PR.PT, 

CT.PO-P, 

CT.DM-P, 

PR.AC-P, 

PR.PT-P

PR.AC-4, 

PR.PT-3, 

CT.PO-P2, 

CT.PO-P3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4, 

PR.PT-P2

AC-03(13) Access 

Enforcement | 

Attribute-based 

Access Control

PR.AC, 

PR.PT, 

CT.PO-P, 

CT.DM-P, 

PR.AC-P, 

PR.PT-P

PR.AC-4, 

PR.PT-3, 

CT.PO-P2, 

CT.PO-P3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4, 

PR.PT-P2

AC-03(14) Access 

Enforcement | 

Individual Access

x PR.AC, 

PR.PT, 

CT.PO-P, 

CT.DM-P, 

PR.AC-P, 

PR.PT-P

PR.AC-4, 

PR.PT-3, 

CT.PO-P2, 

CT.PO-P3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4, 

PR.PT-P2

AC-03(15) Access 

Enforcement | 

Discretionary and 

Mandatory Access 

Control

PR.AC, 

PR.PT, 

CT.PO-P, 

CT.DM-P, 

PR.AC-P, 

PR.PT-P

PR.AC-4, 

PR.PT-3, 

CT.PO-P2, 

CT.PO-P3, 

CT.DM-P1, 

CT.DM-P2, 

CT.DM-P3, 

CT.DM-P4, 

PR.AC-P4, 

PR.PT-P2
Information Technology (IT) Access Control (AC) Standard

Version 5.5 27

Control 

Identifier

Control/Control 

Enhancement) 

Name

Privacy 

Baseline

Security 

Control 

Baseline

Low

Security 

Control 

Baseline

Moderate

Security 

Control 

Baseline

High

CSF and 

PF 

Category

CSF and PF 

Subcategory

AC-04 Information Flow 

Enforcement

x x ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(01) Information Flow 

Enforcement | 

Object Security 

and Privacy 

Attributes

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(02) Information Flow 

Enforcement | 

Processing 

Domains

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(03) Information Flow 

Enforcement | 

Dynamic 

Information Flow 

Control

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(04) Information Flow 

Enforcement | 

Flow Control of 

Encrypted 

Information

x ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(05) Information Flow 

Enforcement | 

Embedded Data 

Types

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5
Information Technology (IT) Access Control (AC) Standard

Version 5.5 28

Control 

Identifier

Control/Control 

Enhancement) 

Name

Privacy 

Baseline

Security 

Control 

Baseline

Low

Security 

Control 

Baseline

Moderate

Security 

Control 

Baseline

High

CSF and 

PF 

Category

CSF and PF 

Subcategory

AC-04(06) Information Flow 

Enforcement | 

Metadata

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(07) Information Flow 

Enforcement | Oneway Flow 

Mechanisms

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(08) Information Flow 

Enforcement | 

Security and 

Privacy Policy 

Filters

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(09) Information Flow 

Enforcement | 

Human Reviews

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(10) Information Flow 

Enforcement | 

Enable and Disable 

Security or Privacy 

Policy Filters

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(11) Information Flow 

Enforcement | 

Configuration of 

Security or Privacy 

Policy Filters

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5
Information Technology (IT) Access Control (AC) Standard

Version 5.5 29

Control 

Identifier

Control/Control 

Enhancement) 

Name

Privacy 

Baseline

Security 

Control 

Baseline

Low

Security 

Control 

Baseline

Moderate

Security 

Control 

Baseline

High

CSF and 

PF 

Category

CSF and PF 

Subcategory

AC-04(12) Information Flow 

Enforcement | Data 

Type Identifiers

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(13) Information Flow 

Enforcement | 

Decomposition into 

Policy-relevant

Subcomponents

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(14) Information Flow 

Enforcement | 

Security or Privacy 

Policy Filter 

Constraints

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(15) Information Flow 

Enforcement | 

Detection of 

Unsanctioned 

Information

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(17) Information Flow 

Enforcement | 

Domain 

Authentication

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(19) Information Flow 

Enforcement | 

Validation of 

Metadata

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5
Information Technology (IT) Access Control (AC) Standard

Version 5.5 30

Control 

Identifier

Control/Control 

Enhancement) 

Name

Privacy 

Baseline

Security 

Control 

Baseline

Low

Security 

Control 

Baseline

Moderate

Security 

Control 

Baseline

High

CSF and 

PF 

Category

CSF and PF 

Subcategory

AC-04(20) Information Flow 

Enforcement | 

Approved 

Solutions

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(21) Information Flow 

Enforcement | 

Physical or Logical 

Separation of 

Information Flows

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(22) Information Flow 

Enforcement | 

Access Only

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(23) Information Flow 

Enforcement | 

Modify Nonreleasable 

Information

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(24) Information Flow 

Enforcement | 

Internal 

Normalized Format

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(25) Information Flow 

Enforcement | Data 

Sanitization

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5
Information Technology (IT) Access Control (AC) Standard

Version 5.5 31

Control 

Identifier

Control/Control 

Enhancement) 

Name

Privacy 

Baseline

Security 

Control 

Baseline

Low

Security 

Control 

Baseline

Moderate

Security 

Control 

Baseline

High

CSF and 

PF 

Category

CSF and PF 

Subcategory

AC-04(26) Information Flow 

Enforcement | 

Audit Filtering 

Actions

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(27) Information Flow 

Enforcement | 

Redundant/indepen

dent Filtering 

Mechanisms

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(28) Information Flow 

Enforcement | 

Linear Filter 

Pipelines

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(29) Information Flow 

Enforcement | 

Filter Orchestration 

Engines

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(30) Information Flow 

Enforcement | 

Filter Mechanisms 

Using Multiple 

Processes

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-04(31) Information Flow 

Enforcement | 

Failed Content 

Transfer 

Prevention

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5
Information Technology (IT) Access Control (AC) Standard

Version 5.5 32

Control 

Identifier

Control/Control 

Enhancement) 

Name

Privacy 

Baseline

Security 

Control 

Baseline

Low

Security 

Control 

Baseline

Moderate

Security 

Control 

Baseline

High

CSF and 

PF 

Category

CSF and PF 

Subcategory

AC-04(32) Information Flow 

Enforcement | 

Process 

Requirements for 

Information 

Transfer

ID.AM, 

PR.AC, 

PR.DS, 

DE.AE, 

CT.DM-P, 

PR.AC-P, 

PR.DS-P

ID.AM-3, 

PR.AC-5, 

PR.DS-5, 

DE.AE-1, 

CT.DM-P2, 

PR.AC-P5, 

PR.DS-P5

AC-05 Separation of 

Duties

x x PR.AC, 

PR.DS, 

PR.AC-P, 

PR.DS-P

PR.AC-4, 

PR.DS-5, 

PR.AC-P4, 

PR.DS-P5

AC-06 Least Privilege x x PR.AC, 

PR.DS, 

PR.AC-P, 

PR.DS-P

PR.AC-4, 

PR.DS-5, 

PR.AC-P4, 

PR.DS-P5

AC-06(01) Least Privilege | 

Authorize Access 

to Security 

Functions

x x PR.AC, 

PR.DS, 

PR.AC-P, 

PR.DS-P

PR.AC-4, 

PR.DS-5, 

PR.AC-P4, 

PR.DS-P5

AC-06(02) Least Privilege | 

Non-privileged 

Access for 

Nonsecurity 

Functions

x x PR.AC, 

PR.DS, 

PR.AC-P, 

PR.DS-P

PR.AC-4, 

PR.DS-5, 

PR.AC-P4, 

PR.DS-P5

AC-06(03) Least Privilege | 

Network Access to 

Privileged 

Commands

x PR.AC, 

PR.DS, 

PR.AC-P, 

PR.DS-P

PR.AC-4, 

PR.DS-5, 

PR.AC-P4, 

PR.DS-P5

AC-06(04) Least Privilege | 

Separate 

Processing 

Domains

PR.AC, 

PR.DS, 

PR.AC-P, 

PR.DS-P

PR.AC-4, 

PR.DS-5, 

PR.AC-P4, 

PR.DS-P5

AC-06(05) Least Privilege | 

Privileged 

Accounts

x x PR.AC, 

PR.DS, 

PR.AC-P, 

PR.DS-P

PR.AC-4, 

PR.DS-5, 

PR.AC-P4, 

PR.DS-P5

AC-06(06) Least Privilege | 

Privileged Access 

by Nonorganizational 

Users

PR.AC, 

PR.DS, 

PR.AC-P, 

PR.DS-P

PR.AC-4, 

PR.DS-5, 

PR.AC-P4, 

PR.DS-P5
Information Technology (IT) Access Control (AC) Standard

Version 5.5 33

Control 

Identifier

Control/Control 

Enhancement) 

Name

Privacy 

Baseline

Security 

Control 

Baseline

Low

Security 

Control 

Baseline

Moderate

Security 

Control 

Baseline

High

CSF and 

PF 

Category

CSF and PF 

Subcategory

AC-06(07) Least Privilege | 

Review of User 

Privileges

x x PR.AC, 

PR.DS, 

PR.AC-P, 

PR.DS-P

PR.AC-4, 

PR.DS-5, 

PR.AC-P4, 

PR.DS-P5

AC-06(08) Least Privilege | 

Privilege Levels 

for Code Execution

PR.AC, 

PR.DS, 

PR.AC-P, 

PR.DS-P

PR.AC-4, 

PR.DS-5, 

PR.AC-P4, 

PR.DS-P5

AC-06(09) Least Privilege | 

Log Use of 

Privileged 

Functions

x x PR.AC, 

PR.DS, 

PR.AC-P, 

PR.DS-P

PR.AC-4, 

PR.DS-5, 

PR.AC-P4, 

PR.DS-P5

AC-06(10) Least Privilege | 

Prohibit Nonprivileged Users 

from Executing 

Privileged 

Functions

x x PR.AC, 

PR.DS, 

PR.AC-P, 

PR.DS-P

PR.AC-4, 

PR.DS-5, 

PR.AC-P4, 

PR.DS-P5

AC-07 Unsuccessful 

Logon Attempts

x x x

AC-07(02) Unsuccessful 

Logon Attempts | 

Purge or Wipe 

Mobile Device

AC-07(03) Unsuccessful 

Logon Attempts | 

Biometric Attempt 

Limiting

AC-07(04) Unsuccessful 

Logon Attempts | 

Use of Alternate 

Authentication 

Factor

AC-08 System Use 

Notification

x x x CM.AW-P CM.AW-P1

AC-09 Previous Logon 

Notification

AC-09(01) Previous Logon 

Notification | 

Unsuccessful 

Logons
Information Technology (IT) Access Control (AC) Standard

Version 5.5 34

Control 

Identifier

Control/Control 

Enhancement) 

Name

Privacy 

Baseline

Security 

Control 

Baseline

Low

Security 

Control 

Baseline

Moderate

Security 

Control 

Baseline

High

CSF and 

PF 

Category

CSF and PF 

Subcategory

AC-09(02) Previous Logon 

Notification | 

Successful and 

Unsuccessful 

Logons

AC-09(03) Previous Logon 

Notification | 

Notification of 

Account Changes

AC-09(04) Previous Logon 

Notification | 

Additional Logon 

Information

AC-10 Concurrent Session 

Control

x PR.AC, 

PR.AC-P

PR.AC-5, 

PR.AC-P5

AC-11 Device Lock x x

AC-11(01) Device Lock | 

Pattern-hiding 

Displays

x x

AC-12 Session 

Termination

x x PR.PT, 

PR.PT-P

PR.PT-4, 

PR.PT-P3

AC-12(01) Session 

Termination | Userinitiated Logouts

PR.PT, 

PR.PT-P

PR.PT-4, 

PR.PT-P3

AC-12(02) Session 

Termination | 

Termination 

Message

PR.PT, 

PR.PT-P

PR.PT-4, 

PR.PT-P3

AC-12(03) Session 

Termination | 

Timeout Warning 

Message

PR.PT, 

PR.PT-P

PR.PT-4, 

PR.PT-P3

AC-14 Permitted Actions 

Without 

Identification or 

Authentication

x x x PR.AC, 

PR.AC-P

PR.AC-4, 

PR.AC-7, 

PR.AC-P4, 

PR.AC-P6

AC-16 Security and 

Privacy Attributes

PR.AC, 

CT.DM-P, 

CT.DP-P, 

CM.AW-P, 

PR.AC-P

PR.AC-4, 

PR.AC-6, 

CT.DM-P7, 

CT.DP-P5, 

CM.AW-P6, 

PR.AC-P4, 

PR.AC-P6
Information Technology (IT) Access Control (AC) Standard

Version 5.5 35

Control 

Identifier

Control/Control 

Enhancement) 

Name

Privacy 

Baseline

Security 

Control 

Baseline

Low

Security 

Control 

Baseline

Moderate

Security 

Control 

Baseline

High

CSF and 

PF 

Category

CSF and PF 

Subcategory

AC-16(01) Security and 

Privacy Attributes | 

Dynamic Attribute 

Association

PR.AC, 

CT.DM-P, 

CT.DP-P, 

CM.AW-P, 

PR.AC-P

PR.AC-4, 

PR.AC-6, 

CT.DM-P7, 

CT.DP-P5, 

CM.AW-P6, 

PR.AC-P4, 

PR.AC-P6

AC-16(02) Security and 

Privacy Attributes | 

Attribute Value 

Changes by 

Authorized 

Individuals

PR.AC, 

CT.DM-P, 

CT.DP-P, 

CM.AW-P, 

PR.AC-P

PR.AC-4, 

PR.AC-6, 

CT.DM-P7, 

CT.DP-P5, 

CM.AW-P6, 

PR.AC-P4, 

PR.AC-P6

AC-16(03) Security and 

Privacy Attributes | 

Maintenance of 

Attribute 

Associations by 

System

PR.AC, 

CT.DM-P, 

CT.DP-P, 

CM.AW-P, 

PR.AC-P

PR.AC-4, 

PR.AC-6, 

CT.DM-P7, 

CT.DP-P5, 

CM.AW-P6, 

PR.AC-P4, 

PR.AC-P6

AC-16(04) Security and 

Privacy Attributes | 

Association of 

Attributes by 

Authorized 

Individuals

PR.AC, 

CT.DM-P, 

CT.DP-P, 

CM.AW-P, 

PR.AC-P

PR.AC-4, 

PR.AC-6, 

CT.DM-P7, 

CT.DP-P5, 

CM.AW-P6, 

PR.AC-P4, 

PR.AC-P6

AC-16(05) Security and 

Privacy Attributes | 

Attribute Displays 

on Objects to Be 

Output

PR.AC, 

CT.DM-P, 

CT.DP-P, 

CM.AW-P, 

PR.AC-P

PR.AC-4, 

PR.AC-6, 

CT.DM-P7, 

CT.DP-P5, 

CM.AW-P6, 

PR.AC-P4, 

PR.AC-P6

AC-16(06) Security and 

Privacy Attributes | 

Maintenance of 

Attribute 

Association

PR.AC, 

CT.DM-P, 

CT.DP-P, 

CM.AW-P, 

PR.AC-P

PR.AC-4, 

PR.AC-6, 

CT.DM-P7, 

CT.DP-P5, 

CM.AW-P6, 

PR.AC-P4, 

PR.AC-P6
Information Technology (IT) Access Control (AC) Standard

Version 5.5 36

Control 

Identifier

Control/Control 

Enhancement) 

Name

Privacy 

Baseline

Security 

Control 

Baseline

Low

Security 

Control 

Baseline

Moderate

Security 

Control 

Baseline

High

CSF and 

PF 

Category

CSF and PF 

Subcategory

AC-16(07) Security and 

Privacy Attributes | 

Consistent 

Attribute 

Interpretation

PR.AC, 

CT.DM-P, 

CT.DP-P, 

CM.AW-P, 

PR.AC-P

PR.AC-4, 

PR.AC-6, 

CT.DM-P7, 

CT.DP-P5, 

CM.AW-P6, 

PR.AC-P4, 

PR.AC-P6

AC-16(08) Security and 

Privacy Attributes | 

Association 

Techniques and 

Technologies

PR.AC, 

CT.DM-P, 

CT.DP-P, 

CM.AW-P, 

PR.AC-P

PR.AC-4, 

PR.AC-6, 

CT.DM-P7, 

CT.DP-P5, 

CM.AW-P6, 

PR.AC-P4, 

PR.AC-P6

AC-16(09) Security and 

Privacy Attributes | 

Attribute 

Reassignment —

Regrading 

Mechanisms

PR.AC, 

CT.DM-P, 

CT.DP-P, 

CM.AW-P, 

PR.AC-P

PR.AC-4, 

PR.AC-6, 

CT.DM-P7, 

CT.DP-P5, 

CM.AW-P6, 

PR.AC-P4, 

PR.AC-P6

AC-16(10) Security and 

Privacy Attributes | 

Attribute 

Configuration by 

Authorized 

Individuals

PR.AC, 

CT.DM-P, 

CT.DP-P, 

CM.AW-P, 

PR.AC-P

PR.AC-4, 

PR.AC-6, 

CT.DM-P7, 

CT.DP-P5, 

CM.AW-P6, 

PR.AC-P4, 

PR.AC-P6

AC-17 Remote Access x x x PR.AC, 

PR.PT, 

PR.AC-P, 

PR.PT-P

PR.AC-3, 

PR.PT-4, 

PR.AC-P3, 

PR.PT-P3

AC-17(01) Remote Access | 

Monitoring and 

Control

x x PR.AC, 

PR.PT, 

PR.AC-P, 

PR.PT-P

PR.AC-3, 

PR.PT-4, 

PR.AC-P3, 

PR.PT-P3

AC-17(02) Remote Access | 

Protection of 

Confidentiality and 

Integrity Using 

Encryption

x x PR.AC, 

PR.PT, 

PR.AC-P, 

PR.PT-P

PR.AC-3, 

PR.PT-4, 

PR.AC-P3, 

PR.PT-P3
Information Technology (IT) Access Control (AC) Standard

Version 5.5 37

Control 

Identifier

Control/Control 

Enhancement) 

Name

Privacy 

Baseline

Security 

Control 

Baseline

Low

Security 

Control 

Baseline

Moderate

Security 

Control 

Baseline

High

CSF and 

PF 

Category

CSF and PF 

Subcategory

AC-17(03) Remote Access | 

Managed Access 

Control Points

x x PR.AC, 

PR.PT, 

PR.AC-P, 

PR.PT-P

PR.AC-3, 

PR.PT-4, 

PR.AC-P3, 

PR.PT-P3

AC-17(04) Remote Access | 

Privileged 

Commands and 

Access

x x PR.AC, 

PR.PT, 

PR.AC-P, 

PR.PT-P

PR.AC-3, 

PR.PT-4, 

PR.AC-P3, 

PR.PT-P3

AC-17(06) Remote Access | 

Protection of 

Mechanism 

Information

PR.AC, 

PR.PT, 

PR.AC-P, 

PR.PT-P

PR.AC-3, 

PR.PT-4, 

PR.AC-P3, 

PR.PT-P3

AC-17(09) Remote Access | 

Disconnect or 

Disable Access

PR.AC, 

PR.PT, 

PR.AC-P, 

PR.PT-P

PR.AC-3, 

PR.PT-4, 

PR.AC-P3, 

PR.PT-P3

AC-17(10) Remote Access | 

Authenticate 

Remote Commands

PR.AC, 

PR.PT, 

PR.AC-P, 

PR.PT-P

PR.AC-3, 

PR.PT-4, 

PR.AC-P3, 

PR.PT-P3

AC-18 Wireless Access x x x PR.PT, 

PR.PT-P

PR.PT-4, 

PR.PT-P3

AC-18(01) Wireless Access | 

Authentication and 

Encryption

x x PR.PT, 

PR.PT-P

PR.PT-4, 

PR.PT-P3

AC-18(03) Wireless Access | 

Disable Wireless 

Networking

x x PR.PT, 

PR.PT-P

PR.PT-4, 

PR.PT-P3

AC-18(04) Wireless Access | 

Restrict 

Configurations by 

Users

x PR.PT, 

PR.PT-P

PR.PT-4, 

PR.PT-P3

AC-18(05) Wireless Access | 

Antennas and 

Transmission 

Power Levels

x PR.PT, 

PR.PT-P

PR.PT-4, 

PR.PT-P3

AC-19 Access Control for 

Mobile Devices

x x x PR.AC, 

PR.AC-P

PR.AC-3, 

PR.AC-P3

AC-19(04) Access Control for 

Mobile Devices | 

Restrictions for 

Classified 

Information

PR.AC, 

PR.AC-P

PR.AC-3, 

PR.AC-P3
Information Technology (IT) Access Control (AC) Standard

Version 5.5 38

Control 

Identifier

Control/Control 

Enhancement) 

Name

Privacy 

Baseline

Security 

Control 

Baseline

Low

Security 

Control 

Baseline

Moderate

Security 

Control 

Baseline

High

CSF and 

PF 

Category

CSF and PF 

Subcategory

AC-19(05) Access Control for 

Mobile Devices | 

Full Device or 

Container-based 

Encryption

x x PR.AC, 

PR.AC-P

PR.AC-3, 

PR.AC-P3

AC-20 Use of External 

Systems

x x x ID.AM, 

PR.AC, 

PR.AC-P

ID.AM-4, 

PR.AC-3, 

PR.AC-P3

AC-20(01) Use of External 

Systems | Limits on 

Authorized Use

x x ID.AM, 

PR.AC, 

PR.AC-P

ID.AM-4, 

PR.AC-3, 

PR.AC-P3

AC-20(02) Use of External 

Systems | Portable 

Storage Devices —

Restricted Use

x x ID.AM, 

PR.AC, 

PR.AC-P

ID.AM-4, 

PR.AC-3, 

PR.AC-P3

AC-20(03) Use of External 

Systems | Nonorganizationally 

Owned Systems —

Restricted Use

ID.AM, 

PR.AC, 

PR.AC-P

ID.AM-4, 

PR.AC-3, 

PR.AC-P3

AC-20(04) Use of External 

Systems | Network 

Accessible Storage 

Devices —

Prohibited Use

ID.AM, 

PR.AC, 

PR.AC-P

ID.AM-4, 

PR.AC-3, 

PR.AC-P3

AC-20(05) Use of External 

Systems | Portable 

Storage Devices —

Prohibited Use

ID.AM, 

PR.AC, 

PR.AC-P

ID.AM-4, 

PR.AC-3, 

PR.AC-P3

AC-21 Information 

Sharing

x x PR.IP, 

CT.DM-P, 

PR.PO-P

PR.IP-8, 

CT.DM-P2, 

PR.PO-P6

AC-21(01) Information 

Sharing | 

Automated 

Decision Support

PR.IP, 

CT.DM-P, 

PR.PO-P

PR.IP-8, 

CT.DM-P2, 

PR.PO-P6

AC-21(02) Information 

Sharing | 

Information Search 

and Retrieval

PR.IP, 

CT.DM-P, 

PR.PO-P

PR.IP-8, 

CT.DM-P2, 

PR.PO-P6

AC-22 Publicly Accessible 

Content

x x x
Information Technology (IT) Access Control (AC) Standard

Version 5.5 39

Control 

Identifier

Control/Control 

Enhancement) 

Name

Privacy 

Baseline

Security 

Control 

Baseline

Low

Security 

Control 

Baseline

Moderate

Security 

Control 

Baseline

High

CSF and 

PF 

Category

CSF and PF 

Subcategory

AC-23 Data Mining 

Protection

CT.DP-P CT.DP-P1, 

CT.DP-P2, 

CT.DP-P3

AC-24 Access Control 

Decisions

PR.AC, 

PR.AC-P

PR.AC-4, 

PR.AC-P4

AC-24(01) Access Control 

Decisions | 

Transmit Access 

Authorization 

Information

PR.AC, 

PR.AC-P

PR.AC-4, 

PR.AC-P4

AC-24(02) Access Control 

Decisions | No 

User or Process 

Identity

PR.AC, 

PR.AC-P

PR.AC-4, 

PR.AC-P4

AC-25 Reference Monitor
Information Technology (IT) Access Control (AC) Standard

Version 5.5 40

APPENDIX B - USER NOTIFICATION WARNING BANNER

Following is the standard warning banner/system-use notification that should be presented to users 

of internet-accessible production web applications and ED websites with the exception of IES

websites that adhere to the Education Science Reform Act.

Warning

You are accessing a U.S. Federal Government computer system intended to be solely accessed by 

individual users expressly authorized to access the system by the U.S. Department of Education. 

Usage may be monitored, recorded, and/or subject to audit. For security purposes and in order to 

ensure that the system remains available to all expressly authorized users, the U.S. Department of 

Education monitors the system to identify unauthorized users. Anyone using this system expressly 

consents to such monitoring and recording.

Unauthorized use of this information system is prohibited and subject to criminal and civil 

penalties. Except as expressly authorized by the U.S. Department of Education, unauthorized 

attempts to access, obtain, upload, modify, change, and/or delete information on this system are 

strictly prohibited and are subject to criminal prosecution under 18 U.S.C § 1030, and other 

applicable statutes, which may result in fines and imprisonment. For purposes of this system, 

unauthorized access includes, but is not limited to: Any access by an employee or agent of a 

commercial entity, or other third party, who is not the individual user, for purposes of commercial 

advantage or private financial gain (regardless of whether the commercial entity or third party is 

providing a service to an authorized user of the system); and Any access in furtherance of any 

criminal or tortious act in violation of the Constitution or laws of the United States or any State. If 

system monitoring reveals information indicating possible criminal activity, such evidence may 

be provided to law enforcement personnel.