Access Control Policy

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose and Scope #

In this policy, the CISO sets the Organization’s requirements for access control in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:

• The Federal Information Security Modernization Act (FISMA) of 2014.
• National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5.
• Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource.
• The OMB memoranda and Executive Orders that apply.

The Organization also uses this policy to carry out the NIST Cybersecurity Framework (CSF) 2.0, which Executive Order 13800 and OMB Circular A-130 require.

1.1 Program Objectives #

In this policy, the CISO sets how the Organization controls who can reach its systems and information, and what each person may do once inside. The Inspector General, the assessors, and the adversaries who probe the Organization all test the same thing: whether the Organization controls who can touch what. The Office of Personnel Management (OPM) breach and the SolarWinds intrusions that led to Executive Order (EO) 14028 both began with an account that could reach more than its owner needed. The account kept that access longer than anyone intended, and no one monitored it.

Federal direction defines what that control must look like. OMB M-22-09 requires the Organization to authenticate, authorize, and encrypt every access request, every session, and every application programming interface (API) call based on dynamic risk, not on network location. It also requires phishing-resistant credentials for privileged access. NIST SP 800-207 supplies the architecture: a per-session authorization decision that weighs device posture and behavioral signals and never grants standing trust. Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive (BOD) 23-02 closes the most common shortcut by ordering management interfaces off the public internet. OMB M-19-03 sets a higher standard for the Organization’s High Value Assets. The CISA High Value Asset (HVA) overlay isolates those systems behind least-privilege access and tiered boundary controls, because an adversary would choose them first.

The Organization meets these mandates with a layered set of identity systems, and every reader of this policy uses part of it. The single sign-on (SSO) service authenticates the workforce, federates single sign-on across the Organization’s software as a service (SaaS) applications, and enforces adaptive multi-factor authentication. Cloud directory conditional access makes the risk-based, device-aware session decisions that M-22-09 requires. Privileged identity management grants elevated rights just in time and removes them on schedule. On-premises, the on-premises directory and its group policy objects apply the same rules to Windows infrastructure through password and lockout policy and hardening scoped to organizational units. Personal Identity Verification (PIV) cards and Fast Identity Online 2 (FIDO2) keys give every privileged user a phishing-resistant factor, as Federal Information Processing Standards (FIPS) 201-3 requires. The joiner-mover-leaver pipeline ties accounts to the personnel lifecycle: a human resources (HR) action leads to SSO deprovisioning in under 24 hours, because an account that outlives its owner’s employment leaves the Organization exposed.

Each audience uses this policy differently. Executives use it to accept or refuse standing access to the Organization’s information. System Owners and Information System Security Officers (ISSOs) use the requirements, roles, and measures in this policy as their build specification and evidence checklist. Each requirement names its SP 800-53 control, its parameter values, and the measure the CISO trends. Every user is responsible for the accounts, sessions, and sharing decisions this policy governs, and the rules of behavior each user acknowledged put this policy into daily practice. The CISO removes access that no one can justify and verifies continuously the access that someone can.

This policy applies to everyone in the program: executives who accept risk, System Owners who fund the controls, security officers who run them, and every user. By following it, the Organization meets its FISMA obligations for this control family and shows its maturity in the annual Inspector General (IG) FISMA evaluation. The Organization’s target is Level 4 (Managed and Measurable). The CISO tracks progress with the performance measures and the improvement commitments later in this policy.

1.2 CSF 2.0 Alignment #

The controls in this policy support these CSF 2.0 categories:

• PR.AA — Identity Management, Authentication, and Access Control (Protect function)
• PR.DS — Data Security (Protect function)

These categories fall under the Protect function(s) of CSF 2.0. The Organization’s CSF 2.0 Profile maps each category to the NIST SP 800-53 controls in this policy.

This policy covers every access control in the low baseline of FIPS 200 and NIST SP 800-53B:

• AC-01 — Policy and Procedures
• AC-02 — Account Management
• AC-03 — Access Enforcement
• AC-03(14) — Individual Access
• AC-04 — Information Flow Enforcement
• AC-06 — Least Privilege
• AC-07 — Unsuccessful Logon Attempts
• AC-08 — System Use Notification
• AC-14 — Permitted Actions Without Identification or Authentication
• AC-17 — Remote Access
• AC-18 — Wireless Access
• AC-19 — Access Control for Mobile Devices
• AC-20 — Use of External Systems
• AC-22 — Publicly Accessible Content

2. Authority and References #

The CISO issues this policy under the authority of:

• FISMA 2014 (44 U.S.C. § 3551 et seq.) — Statutory mandate for federal information security programs
• NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations
• OMB Circular A-130 — Managing Information as a Strategic Resource
• OMB Circular A-123 — Management’s Responsibility for Internal Control (revised March 10, 2026)
• NIST CSF 2.0 — Cybersecurity Framework (mandated by EO 13800 and OMB Circular A-130)
• EO 13800 — Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
• OMB M-22-09: Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, January 26, 2022.
• OMB M-19-17: Enabling Mission Delivery through Improved Identity, Credential, and Access Management (ICAM), May 21, 2019.
• Executive Order 14028: Improving the Nation’s Cybersecurity, May 12, 2021.
• FIPS 201-3: Personal Identity Verification (PIV) of Federal Employees and Contractors, January 2022.

2.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the AC control family. They add to the NIST SP 800-53 control requirements in the Policy section.

OMB M-22-09: Moving the U.S. Government Toward Zero Trust Cybersecurity Principles

• The organization must implement a zero trust architecture where every access request is fully authenticated, authorized, and encrypted before granting access. Access decisions must be based on dynamic risk assessment, not static network location. Deadline: FY 2024. (OMB M-22-09, §2)
• The organization must employ multi-factor authentication (MFA) for all users, with phishing-resistant MFA for all privileged accounts and all remote access. Password-based authentication alone is insufficient. Deadline: FY 2024. (OMB M-22-09, §3(a)(i))
• The organization must implement continuous authorization for access sessions, periodically re-evaluating user identity, device posture, and behavioral context throughout the session, not just at initial login. Deadline: FY 2024. (OMB M-22-09, §3)
• The organization must designate a zero trust strategy implementation lead within 30 days of the memorandum’s publication. This lead is responsible for Government-wide coordination and OMB engagement on planning and implementation. Deadline: 30 days from issuance. (OMB M-22-09, §2)

NIST SP 800-207: Zero Trust Architecture

• The organization must ensure all access to resources is authenticated and authorized on a per-session basis, regardless of network location. Trust must never be granted implicitly based on network proximity. (NIST SP 800-207, §3.1)
• The organization must make access policies dynamic, using device security posture, user behavior analytics, and threat intelligence to make real-time authorization decisions. (NIST SP 800-207, §3.2)

CISA BOD 25-01: Implementing Secure Practices for Cloud Services

• The organization must ensure cloud service provider (CSP) access to agency environments is monitored, logged, and restricted to authorized personnel only. CSP management plane access must follow least-privilege principles. (CISA BOD 25-01, §3)

CISA BOD 23-02: Mitigating the Risk of Internet-Exposed Management Interfaces

• The organization must identify and remove internet-exposed management interfaces from public-facing networks. Management interfaces must be accessible only through internal networks or via VPN with MFA. (CISA BOD 23-02, §1)

NIST SP 800-63-4: Digital Identity Guidelines

• The organization must require multi-factor authentication at AAL2 and AAL3, and at AAL3 require a phishing-resistant authenticator with a non-exportable private key. (NIST SP 800-63B-4, §2)
• The organization must set each system’s session limits from its authentication assurance level: no more than 30 days at AAL1; 24 hours, or 1 hour of inactivity, at AAL2; and 12 hours, or 15 minutes of inactivity, at AAL3. (NIST SP 800-63B-4, §2 (reauthentication at each AAL))

OMB M-19-03: Strengthening Cybersecurity through the High Value Asset Program

• The organization must apply enhanced access safeguards to High Value Assets, including privileged access management and network segmentation commensurate with the asset’s value and the threats it faces, informed by the CISA HVA control overlay. (OMB M-19-03, §B)

CISA High Value Asset (HVA) Control Overlay v1.0

• The organization must control and limit access for HVA users through the overlay’s least-privilege selections (AC-6 and enhancements), ensuring privileged access to HVAs receives elevated scrutiny and restriction. (CISA HVA Control Overlay v1.0, AC-6)

OMB M-23-22: Delivering a Digital-First Public Experience

• The organization must link every page of each public website to the privacy policy and the other notices OMB M-23-22 requires. (OMB M-23-22, §III)

CISA Zero Trust Maturity Model v2.0

• The organization should progress through the maturity levels (Traditional, Initial, Advanced, Optimal) for the identity, device, network, application, and data pillars, moving access control from static roles to dynamic, risk-based decisions. (CISA ZTMM v2.0, §5)

NIST SP 800-124 Rev 2: Guidelines for Managing the Security of Mobile Devices in the Enterprise

• The organization should manage organization-issued mobile devices with enterprise mobility management, and use mobile threat defense to detect device, app, and network threats. (NIST SP 800-124 Rev 2, §§3-4)

NIST SP 800-163 Rev 1: Vetting the Security of Mobile Applications

• The organization should vet each mobile app against the Organization’s security requirements before approving it for organization devices, and vet it again when it is updated. (NIST SP 800-163 Rev 1, §§2-3)

NIST SP 800-153: Guidelines for Securing Wireless Local Area Networks (WLANs)

• The organization should monitor for rogue wireless access points and other unauthorized wireless devices, and remove or block any that are found. (NIST SP 800-153, §3)

CISA: Mobile Communications Best Practice Guidance

• The organization should give highly targeted staff, such as senior officials, approved end-to-end encrypted messaging, and do not let them use text messages as a sign-in factor. (CISA Mobile Communications Best Practice Guidance)

3. Policy #

The Organization must implement and maintain its access control controls to meet the following requirements:

The twenty-three base controls and their enhancements in this section work as one system. AC-1 sets the governance. AC-2 through AC-6 form the account and privilege core: the Organization creates every account deliberately, limits it by least privilege and separation of duties, and re-verifies it on schedule. AC-7 through AC-12 govern the session itself, from lockout after failed logons through device lock and session termination. AC-17 through AC-20 apply the same rules to remote access, wireless, mobile devices, and external systems, where the boundary is weakest. AC-21 through AC-25 govern what authorized users may share and publish once inside. Read each requirement as part of that chain. Weakening one control reopens the path that the other controls close.

AC-01 — Policy and Procedures #

Baselines: Low / Moderate / High / Privacy CSF 2.0: PR.AA (Identity Management, Authentication, and Access Control)

Requirement:

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] access control policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the access control policy and the associated access controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the access control policy and procedures; and
3. Review and update the current access control:

1. Policy at least every 3 years and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Implementation guidance:

The CISO owns this policy and the procedures that put it into practice. The CISO must issue the access control policy for the whole Organization and distribute it through the policy library to the Authorizing Official, System Owners, ISSOs, and key stakeholders. The CISO must review the policy every 3 years, and sooner after a major change to a law, a directive, or the Organization’s operating environment. The CISO must review the procedures on the same cycle. Every requirement in this policy takes its authority from this control. Anyone who needs to deviate from a requirement must use the exception process in this policy. Supervisors must make sure the personnel they manage know which parts of this policy apply to their daily work. The CISO sets the Organization’s zero trust targets for access decisions in the Zero Trust and ICAM Implementation Plan (PLAN-ZT-001).

AC-02 — Account Management #

Baselines: Low / Moderate / High / HVA overlay CSF 2.0: PR.AA (Identity Management, Authentication, and Access Control)

Requirement:

1. Define and document the types of accounts allowed and specifically prohibited for use within the system;
2. Assign account managers;
3. Require [Assignment: organization-defined prerequisites and criteria — to be defined] for group and role membership;
4. Specify:

1. Authorized users of the system;
2. Group and role membership; and
3. Access authorizations (i.e., privileges) and [Assignment: organization-defined attributes (as required) — to be defined] for each account;

5. Require approvals by [Assignment: organization-defined personnel or roles — to be defined] for requests to create accounts;
6. Create, enable, modify, disable, and remove accounts in accordance with [Assignment: organization-defined policy, procedures, prerequisites, and criteria — to be defined];
7. Monitor the use of accounts;
8. Notify account managers and [Assignment: organization-defined personnel or roles — to be defined] within:

1. twenty-four (24) hours when accounts are no longer required;
2. eight (8) hours when users are terminated or transferred; and
3. eight (8) hours when system usage or need-to-know changes for an individual;

1. Authorize access to the system based on:

1. A valid access authorization;
2. Intended system usage; and
3. [Assignment: organization-defined attributes (as required) — to be defined];

10. Review accounts for compliance with account management requirements at least annually;
11. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and
12. Align account management processes with personnel termination and transfer processes.

Implementation guidance:

Every account must have a current, recorded justification. System Owners, or the designees they name, must approve a new account only when it has an approved access request, completed training, and a recorded expiration date where one applies. Group and role membership must match the holder’s clearance, need for access, and job responsibilities. Account managers and the System Owner must receive notice within 24 hours when an account is no longer needed, when the holder leaves or transfers, or when the holder’s need to know changes. The ISSO and System Owners must review all non-privileged accounts at least every year and all privileged accounts every quarter. In each review, the Information Owner must confirm that each user’s role and privileges still fit the information the user may reach. Each System Owner must keep an inventory of service, system, and other non-person accounts. The inventory must record each account’s purpose, the systems it reaches, its privileges, and the named person accountable for the account and its credentials. Account managers must disable any account that fails review.

AC-03 — Access Enforcement #

Baselines: Low / Moderate / High / HVA overlay CSF 2.0: PR.AA (Identity Management, Authentication, and Access Control), PR.DS (Data Security)

Requirement:

Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Implementation guidance:

System Owners must enforce approved authorizations at every point where their systems decide whether to grant access. Cloud directory conditional access checks each session against user, device, and risk signals before it grants access, as OMB M-22-09 requires. The on-premises directory access control lists and security groups enforce authorizations on domain resources. The cloud platform identity policies limit what administrators and workloads can reach in the cloud. No component may grant access based on network location alone. System Owners must make sure the technical enforcement in their systems matches the authorizations approved under AC-02. System Owners must treat any difference between the two as a defect and correct it.

AC-03(14) — Individual Access #

Baselines: Privacy

Requirement:

Provide [Assignment: organization-defined mechanisms — to be defined] to enable individuals to have access to the following elements of their personally identifiable information: [Assignment: organization-defined elements — to be defined].

Implementation guidance:

The Organization must give each individual a way to see the personally identifiable information (PII) it holds about them. System Owners of systems that retrieve records by a person’s name or identifier must offer [AC-03(14) parameter 1 — to be defined] for this purpose. Through these mechanisms, an individual must be able to obtain [AC-03(14) parameter 2 — to be defined]. The Senior Agency Official for Privacy (SAOP) must approve each access mechanism before it goes into use. The Privacy Officer must confirm a requester’s identity before any record is released. The SAOP must consult General Counsel before the Organization withholds a record under a legal exemption. The Privacy Officer must describe how to request access in each system of records notice and on the Organization’s public website.

AC-04 — Information Flow Enforcement #

Baselines: Moderate / High / HVA overlay (applies to systems designated as High Value Assets, under OMB M-19-03) CSF 2.0: PR.AA (Identity Management, Authentication, and Access Control), PR.DS (Data Security)

Requirement:

Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [Assignment: organization-defined information flow control policies — to be defined].

Implementation guidance:

System Owners must enforce information flow authorizations under the Organization Access Control Policy within each system and between connected systems. Export-controlled information must leave Organization-controlled networks only under approved encryption. Boundary devices must drop inbound traffic that presents an internal source address. Web requests bound for the Internet must leave only through the internal web proxy path that the secure web gateway provides. Any further flow enforcement policy takes effect only with the Configuration Control Board (CCB)/the Change Advisory Board (CAB) approval, and the network team enforces it through firewall rulesets. A firewall rule that appears without that approval is a configuration incident, and the CISO must treat it as one. System Owners must keep the approved flows for their systems documented so an assessor can trace every ruleset line to a decision.

AC-06 — Least Privilege #

Baselines: Moderate / High / HVA overlay (applies to systems designated as High Value Assets, under OMB M-19-03) CSF 2.0: PR.AA (Identity Management, Authentication, and Access Control), PR.DS (Data Security)

Requirement:

Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.

Implementation guidance:

System Owners must grant each user and each process only the access its function requires, and nothing more. System Owners must define role-based permission sets so that access follows the job, not the individual. Privileged functions must stay separate from standard duties. An administrator gains elevated rights through cloud directory privileged identity management just in time, with approval, and the elevation expires on schedule. Under OMB M-22-09, privileged access must use phishing-resistant PIV or hardware security key credentials. Supervisors must request a reduction in access when a user’s duties change. The Organization treats over-provisioning found in a review as a failure to follow this policy.

AC-07 — Unsuccessful Logon Attempts #

Baselines: Low / Moderate / High CSF 2.0: PR.AA (Identity Management, Authentication, and Access Control)

Requirement:

1. Enforce a limit of [Assignment: organization-defined number — to be defined] consecutive invalid logon attempts by a user during a [Assignment: organization-defined time period — to be defined]; and
2. Automatically [Selection (one or more): lock the account or node for [organization-defined]; lock the account or node until released by an administrator; delay next logon prompt per [organization-defined]; notify system administrator; take other [organization-defined] — to be defined] when the maximum number of unsuccessful attempts is exceeded.

Implementation guidance:

Every system must limit a user to [AC-07 parameter 1 — to be defined] consecutive invalid logon attempts within a [AC-07 parameter 2 — to be defined] window. When a user exceeds the limit, the system must lock the account until an administrator releases it, or delay the next logon prompt by at least [AC-07 parameter 3 — to be defined]. Group policy enforces the threshold on domain-joined systems, and the SSO service applies the same lockout for federated application access. Lockout events are security signals that the ISSO must review. The ISSO must treat repeated lockouts on one account, or lockouts across many accounts, as a possible credential attack.

AC-08 — System Use Notification #

Baselines: Low / Moderate / High CSF 2.0: PR.AA (Identity Management, Authentication, and Access Control)

Requirement:

1. Display see additional Requirements and Guidance to users before granting access to the system that provides privacy and security notices consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and state that:

1. Users are accessing a U.S. Government system;
2. System usage may be monitored, recorded, and subject to audit;
3. Unauthorized use of the system is prohibited and subject to criminal and civil penalties; and
4. Use of the system indicates consent to monitoring and recording;

2. Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system; and
3. For publicly accessible systems:

1. Display system use information see additional Requirements and Guidance, before granting further access to the publicly accessible system;
2. Display references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and
3. Include a description of the authorized uses of the system.

Implementation guidance:

Every system must display the CISO-approved system use banner before it grants access. The banner must make four statements. The user is accessing a U.S. Government information system. The Organization may monitor, record, and audit system use. Use without authorization is prohibited and may lead to criminal and civil penalties. Use of the system means the user consents to monitoring and recording. The CISO must publish the approved banner text in the document management system, with a short form for devices with small screens. System Owners must not remove or reword any part of the banner, and the CISO must approve any system-specific wording. The banner must stay on screen until the user acknowledges it and acts to log on. A public website may meet this requirement for visitors by linking from every page to the Organization’s privacy policy and website security notice, as OMB M-23-22 directs. Where members of the public register for an account, the System Owner must show the terms of use at registration.

AC-14 — Permitted Actions Without Identification or Authentication #

Baselines: Low / Moderate / High CSF 2.0: PR.AA (Identity Management, Authentication, and Access Control)

Requirement:

1. Identify [Assignment: organization-defined user actions — to be defined] that can be performed on the system without identification or authentication consistent with organizational mission and business functions; and
2. Document and provide supporting rationale in the security plan for the system, user actions not requiring identification or authentication.

Implementation guidance:

System Owners must identify the specific user actions their system allows without identification or authentication. System Owners must keep that list as short as the mission allows and document every entry, with its rationale, in the System Security and Privacy Plan (SSPP). Any action not on the list requires authentication. System Owners must re-justify the list whenever the system’s function changes. The ISSO must confirm that what the system allows matches what the SSPP says it allows. The permitted set is narrow: reading content the Organization has already cleared for public release, and little else.

AC-17 — Remote Access #

Baselines: Low / Moderate / High / HVA overlay CSF 2.0: PR.AA (Identity Management, Authentication, and Access Control)

Requirement:

1. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and
2. Authorize each type of remote access to the system prior to allowing such connections.

Implementation guidance:

The Organization must authorize each type of remote access before anyone uses it and must document its usage restrictions and permitted configurations. All remote sessions must route through zero trust network access. The zero trust network access (ZTNA) service authenticates the user through the SSO service, verifies device compliance through the mobile device management (MDM) tool, and encrypts every session. This design follows OMB M-22-09, which requires access decisions based on identity and device posture, not network location. The Organization does not grant broad network tunnels; the ZTNA service brokers access to one application at a time. An administrator who performs privileged functions remotely must authenticate with phishing-resistant PIV or hardware security key credentials, and the system must log the session.

AC-18 — Wireless Access #

Baselines: Low / Moderate / High CSF 2.0: PR.AA (Identity Management, Authentication, and Access Control)

Requirement:

1. Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and
2. Authorize each type of wireless access to the system prior to allowing such connections.

Implementation guidance:

For every type of wireless access, the Organization must set the configuration standards, the connection conditions, and the implementation guidance before it allows the first connection. The System Owner must authorize each wireless access type before any device uses it. Endpoints must receive their wireless settings through managed configuration, not manual setup, so devices join approved networks on approved terms. The Organization prohibits wireless connections to Organization systems outside an authorized type. Network Administrators must scan each Organization facility for unauthorized wireless access points at least once a quarter. Continuous monitoring with wireless intrusion detection may replace the quarterly scan, as NIST SP 800-153 recommends. The ISSO must treat the discovery of an unauthorized access point or connection as an incident.

AC-19 — Access Control for Mobile Devices #

Baselines: Low / Moderate / High CSF 2.0: PR.AA (Identity Management, Authentication, and Access Control)

Requirement:

1. Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas; and
2. Authorize the connection of mobile devices to organizational systems.

Implementation guidance:

The Organization must set the configuration standards, connection conditions, and implementation guidance for the mobile devices it controls, including their use outside controlled areas. These rules must follow NIST SP 800-124 Rev. 2. No mobile device may connect to Organization systems without authorization. Enrollment in the MDM tool is how a device receives and keeps that authorization. A device that is not enrolled, or is enrolled but out of compliance, must not reach Organization resources. The MDM tool must block jailbroken or rooted devices and devices that run an out-of-date operating system. Every managed device must run mobile threat defense. Only apps on the approved mobile app list may handle Organization information. The CISO must approve an app for the list only after a security review under NIST SP 800-163 Rev. 1. An app that handles PII also needs a privacy threshold analysis first. Users must keep their devices under personal control outside controlled areas and must report a lost or stolen device without delay. The Mobile Device Policy (POL-MOB-001) sets the program rules for issuing, using, and recovering devices.

AC-20 — Use of External Systems #

Baselines: Low / Moderate / High / HVA overlay CSF 2.0: PR.AA (Identity Management, Authentication, and Access Control)

Requirement:

1. [Selection (one or more): establish [organization-defined]; identify [organization-defined] — to be defined], consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to:

1. Access the system from external systems; and
2. Process, store, or transmit organization-controlled information using external systems; or

2. Prohibit the use of [Assignment: organization-defined prohibited types of external systems — to be defined].

Implementation guidance:

The Organization must establish an interconnection security agreement (ISA), memorandum of understanding (MOU), or service level agreement (SLA) with an external party before an authorized individual uses the party’s system to access Organization systems. The same applies before anyone processes, stores, or transmits Organization-controlled information on that system. The agreement must identify, at minimum, the external party’s access controls, security and privacy protections, and incident response capabilities. If the Organization cannot establish those terms, no one may use the external system for Organization purposes. A user must not connect a device to any other network remotely while it is connected to an Organization information system. A personally owned device may reach Organization information only when the CISO has approved its device type and the user has enrolled it in app-level management. On such a device, Organization data must stay in a managed, encrypted work container that the Organization can wipe remotely. NIST SP 800-46 Rev. 2 and NIST SP 800-124 Rev. 2 describe this approach. The user must agree in the rules of behavior to report a lost device at once and to provide the device for incident response.

AC-22 — Publicly Accessible Content #

Baselines: Low / Moderate / High CSF 2.0: PR.AA (Identity Management, Authentication, and Access Control)

Requirement:

1. Designate individuals authorized to make information publicly accessible;
2. Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information;
3. Review the proposed content of information prior to posting onto the publicly accessible system to ensure that nonpublic information is not included; and
4. Review the content on the publicly accessible system for nonpublic information at least quarterly and remove such information, if discovered.

Implementation guidance:

Only individuals the System Owner designates may make information publicly accessible. Each designated individual must complete training on recognizing nonpublic information before the designation takes effect. A designated reviewer must review every piece of proposed content before posting to confirm that it contains no nonpublic information. Designated reviewers must review the existing public content at least every quarter and must remove any nonpublic information they find at once. The System Owner must withdraw the designation of anyone who publishes content without the review.

Related Required Processes #

• Staff use of an internet-based service that keeps no Organization information, such as a search engine or a public social media account, follows “Reviewing External Services” in the System and Services Acquisition policy and procedures. A system that exchanges Organization information needs the agreement this policy requires.

4. Roles and Responsibilities #

These roles apply across this policy. Each System Owner records the system-specific assignments in the system’s System Security and Privacy Plan (SSPP).

5. Performance Measurement #

The CISO manages this policy with the measures below, which meet the IG FISMA maturity model’s Level 4 (Managed and Measurable) criteria. The CISO collects and trends the measures and reports them to the CIO and the Authorizing Officials. When a measure moves away from its target, the CISO starts corrective action through the plan of action and milestones (POA&M) process.

The CISO keeps the measurement data for the annual IG FISMA evaluation and for trend analysis across reporting periods.

6. Compliance and Enforcement #

Every employee, contractor, and other user with access to an information system that the Organization operates, or that others operate for it, must comply with this policy. The CISO records each case of non-compliance as a finding in the Organization’s continuous monitoring program. The ISSO tracks the finding to resolution as a POA&M item, as OMB Circular A-130 and NIST SP 800-37 Rev. 2 describe.

A violation of this policy can lead to suspension of system access, withdrawal of the system’s authorization to operate (ATO), and administrative or disciplinary action under applicable law, regulation, and human capital policy.

The Inspector General assesses the maturity of access control controls each year through the IG FISMA reporting metrics. The target maturity level for this policy area is Level 4: Managed and Measurable.

7. Continuous Improvement #

Level 4 is the minimum the Organization aims for. To meet the IG FISMA maturity model’s Level 5 (Optimized) criteria, the CISO improves access control through these commitments:

1. Review the performance measures in this document at least annually; where a measure has met its target for four consecutive periods, tighten the target or replace the measure with a more demanding indicator.
2. Conduct an annual effectiveness review of this policy area using IG FISMA audit results, assessment findings, incident data, and metric trends; document resulting changes in the revision history.
3. Feed lessons learned from incidents, assessments, and exercises into updates of this document and its procedures within 90 days of the triggering event.
4. Benchmark against the IG FISMA maturity model annually and maintain a documented plan to reach and sustain Level 4 (Managed and Measurable), with a roadmap toward Level 5 (Optimized).
5. Automate joiner-mover-leaver access changes end-to-end from the authoritative HR source, eliminating manual deprovisioning steps.
6. Expand risk-based conditional access signals (device health, behavior analytics) toward continuous, per-session authorization decisions.

8. Exceptions and Waivers #

The CISO may grant an exception to this policy only when compliance is not technically feasible or would harm the mission. To request one, the System Owner sends the CISO a written request that includes:

1. A business justification and a risk assessment.
2. Compensating controls that reduce the risk the exception creates, following the NIST SP 800-53B guidance on compensating controls.
3. A proposed end date no more than one year away.

The CISO decides each request in coordination with the Authorizing Official. An exception that involves privacy risk also needs the agreement of the Senior Agency Official for Privacy (SAOP). The CISO re-evaluates each exception when it comes up for renewal. The System Owner records each approved exception in the system’s SSPP, and the ISSO tracks it as a POA&M item.

9. References #

These are the sources this document cites, with a link to each official text.

• CISA BOD 23-02: Mitigating the Risk from Internet-Exposed Management Interfaces, June 13, 2023.
• CISA BOD 25-01: Implementing Secure Practices for Cloud Services, December 17, 2024.
• CISA High Value Asset (HVA) Control Overlay v1.0, November 1, 2017.
• CISA Zero Trust Maturity Model, April 11, 2023.
• Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, May 11, 2017.
• Executive Order 14028: Improving the Nation’s Cybersecurity, May 12, 2021.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, March 2006.
• FIPS 201-3: Personal Identity Verification (PIV) of Federal Employees and Contractors, January 2022.
• Mobile Communications Best Practice Guidance, December 18, 2024.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-46 Rev. 2: Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security, July 29, 2016.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-53B: Control Baselines for Information Systems and Organizations, September 2020.
• NIST SP 800-63-4: Digital Identity Guidelines, July 31, 2025.
• NIST SP 800-124 Rev. 2: Guidelines for Managing the Security of Mobile Devices in the Enterprise, May 2023.
• NIST SP 800-153: Guidelines for Securing Wireless Local Area Networks (WLANs), February 2012.
• NIST SP 800-163 Rev. 1: Vetting the Security of Mobile Applications, April 2019.
• NIST SP 800-207: Zero Trust Architecture, August 2020.
• OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• OMB M-19-03: Strengthening the Cybersecurity of Federal Agencies by Enhancing the High Value Asset Program, December 26, 2018.
• OMB M-19-17: Enabling Mission Delivery through Improved Identity, Credential, and Access Management (ICAM), May 21, 2019.
• OMB M-22-09: Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, January 26, 2022.
• OMB M-23-22: Delivering a Digital-First Public Experience, September 22, 2023.