AC-1 is the first control in the Access Control family, and it is the one every other AC control hangs from. It asks you to write down your policy and procedures for access control, name someone to own them, and keep them current.
SP 800-53 binds US federal systems, and reaches contractors through agreements. For the rest of us it is a reference catalog. If a customer or auditor asks for AC-1 evidence, the content below is what they expect to see.
What the control asks
The statement has three parts. First, develop, document and disseminate an access control policy to the people you define. The policy must address purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance, and it must be consistent with applicable laws and standards. Second, publish procedures that put the policy into effect. Third, designate an official to manage the whole thing, and review and update both documents on a frequency you set and after events you define.
The numbers and names in that statement are yours to fill in. NIST leaves them as organization defined values.
What it means in practice
The guidance is blunt about one point: simply restating controls does not constitute an organizational policy or procedure. A policy copied from the catalog will not satisfy anyone.
It also says the policy can sit inside a general security and privacy policy, or be split across several. Procedures can live in a system security plan or in separate documents. Triggers for an update include audit findings, security incidents or breaches, and changes in law or standards.
Evidence to collect
- The current access control policy, with version, date and approver.
- The procedures: how accounts are requested, approved, changed and removed.
- The name or role of the owner.
- Proof the policy reached staff, such as an acknowledgment record.
- A review record from the last cycle, with changes noted.
Common gaps
- A policy with no owner, or an owner who left.
- Procedures that describe a tool you no longer use.
- A review date that passed months ago.
- No link between a past incident and any policy change.
How to implement it
Keep the policy short. State who may get access, who approves it, and how fast it is removed. Write procedures as steps a new admin could follow on day one. Set a yearly review on the calendar, and add a rule that an incident triggers an early one.
Mapping this to other frameworks varies by source, so check the mapping your auditor uses before you reuse the same document across them.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can AC-1 be satisfied by copying the control text?
No. The guidance says restating controls does not constitute a policy or procedure.
What events should trigger an early update?
Assessment or audit findings, security incidents or breaches, and changes in law or standards.
Sources
- NIST SP 800-53 Rev 5, AC-1: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-1
- NIST OSCAL catalog of SP 800-53 Rev 5: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json
