NIST 800-53 AC-13: Withdrawn, Where the Requirements Went

AC-13, Supervision and Review for Access Control, no longer exists as a requirement. NIST withdrew it in SP 800-53 Rev 5 and folded it into two other controls: AC-2 Account Management and AU-6 Audit Record Review, Analysis, and Reporting. The Rev 5 catalog lists it with a withdrawn status and "incorporated into" links to both.

If you are looking at an older baseline or a customer questionnaire that still cites AC-13, this is the page that tells you where to point.

What it means in practice

The old idea was simple. Someone should be watching how access is used, and supervisors should review it. Rev 5 split that into two jobs.

• Reviewing whether accounts are still needed, correctly scoped and properly approved belongs to AC-2.
• Reviewing logs for signs of misuse belongs to AU-6.

800-53 binds federal systems and, through contract, many of their suppliers. For everyone else it is a reference, so the practical move is to treat the two replacement controls as your answer.

Evidence to collect

• The most recent account review for each in scope system, with reviewer and date (see AC-2).
• Records showing audit logs are read on a schedule, with notes on what was found (see AU-6).
• A line in your policy that names who is responsible for each review.

Common gaps

• Answering a legacy AC-13 request with a screenshot of a login page. It does not address either replacement control.
• Reviews that happen but leave no record.

How to implement it

Pick one owner for account reviews and one for log reviews. Put both on a calendar. Keep the output of each review in a single place so you can hand it over without a scramble.

Quick check

Sources

• NIST SP 800-53 Rev 5, AC-13: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-13
• NIST OSCAL catalog of SP 800-53 Rev 5: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json