AC-15, Automated Marking, is a withdrawn control. In SP 800-53 Rev 5, NIST incorporated it into MP-3 Media Marking. The catalog records the withdrawn status and a single "incorporated into" link to MP-3.
You may still meet AC-15 in older system security plans or in a customer's template. When you do, map it forward rather than answering it as a live requirement.
What it means in practice
The original control was about marking output, such as printed pages and displays, with the sensitivity of the information. In Rev 5 that expectation lives with media marking in the MP family.
For a company outside the US federal world, 800-53 is a reference, not a rule. So the useful question is whether your sensitive data carries a visible label that tells people how to handle it.
Evidence to collect
- Your data classification scheme and the labels it uses.
- Examples of labelled output, such as an export header, a report footer or a document watermark.
- The MP-3 evidence you already keep for removable media and exports.
Common gaps
- A classification policy that exists on paper while exports and reports carry no label at all.
- Answering "not applicable" without noting the control was withdrawn.
How to implement it
Decide which classes of data need a label. Then make the system add it on output, so people do not have to remember. Start with exports and reports that leave the platform.
Quick check
Where did AC-15 go in Rev 5?
It was withdrawn and incorporated into MP-3 Media Marking.
Sources
- NIST SP 800-53 Rev 5, AC-15: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-15
- NIST OSCAL catalog of SP 800-53 Rev 5: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json
