External systems are the ones you do not control but still touch your data: a contractor's laptop, a personal device, a partner's tenant, a coffee shop network. AC-20 asks you to decide how to handle them.
SP 800-53 binds US federal systems and, by contract, some suppliers. For other companies it is a reference, and the questions it raises show up in vendor and BYOD reviews.
What the control asks
Establish, per your trust relationships with the organizations that own or run those systems, terms and conditions that allow authorized people to access your system from external systems, and to process, store or transmit your information on them. Or prohibit the use of specified types of external system. You choose which.
What it means in practice
The guidance describes external systems as those used by, but not part of, your organizational systems, where you lack direct control over implementation and assessment of controls. Examples: personally owned devices, privately owned equipment in public facilities, systems run by contractors, and systems run by other organizations. It adds that you can prohibit any external system type, such as all personally owned systems.
Where trust relationships already exist, for example through existing information exchange agreements, explicit terms may not be needed, and those systems may not count as external.
The enhancements: AC-20.1 Limits on Authorized Use, AC-20.2 Portable Storage Devices, Restricted Use, AC-20.3 Non organizationally Owned Systems, Restricted Use, AC-20.4 Network Accessible Storage Devices, Prohibited Use and AC-20.5 Portable Storage Devices, Prohibited Use.
Evidence to collect
- A policy stating which external systems are allowed, restricted or banned.
- Contractor and partner agreements carrying security terms.
- Technical controls: conditional access that checks device state, or browser isolation for unmanaged devices.
- A register of third parties with access, including what they can reach.
- Reviews of third party access with removals.
- Rules for personal cloud storage and file sharing.
Common gaps
- Contractors using personal laptops with full access to source code.
- Employees syncing company files to personal cloud accounts.
- Third parties with standing access and no end date.
- A policy that bans personal devices while the identity provider lets them in.
- No view of vendors holding company data.
How to implement it
Decide the rule first. Many teams allow unmanaged devices for web access only, through a session that blocks download, and require managed devices for anything deeper. Write that down, then enforce it with conditional access.
Give contractors scoped accounts that expire. Put security terms in contracts. Keep a third party register and review it with your regular access reviews.
Your software supply chain is an external system too, because open source packages are code you run but do not control. A vendor risk review process helps you apply the same discipline to suppliers, and the Gold directory lets you look up the security posture of public packages before you adopt them.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can an organization prohibit external systems entirely?
Yes. The control allows you to prohibit the use of specified types of external systems instead of permitting them with terms.
Give two examples of external systems from the guidance.
Personally owned devices, and systems managed by contractors.
Sources
- NIST SP 800-53 Rev 5, AC-20: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-20
- NIST OSCAL catalog of SP 800-53 Rev 5: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json
