AC-21 is about the moment someone decides to share. It asks you to let authorized users determine whether the access authorizations assigned to a sharing partner match the information's access and use restrictions, and to use automated mechanisms or processes that help them decide.
800-53 binds federal systems and, through contract, other organizations. Private firms see the same idea when sharing customer data, source code or contract material.
What it means in practice
The guidance says the control applies to information restricted in some formal way, such as contract sensitive, proprietary, privileged or personal data. Partners can be defined at individual, group or organization level. Restrictions can include non disclosure agreements.
Enhancements: AC-21.1 Automated Decision Support and AC-21.2 Information Search and Retrieval.
Evidence to collect
- A classification scheme with sharing rules per class.
- A partner register showing agreements and what each partner may see.
- Screens or prompts in your sharing tools that warn the user.
- Logs of shares to external parties.
Common gaps
- Sharing links open to anyone.
- No record of which partners signed an NDA.
- Users guessing, because nothing tells them what a document is.
How to implement it
Label data, keep a partner list, and make your file sharing tool block or warn on external shares of restricted classes.
Quick check
What can access restrictions include?
The guidance gives non disclosure agreements as one example of an access restriction.
Sources
- NIST SP 800-53 Rev 5, AC-21: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-21
- NIST OSCAL catalog of SP 800-53 Rev 5: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json
