AC-23 asks you to employ mechanisms you define on selected data storage objects to detect and protect against unauthorized data mining. The control is about someone extracting patterns or bulk records from a database, even through queries that look normal one at a time.
800-53 binds federal systems and, by contract, some suppliers. For other teams it maps well to scraping and bulk export abuse.
What it means in practice
The guidance lists techniques: limit the number and frequency of queries, limit the types of response, apply differential privacy or homomorphic encryption, and notify staff when atypical queries or accesses happen. It also separates this from AU-13, which watches for information that has already been mined and appears outside.
Evidence to collect
- The data stores you consider at risk.
- Rate limits and result size caps in the API or database layer.
- Alert rules for unusual query volume, with a sample alert.
Common gaps
- Authenticated users can page through every record with no limit.
- No alert for a single account reading far more than normal.
How to implement it
Cap page sizes and query rates per account. Alert on volume that departs from each account's own baseline. Review the rules after any incident.
Quick check
How does AC-23 differ from AU-13?
AC-23 protects data while it sits in your stores. AU-13 monitors for information that may already have been mined and exposed elsewhere.
Sources
- NIST SP 800-53 Rev 5, AC-23: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-23
- NIST OSCAL catalog of SP 800-53 Rev 5: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json
