AC-25 is one of the most design focused controls in the catalog. Implement a reference monitor for the policies you define, and make it tamperproof, always invoked, and small enough to be analyzed and tested so that its completeness can be assured.
800-53 binds federal systems and, by contract, some suppliers. Most commercial teams will never build one themselves, but the three properties are a good test for any access check you rely on.
What it means in practice
The guidance describes a reference monitor as a design requirement on a validation mechanism, typically in an operating system, that enforces an access policy over all subjects and objects.
- Tamperproof: attackers cannot alter the mechanism.
- Always invoked: nothing can bypass it.
- Small: it can be analyzed and tested thoroughly.
Evidence to collect
- The design rationale naming the component that plays this role.
- Test results showing the check cannot be skipped.
- For third party platforms, the vendor's documentation of how enforcement works.
Common gaps
- Several overlapping checks scattered across services, none of them complete.
- No test proving a bypass path does not exist.
How to implement it
Most teams meet the spirit by relying on a mature operating system or platform kernel, and by keeping custom authorization logic in one small, tested module.
Quick check
Name the three properties AC-25 requires.
Tamperproof, always invoked, and small enough to be analyzed and tested.
Sources
- NIST SP 800-53 Rev 5, AC-25: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-25
- NIST OSCAL catalog of SP 800-53 Rev 5: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json
