AC-3 Access enforcement

FedRAMP Moderate · Rev 5

What the standard requires

Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Quoted verbatim from NIST SP 800-53 Rev 5 (OSCAL catalog), which is in the public domain.

Maps to 3 controls in 2 other frameworks

Framework	Control
HITRUST CSF v11	01.b.01 Access to information and systems is authorized based on business need
	01.h.01 Access to application functions and data is restricted per policy
NIST Cybersecurity Framework (1.1, legacy)	PR.AC-4 Access permissions and authorizations managed

Mappings are CMDash’s own, seeded with the product and shown on both frameworks they connect. In the product they mean evidence you attach here also counts against the controls listed above.

Track AC-3 with evidence behind it

In CMDash this control is a row with an owner, a status, uploaded evidence kept with its full history, and an export an assessor can read.

Start free trial All FedRAMP Moderate controls