Navigate

AC-20 (1)

AC-20 (1): Limits On Authorized Use

The organization permits authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only when the organization:

AC-20 (1)(a): Verifies the implementation of required security controls on the external system as specified in the organization�s information security policy and security plan; or

AC-20 (1)(b): Retains approved information system connection or processing agreements with the organizational entity hosting the external information system.

Supplemental

This control enhancement recognizes that there are circumstances where individuals using external information systems (e.g., contractors, coalition partners) need to access organizational information systems. In those situations, organizations need confidence that the external information systems contain the necessary security safeguards (i.e., security controls), so as not to compromise, damage, or otherwise harm organizational information systems. Verification that the required security controls have been implemented can be achieved, for example, by third-party, independent assessments, attestations, or other means, depending on the confidence level required by organizations.

CIA Levels
Confidentiality	low
Integrity	low
Availability	unknown

Overlays
Classified, Int-A, Int-B, Int-C, Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to AC-20 (1).

Control	Description
CA-2	The organization: CA-2a.: Develops a security assessment plan that describes the scope of the assessment including: CA-2a.1.: Security controls and control enhancements under assessment; CA-2a.2.: Assessment procedures to be used to determine security control effectiveness; and CA-2a.3.: Assessment environment, assessment team, and assessment roles and responsibilities; CA-2b.: Assesses the security controls in the information system and its environment of operation [Assignment: organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements; CA-2c.: Produces a security assessment report that documents the results of the assessment; and CA-2d.: Provides the results of the security control assessment to [Assignment: organization-defined individuals or roles].

Control

Description

CA-2

The organization:

CA-2a.: Develops a security assessment plan that describes the scope of the assessment including:
- CA-2a.1.: Security controls and control enhancements under assessment;
- CA-2a.2.: Assessment procedures to be used to determine security control effectiveness; and
- CA-2a.3.: Assessment environment, assessment team, and assessment roles and responsibilities;

CA-2b.: Assesses the security controls in the information system and its environment of operation [Assignment: organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;

CA-2c.: Produces a security assessment report that documents the results of the assessment; and

CA-2d.: Provides the results of the security control assessment to [Assignment: organization-defined individuals or roles].

Enhancements

The controls below (if any) add on to the requirements of AC-20 (1).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AC-20 (1).

CCI	Definition
CCI-002333	The organization permits authorized individuals to use an external information system to access the information system only when the organization verifies the implementation of required security controls on the external system as specified in the organization^s information security policy and security plan.
CCI-002334	The organization permits authorized individuals to use an external information system to process organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization^s information security policy and security plan.
CCI-002335	The organization permits authorized individuals to use an external information system to store organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization^s information security policy and security plan.
CCI-002336	The organization permits authorized individuals to use an external information system to transmit organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization^s information security policy and security plan.
CCI-002337	The organization permits authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only when the organization retains approved information system connection or processing agreements with the organizational entity hosting the external information system.