Use of External Systems AC-20

Source: NIST SP 800-53 Rev.5, Access Control family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

AC-20 (Use of External Systems) is about setting the rules for systems you do not own or control — an administrator’s home laptop, a contractor’s machine, a public kiosk, or a cloud service — when those systems connect to this server or handle its information. Under the control you do one of two things for each type: establish written terms and conditions for using it, or prohibit it outright. It sits in the Low baseline as a foundational Access Control.

What good looks like

• Know your external systems — the machines and services outside your control that touch this server (admins’ home laptops, a contractor’s box, package mirrors, remote log or backup targets).
• Decide the approach per type: either set terms and conditions for connecting, or prohibit the types you will not allow (for example, public or shared kiosks).
• Terms should cover who may connect, from what, and the protections the external system must have — patched operating system, disk encryption, and a screen lock.
• Limit how external systems reach the server — accept administrative connections only from known, trusted networks, not the open internet.
• Review the arrangement on a schedule and when people, contractors, or cloud dependencies change. At Moderate you also verify controls on the external system before allowing it (AC-20(1)) and restrict portable storage devices used on external systems (AC-20(2)).

Framework mapping

• NIST CSF 2.0 — ID.AM-04 — Inventories of services provided by suppliers are maintained
• CIS Controls v8 — Control 15 — Service Provider Management

How to move it toward Implemented

• Write a one-page external-systems statement: which external systems may access this server, the terms they must meet (patched, encrypted, screen-locked), and any types you prohibit — then save it as a dated file.
• Restrict administrative access to trusted sources — allow ssh (Secure Shell) only from your admin network or VPN (Virtual Private Network) using the host firewall ufw (Uncomplicated Firewall), for example ufw allow from 10.0.0.0/24 to any port 22, and confirm with ufw status.
• Inventory the external systems the server itself trusts — package mirrors, time sources, and remote log or backup targets — from /etc/apt/sources.list (or /etc/yum.repos.d/), /etc/systemd/timesyncd.conf, and your outbound firewall rules; save that list as a dated file.
• Attach that statement and inventory as hardening evidence on the asset, naming AC-20 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.