Access Enforcement AC-3
Access Control · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds AC-3 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Access Control family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
AC-3 (Access Enforcement) requires the system to actually enforce approved authorizations - only permitted users and processes reach a given resource, per policy. It is the mechanism that carries out the decisions account policy and AC-6 define, and it is a foundational Low-and-up control.
What good looks like
- Deny by default and grant access only where an authorization exists.
- Enforce access at multiple layers - network, host, and application - not just one.
- Tie every enforcement decision to an authenticated identity.
- Keep enforcement logic consistent with the documented access policy so the two never drift apart.
Framework mapping
- NIST CSF 2.0 — PR.AA-05 — Access permissions and authorizations are managed and enforced
- CIS Controls v8 — Control 6 — Access Control Management - grant and enforce access rights
- OWASP Top 10:2021 — A01 Broken Access Control — Enforce that users act only within their intended permissions
How to move it toward Implemented
- This is met on VM 607 across three layers: the SSH (Secure Shell) daemon enforces host login (
AllowUsers, key-only, root disabled, §1c), an Uncomplicated Firewall (UFW) default-deny with a rate-limited port 22 gates the network (§1d), and the sudo group gates privilege. - Capture the enforcement state as evidence -
sudo ufw status verbose, the sshd hardening file, and the sudoers/sudo-group membership - saved as a dated as-built. - Attach that bundle as asset-scoped evidence naming AC-3 in the Requirement field to move it to 'Completed'.
- Note the DVWA (Damn Vulnerable Web Application) target enforces nothing at the app layer by design - it is the practice victim, not part of the host's enforcement claim.