Skip to main content

NIST 800-53

logo

Summary

NIST SP 800-53 defines the standards and guidelines for federal agencies to architect and manage their information security systems. It was established to provide guidance for the protection of agency's and citizen's private data. The version used for this section is NIST 800-53, Rev. 5, September 2020.

Definitions

DefinitionRequirements
AC-2_2. Removal of temporary or emergency accounts023. Terminate inactive user sessions
027. Allow session lockout
AC-2_3. Disable accounts144. Remove inactive accounts periodically
AC-2_4. Automated audit actions301. Notify configuration changes
AC-2_6. Dynamic privilege management095. Define users with privileges
096. Set user's required privileges
AC-2_7a. Establish and administer privileged user accounts095. Define users with privileges
096. Set user's required privileges
AC-2_7b. Monitor privileged role or attribute assignments095. Define users with privileges
096. Set user's required privileges
AC-2_7c. Monitor changes to roles or attributes095. Define users with privileges
096. Set user's required privileges
AC-2_10. Shared and group account credential change144. Remove inactive accounts periodically
AC-2_13. Disable accounts for high-risk individuals027. Allow session lockout
144. Remove inactive accounts periodically
AC-6. Least privilege186. Use the principle of least privilege
AC-12. Session termination023. Terminate inactive user sessions
369. Set a maximum lifetime in sessions
AC-18_5. Antennas and transmission power levels249. Locate access points
IA-1. Policy and procedures229. Request access credentials
IA-2. Identification and authentication (organizational users)121. Guarantee uniqueness of emails
229. Request access credentials
257. Access based on user credentials
265. Restrict access to critical processes
IA-7. Cryptographic module authentication147. Use pre-existent mechanisms
224. Use secure cryptographic mechanisms
PL-4_1. Social media and external site/applications usage restrictions260. Use alternative emails
SC-3. Security function isolation235. Define credential interface