AC-1 Policy and Procedures

a. Develop, document, and disseminate to organization-defined personnel or roles: 1. Selection (one or more): organization-level; mission/business process-level; system-level access control policy that: (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2. Procedures to facilitate the implementation of the access control policy and the associated access controls; b. Designate an organization-defined official to manage the development, documentation, and dissemination of the access control policy and procedures; and c. Review and update the current access control: 1. Policy organization-defined frequency and following organization-defined events; and 2. Procedures organization-defined frequency and following organization-defined events.

Source: NIST SP 800-53 Rev 5, AC-1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open NIST SP 800-53 Rev 5 in the compliance library.

Base controls and their enhancements. Which apply follows the baseline you are assessed against (for example FedRAMP Moderate or High, or the low, moderate and high baselines of SP 800-53B). Text in square brackets is a parameter your organisation sets.