Access Control is the largest family in NIST SP 800-171 and the one that carries the most SPRS points. It governs who and what can reach CUI, what they can do once inside, and how connections from outside the boundary — remote, wireless, mobile and external systems — are allowed and protected.
Its size makes it intimidating, but it also contains the single most useful scoping lever in the standard: three five-point requirements that cost nothing if the organization genuinely does not allow the connection they govern.
What the Access Control family covers
Access Control contains 22 requirements, numbered 3.1.1 to 3.1.22 in NIST SP 800-171 Revision 2. In CMMC Level 2 they carry the practice prefix AC.L2, so 3.1.1 appears as AC.L2-3.1.1.
The requirements fall into four groups: account and privilege management (3.1.1–3.1.7), logon and session behavior (3.1.8–3.1.11), remote, wireless and mobile access (3.1.12–3.1.19), and connections to external and public systems (3.1.20–3.1.22). The first group overlaps heavily with Identification and Authentication, and the last overlaps with the boundary controls in System and Communications Protection.
| Requirement | What it requires | SPRS points | POA&M |
|---|---|---|---|
| 3.1.1 | Limit system access to authorized users, processes acting on behalf of users, and devices | 5 | No |
| 3.1.2 | Limit system access to the types of transactions and functions authorized users may execute | 5 | No |
| 3.1.3 | Control the flow of CUI in accordance with approved authorizations | 1 | Eligible |
| 3.1.4 | Separate the duties of individuals to reduce the risk of malevolent activity without collusion | 1 | Eligible |
| 3.1.5 | Employ the principle of least privilege, including for specific security functions and privileged accounts | 3 | No |
| 3.1.6 | Use non-privileged accounts or roles when accessing nonsecurity functions | 1 | Eligible |
| 3.1.7 | Prevent non-privileged users from executing privileged functions and log such attempts | 1 | Eligible |
| 3.1.8 | Limit unsuccessful logon attempts | 1 | Eligible |
| 3.1.9 | Provide privacy and security notices consistent with applicable CUI rules | 1 | Eligible |
| 3.1.10 | Use session lock with pattern-hiding displays after a period of inactivity | 1 | Eligible |
| 3.1.11 | Terminate (automatically) a user session after a defined condition | 1 | Eligible |
| 3.1.12 | Monitor and control remote access sessions | 5 | No |
| 3.1.13 | Employ cryptographic mechanisms to protect the confidentiality of remote access sessions | 5 | No |
| 3.1.14 | Route remote access via managed access control points | 1 | Eligible |
| 3.1.15 | Authorize remote execution of privileged commands and remote access to security-relevant information | 1 | Eligible |
| 3.1.16 | Authorize wireless access prior to allowing such connections | 5 | No |
| 3.1.17 | Protect wireless access using authentication and encryption | 5 | No |
| 3.1.18 | Control connection of mobile devices | 5 | No |
| 3.1.19 | Encrypt CUI on mobile devices and mobile computing platforms | 3 | No |
| 3.1.20 | Verify and control or limit connections to and use of external systems | 1 | Never |
| 3.1.21 | Limit use of portable storage devices on external systems | 1 | Eligible |
| 3.1.22 | Control CUI posted or processed on publicly accessible systems | 1 | Never |
Point values from the DoD Assessment Methodology v1.2.1. POA&M eligibility under 32 CFR 170.21.
What it costs you in SPRS points
The family puts 54 of the 313 deductible points in the SPRS score at risk. The five-point requirements are 3.1.1, 3.1.2, 3.1.12, 3.1.13, 3.1.16, 3.1.17 and 3.1.18. 3.1.5 and 3.1.19 are worth three points. The remaining 13 are worth one point each.
Seven five-point requirements make this family the biggest single source of score swings. But three of them — 3.1.12 (remote access monitoring), 3.1.16 (wireless authorization) and 3.1.18 (mobile device connection) — incur no deduction if the organization does not permit that kind of connection and has policy preventing it from being enabled by accident. That is 15 of the family's 54 points that can be removed by a documented scoping decision rather than by technology.
Where Access Control fails
No Access Control requirement appears in the DIBCAC top-ten list of most-failed requirements, which surprises people given the family's size. The failures that do occur are usually about completeness rather than absence: an account list that omits service accounts and shared mailboxes, least privilege applied to users but not to administrators, or remote access protected at the VPN but not at a second gateway.
The other common problem is the N/A provision used without evidence. Claiming that wireless access to the CUI environment is not permitted requires a policy that says so and technical settings that prevent it. An assessor who finds an enabled wireless adapter on a laptop in scope will not accept the claim.
Implementation priorities for Access Control
Start with the account inventory and the scoping decisions for remote, wireless and mobile access, because they determine how much of the rest of the family applies. Then implement least privilege for administrators, session lock and lockout settings, and encryption for any remote access you keep. External-system rules and the public-posting review come next because they cannot be deferred.
What you can and cannot defer
Under 32 CFR 170.21 only one-point requirements may be placed on a POA&M, with the single exception of 3.13.11 when encryption exists but is not FIPS-validated. In this family that makes 3.1.3, 3.1.4, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.1.10, 3.1.11, 3.1.14, 3.1.15 and 3.1.21 eligible for deferral. 3.1.20 and 3.1.22 are on the list of six requirements that can never be deferred, whatever the point value.
Because 3.1.20 and 3.1.22 cannot be deferred, controls on external systems and on publicly accessible systems need to be in place before any assessment. In practice that means a documented list of approved external systems with terms of use, and a review process before anything is published to a public website.
Evidence assessors expect
Assessors work at the level of the objectives in NIST SP 800-171A and use examine, interview and test. For this family, have the following ready — the full evidence package checklist covers all 14 families:
- An account inventory covering users, administrators, service accounts and devices, with approval records.
- Role definitions and evidence of periodic access reviews.
- Configuration of lockout, session lock and session termination.
- Remote access architecture, encryption settings and session logs.
- Policy and technical settings supporting any N/A claim for wireless, mobile or remote access.
- A list of external systems and the approval process for CUI on public systems.
Frequently asked questions
Can we really score 3.1.16 as N/A if we have Wi-Fi in the office?
Only if the wireless network is outside the CUI boundary and devices in scope are prevented from connecting to it. Office Wi-Fi used by in-scope laptops brings 3.1.16 and 3.1.17 into play.
Is 3.1.1 the same as having user accounts?
It goes further. Its objectives cover identifying authorized users, processes acting on their behalf and devices, and limiting access to each. Devices and processes are often missed.
Does least privilege (3.1.5) apply to administrators?
Yes, explicitly. Administrators should use non-privileged accounts for routine work (3.1.6) and privileged accounts only for privileged tasks.
Does 3.1.3 require data loss prevention software?
Not specifically. 3.1.3 requires controlling the flow of CUI according to approved authorizations. Boundary rules, email restrictions and DLP are all ways to do it; document the mechanism you use.