STIGhubSTIGhub
STIGsRMF ControlsCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • RMF Controls
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 5 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← All Controls

AC-1

Access ControlRev 4

Policy and Procedures

CCI Identifiers (23)

CCI-000001The organization develops an access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.CCI-000002Disseminate the organization-level; mission/business process-level; and/or system-level access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance to organization-defined personnel or roles.CCI-000003Review and update the current access control policy on an organization-defined frequency.CCI-000004The organization develops procedures to facilitate the implementation of the access control policy and associated access controls.CCI-000005Disseminate procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level access control policy and associated access controls to the organization-defined personnel or roles.CCI-000006Review and update the current access control procedures on an organization-defined frequency.CCI-001545Defines a frequency for reviewing and updating the access control policy.CCI-001546Defines a frequency for reviewing and updating the access control procedures.CCI-002106The organization documents the access control policy.CCI-002107Defines the personnel or roles to be recipients of the organization-level; mission/business process-level; and/or system-level access control policy necessary to facilitate the implementation of the access control policy and associated access controls.CCI-002108Defines the personnel or roles to be recipients of the procedures necessary to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level access control policy and associated access controls.CCI-002109The organization documents procedures to facilitate the implementation of the access control policy and associated access controls.CCI-003601Develop and document an organization-level; mission/business process-level; and/or system-level access control policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.CCI-003602Develop and document an organization-level; mission/business process-level; and/or system-level access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.CCI-003603Disseminate the organization-level; mission/business process-level; and/or system-level access control policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines to organization-defined personnel or roles.CCI-003604Develop and document procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level access control policy and the associated access control.CCI-003605Designate an organization-defined official to manage the development and documentation of the access control policy and procedures.CCI-003606Designate an organization-defined official to manage the dissemination of the access control policy and procedures.CCI-003607Defines the official designated to manage the development, documentation, and dissemination of the access control policy and procedures.CCI-003608Review and update the current access control policy following organization-defined events.CCI-003609Defines the events following reviewing and updating the current access control policy.CCI-003610Review and update the current access control procedures following organization-defined events.CCI-003611Defines the events following reviewing and updating the current access control procedures.

Linked STIG Checks (0)

No STIG checks reference this control.