AC-3 — Access Enforcement | Defense Map

NIST SP 800-53 control context

AC-3 — Access Enforcement

Access control policies control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (i.e., devices, files, records, domains) in organizational systems. In addition to enforcing authorized access at the system level and recognizing that systems can host many applications and services in support of mission and business functions, access enforcement mechanisms can also be employed at the application and service level to provide increased information security and privacy. In contrast to logical access controls that are implemented within the system, physical access controls are addressed by the controls in the Physical and Environmental Protection ( [PE](#pe) ) family.

Read the official statement, discussion, parameters, enhancements, and assessment methods →

Outcome layer

NIST CSF 2.0 informative references

These CSF Subcategories list this base control or one of its enhancements in the imported NIST informative reference.

PR.AA-05Manage Permissions and AuthorizationsAC-3 PR.DS-10Protect Data in UseAC-3 PR.IR-01Protect Networks and EnvironmentsAC-3

CUI protection layer

NIST SP 800-171 and SP 800-172

SP 800-171 requirements sourcing this control

03.01.02Access EnforcementAC-3

SP 800-172 enhanced requirements sourcing this control

03.01.01EDual AuthorizationAC-3(2)03.01.09EAttribute-Based Access ControlAC-3(13)03.01.11ERole-Based Access ControlAC-3(7)

Defensive engineering layer

MITRE D3FEND techniques

D3-EALExecutable Allowlistingnarrower · AC-3 D3-EDLExecutable Denylistingnarrower · AC-3 D3-SCFSystem Call Filteringnarrower · AC-3(8)

Adversary layer

MITRE ATT&CK relationships

Curated mitigation mappings

M1018User Account ManagementCurated through D3-SCF M1025Privileged Process IntegrityCurated through D3-SCF M1033Limit Software InstallationCurated through D3-EAL M1033Limit Software InstallationCurated through D3-EDL M1038Execution PreventionCurated through D3-EAL M1038Execution PreventionCurated through D3-EDL M1042Disable or Remove Feature or ProgramCurated through D3-EDL M1042Disable or Remove Feature or ProgramCurated through D3-SCF M1044Restrict Library LoadingCurated through D3-SCF M1045Code SigningCurated through D3-EAL

Show 2 additional relationships

M1048Application Isolation and SandboxingCurated through D3-SCF M1052User Account ControlCurated through D3-SCF

Inferred behavior relationships

Experimental: These relationships are inferred through D3FEND and must be validated against architecture, telemetry, and threat context.

Show 142 additional relationships

T1562.001Disable or Modify ToolsInferred through D3-SCF

T1562.003Impair Command History LoggingInferred through D3-EAL

T1562.003Impair Command History LoggingInferred through D3-EDL

T1565.003Runtime Data ManipulationInferred through D3-EAL T1565.003Runtime Data ManipulationInferred through D3-EDL T1574.007Path Interception by PATH Environment VariableInferred through D3-EAL T1574.007Path Interception by PATH Environment VariableInferred through D3-EDL T1574.008Path Interception by Search Order HijackingInferred through D3-EAL T1574.008Path Interception by Search Order HijackingInferred through D3-EDL T1574.009Path Interception by Unquoted PathInferred through D3-EAL T1574.009Path Interception by Unquoted PathInferred through D3-EDL T1621Multi-Factor Authentication Request GenerationInferred through D3-SCF

Relationship boundaries

Use the map without overclaiming.

A CSF informative reference is not an equivalence statement. A source-control relationship is not proof of implementation. A D3FEND semantic relationship is not a product claim. An inferred ATT&CK link is a hypothesis for engineering analysis.

Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST or MITRE. Informative references and cross-framework relationships support navigation and analysis; they do not establish compliance, applicability, equivalence, control inheritance, or guaranteed mitigation effectiveness.