Security requirement
- a.Develop and document access agreements for systems processing, storing, or transmitting CUI.
- b.Review and update the access agreements [Organization-defined: organization-defined frequency].
- c.Verify that individuals requiring access to CUI and systems processing, storing, or transmitting CUI:
- c-1.Sign appropriate access agreements prior to being granted access; and
- c-2.Re-sign access agreements to maintain access to systems when access agreements have been updated or [Organization-defined: organization-defined frequency].
Discussion
Access agreements include nondisclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements. Signed access agreements include an acknowledgement that individuals have read, understand, and agree to abide by the constraints associated with systems processing, storing, or transmitting CUI to which they have authorized access. This requirement is sourced to a control tailored out of the SP 800-53B .13 moderate baseline in SP 800-171.
Tailoring decisions required
Resolve these values through the governing organization’s approved tailoring and risk-management process before declaring the requirement implemented.
Protection strategies supported
These classifications are carried from the official SP 800-172 OSCAL record and help explain the enhanced requirement’s defensive purpose.
Implementation perspective
Treat Access Agreements as an enhanced CUI protection outcome for elevated threat conditions that must be reflected in the system boundary, documented implementation, operational behavior, and assessment evidence. Pay particular attention to personnel risk, screening, agreements, transfer, termination, and timely access consequences.
- Confirm the federal agency selected this enhanced requirement for the critical program or high-value asset and identify the CUI system components, services, users, and external connections in scope.
- Resolve every organization-defined parameter through an approved governance and tailoring process.
- Map each clause of the requirement to an accountable owner, implementation mechanism, and evidence source.
- Verify that inherited and shared implementations are supported by current provider evidence and responsibility boundaries.
- Collect evidence during normal operation and review changes, exceptions, and deficiencies on a risk-based cadence.
Questions to ask
- Which critical-program or high-value-asset CUI, data flows, users, and services are protected by this enhanced requirement?
- Which portions are implemented locally, inherited, shared, or not applicable, and what evidence supports that determination?
- Do the system security plan, deployed configuration, operating process, and assessment evidence tell the same story?
- What change, incident, or threshold should trigger reassessment?
Evidence and validation
- screening and suitability records
- access agreements
- transfer and termination checklists
- role-change and offboarding evidence
Common failure patterns
- access persisting after transfer or separation
- contractor lifecycle outside normal controls
- sensitive roles not screened based on risk
- termination actions that cannot be shown to occur promptly
Assessment objectives and methods
Assessment objectives (5)
- a.
access agreements are developed and documented for systems processing, storing, or transmitting CUI.
- b.
access agreements are reviewed [Organization-defined: frequency].
- b.
access agreements are updated [Organization-defined: frequency].
- c.1.
individuals requiring access to CUI and systems processing, storing, or transmitting CUI sign appropriate access agreements prior to being granted access.
- c.2.
individuals requiring access to CUI and systems processing, storing, or transmitting CUI re-sign access agreements to maintain access when access agreements have been updated or [Organization-defined: frequency].
Examine
- Personnel security policy
- personnel security procedures
- procedures addressing access agreements for systems processing, storing, or transmitting CUI
- access control policy
- access control procedures
- access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements)
- documentation of access agreement reviews, updates, and re-signing
- system security plan
- other relevant documents or records
Interview
- Personnel with personnel security responsibilities
- personnel who have signed and/or resigned access agreements
- personnel with information security responsibilities
Test
- Processes for reviewing, updating, and re-signing access agreements
- mechanisms supporting reviewing, updating, and re-signing of access agreements
Source NIST SP 800-53 controls
These controls are referenced by the official SP 800-172 Rev. 3 OSCAL record. Open the corresponding control pages for complete control text, enhancements, D3FEND mappings, and related learning.
Authoritative sources
- NIST SP 800-172 Revision 3 official publication ↗
- NIST SP 800-172A Revision 3 official publication ↗
- NIST OSCAL Content release used for this import ↗
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. The official publications, the responsible federal agency, and the governing contract or agreement determine applicability, tailoring, assessment depth, and required implementation.