Control statement
- a.[Organization-defined: ac-20_odp.01] , consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to:
- 1.Access the system from external systems; and
- 2.Process, store, or transmit organization-controlled information using external systems; or
- b.Prohibit the use of [Organization-defined: prohibited types of external systems].
Discussion
External systems are systems that are used by but not part of organizational systems, and for which the organization has no direct control over the implementation of required controls or the assessment of control effectiveness. External systems include personally owned systems, components, or devices; privately owned computing and communications devices in commercial or public facilities; systems owned or controlled by nonfederal organizations; systems managed by contractors; and federal information systems that are not owned by, operated by, or under the direct supervision or authority of the organization. External systems also include systems owned or operated by other components within the same organization and systems within the organization with different authorization boundaries. Organizations have the option to prohibit the use of any type of external system or prohibit the use of specified types of external systems, (e.g., prohibit the use of any external system that is not organizationally owned or prohibit the use of personally-owned systems). For some external systems (i.e., systems operated by other organizations), the trust relationships that have been established between those organizations and the originating organization may be such that no explicit terms and conditions are required. Systems within these organizations may not be considered external. These situations occur when, for example, there are pre-existing information exchange agreements (either implicit or explicit) established between organizations or components or when such agreements are specified by applicable laws, executive orders, directives, regulations, policies, or standards. Authorized individuals include organizational personnel, contractors, or other individuals with authorized access to organizational systems and over which organizations have the authority to impose specific rules of behavior regarding system access. Restrictions that organizations impose on authorized individuals need not be uniform, as the restrictions may vary depending on trust relationships between organizations. Therefore, organizations may choose to impose different security restrictions on contractors than on state, local, or tribal governments. External systems used to access public interfaces to organizational systems are outside the scope of [AC-20](#ac-20) . Organizations establish specific terms and conditions for the use of external systems in accordance with organizational security policies and procedures. At a minimum, terms and conditions address the specific types of applications that can be accessed on organizational systems from external systems and the highest security category of information that can be processed, stored, or transmitted on external systems. If the terms and conditions with the owners of the external systems cannot be established, organizations may impose restrictions on organizational personnel using those external systems.
Organization-defined parameters
These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.
From control text to operational evidence
Use Use of External Systems as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to identity, authorization, least privilege, session boundaries, and access lifecycle governance.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- access approvals and entitlement records
- role and group configuration exports
- periodic access review results
- authentication and authorization logs
Common failure patterns
- standing privileges that outlive business need
- shared or orphaned accounts
- access rules implemented differently across systems
- approvals that cannot be traced to actual permissions
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
- AC-20a.
- AC-20a.01[Organization-defined: ac-20_odp.01] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to access the system from external systems (if applicable);
- AC-20a.02[Organization-defined: ac-20_odp.01] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to process, store, or transmit organization-controlled information using external systems (if applicable);
- AC-20b.the use of [Organization-defined: prohibited types of external systems] is prohibited (if applicable).
Examine
- Access control policy
- procedures addressing the use of external systems
- external systems terms and conditions
- list of types of applications accessible from external systems
- maximum security categorization for information processed, stored, or transmitted on external systems
- system configuration settings and associated documentation
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for defining terms and conditions for use of external systems to access organizational systems
- system/network administrators
- organizational personnel with information security responsibilities
Test
- Mechanisms implementing terms and conditions on the use of external systems
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
AC-20(1) — Limits on Authorized Use
Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after:
- (a)Verification of the implementation of controls on the external system as specified in the organization’s security and privacy policies and security and privacy plans; or
- (b)Retention of approved system connection or processing agreements with the organizational entity hosting the external system.
Official discussion
Limiting authorized use recognizes circumstances where individuals using external systems may need to access organizational systems. Organizations need assurance that the external systems contain the necessary controls so as not to compromise, damage, or otherwise harm organizational systems. Verification that the required controls have been implemented can be achieved by external, independent assessments, attestations, or other means, depending on the confidence level required by organizations.
Assessment objectives and methods
- AC-20(01)(a)authorized individuals are permitted to use an external system to access the system or to process, store, or transmit organization-controlled information only after verification of the implementation of controls on the external system as specified in the organization’s security and privacy policies and security and privacy plans (if applicable);
- AC-20(01)(b)authorized individuals are permitted to use an external system to access the system or to process, store, or transmit organization-controlled information only after retention of approved system connection or processing agreements with the organizational entity hosting the external system (if applicable).
Examine
- Access control policy
- procedures addressing the use of external systems
- system connection or processing agreements
- account management documents
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
Test
- Mechanisms implementing limits on use of external systems
Related controls
AC-20(2) — Portable Storage Devices — Restricted Use
Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using [Organization-defined: restrictions].
Official discussion
Limits on the use of organization-controlled portable storage devices in external systems include restrictions on how the devices may be used and under what conditions the devices may be used.
Organization-defined parameters (1)
Assessment objectives and methods
the use of organization-controlled portable storage devices by authorized individuals is restricted on external systems using [Organization-defined: restrictions].
Examine
- Access control policy
- procedures addressing the use of external systems
- system configuration settings and associated documentation
- system connection or processing agreements
- account management documents
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for restricting or prohibiting the use of organization-controlled storage devices on external systems
- system/network administrators
- organizational personnel with information security responsibilities
Test
- Mechanisms implementing restrictions on the use of portable storage devices
Related controls
AC-20(3) — Non-organizationally Owned Systems — Restricted Use
Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using [Organization-defined: restrictions].
Official discussion
Non-organizationally owned systems or system components include systems or system components owned by other organizations as well as personally owned devices. There are potential risks to using non-organizationally owned systems or components. In some cases, the risk is sufficiently high as to prohibit such use (see [AC-20 b.](#ac-20_smt.b) ). In other cases, the use of such systems or system components may be allowed but restricted in some way. Restrictions include requiring the implementation of approved controls prior to authorizing the connection of non-organizationally owned systems and components; limiting access to types of information, services, or applications; using virtualization techniques to limit processing and storage activities to servers or system components provisioned by the organization; and agreeing to the terms and conditions for usage. Organizations consult with the Office of the General Counsel regarding legal issues associated with using personally owned devices, including requirements for conducting forensic analyses during investigations after an incident.
Organization-defined parameters (1)
Assessment objectives and methods
the use of non-organizationally owned systems or system components to process, store, or transmit organizational information is restricted using [Organization-defined: restrictions].
Examine
- Access control policy
- procedures addressing the use of external systems
- system design documentation
- system configuration settings and associated documentation
- system connection or processing agreements
- account management documents
- system audit records, other relevant documents or records
Interview
- Organizational personnel with responsibilities for restricting or prohibiting the use of non-organizationally owned systems, system components, or devices
- system/network administrators
- organizational personnel with information security responsibilities
Test
- Mechanisms implementing restrictions on the use of non-organizationally owned systems, components, or devices
AC-20(4) — Network Accessible Storage Devices — Prohibited Use
Prohibit the use of [Organization-defined: network-accessible storage devices] in external systems.
Official discussion
Network-accessible storage devices in external systems include online storage devices in public, hybrid, or community cloud-based systems.
Organization-defined parameters (1)
Assessment objectives and methods
the use of [Organization-defined: network-accessible storage devices] is prohibited in external systems.
Examine
- Access control policy
- procedures addressing use of network-accessible storage devices in external systems
- system design documentation
- system configuration settings and associated documentation
- system connection or processing agreements
- list of network-accessible storage devices prohibited from use in external systems
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for prohibiting the use of network-accessible storage devices in external systems
- system/network administrators
- organizational personnel with information security responsibilities
Test
- Mechanisms prohibiting the use of network-accessible storage devices in external systems
AC-20(5) — Portable Storage Devices — Prohibited Use
Prohibit the use of organization-controlled portable storage devices by authorized individuals on external systems.
Official discussion
Limits on the use of organization-controlled portable storage devices in external systems include a complete prohibition of the use of such devices. Prohibiting such use is enforced using technical methods and/or nontechnical (i.e., process-based) methods.
Assessment objectives and methods
the use of organization-controlled portable storage devices by authorized individuals is prohibited on external systems.
Examine
- Access control policy
- procedures addressing use of portable storage devices in external systems
- system design documentation
- system configuration settings and associated documentation
- system connection or processing agreements
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for prohibiting the use of portable storage devices in external systems
- system/network administrators
- organizational personnel with information security responsibilities
Related controls
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.