Security and Privacy Controls for Information Systems and Organizations

Ross, R., Pillitteri, Dempsey, Riddle, & Guissanie, G. (2020). Security and Privacy Controls for Information Systems and Organizations.

Type

Report

Intellectual base

Grey literature

Year

2020

DOI

10.6028/nist.sp.800-53r5

Link

https://doi.org/10.6028/NIST.SP.800-53r5

Cited from

computer_science, military_strategic_studies, political_science, systems_cybernetics

Cited by

11 citations across 11 artifacts.

Each citation links to the sentence it supports in the citing article.

Primes

• Access Control
  • Access control is the mechanism and policy by which a system decides whether a particular principal (user, process, service, device) may perform a particular action (read, write, execute, modify, delete) on a particular resource (file, record, endpoint, physical space, function) at a particular moment — enforcing a security policy that separates authorized from unauthorized access and is the primary technical implementation of confidentiality, integrity, and need-to-know principles

    This sourceThe Access Control (AC) family — AC-3 Access Enforcement, AC-6 Least Privilege, plus account management and continuous monitoring — is the canonical control catalog implementing authorization, need-to-know, and least privilege; supports markers 001, 005, 006, 010.

• Defense In Depth
  • In cybersecurity, the pattern stacks perimeter firewalls, network segmentation, host hardening, encryption, monitoring, and least-privilege identity so that a phished credential does not reach the database.

    This sourceSpecifies layered, defense-in-depth security controls and the principle of diversifying control types so layers fail for independent reasons.

• Indirection
  • Listed in the references but not attached to a specific claim.
• Record-Reality Divergence
  • … the record overstating entitlement (a departed employee whose access was never revoked retains live credentials), so the security stakes push cadence toward continuous reconciliation and event-driven write-through (deprovision synchronously on the HR termination event rather than waiting for the quarterly review

    This sourceRequires aligning account management with personnel termination/transfer and disabling accounts within a defined period — the event-driven (write-through) deprovisioning that prevents an access-control record from overstating entitlement after employment ends.

• Separation of Powers
  • In information security and internal control, separation of duties (SoD) is the principle that no single individual should have authority to execute, approve, and audit the same transaction—operationalized in NIST Special Publication 800-53 (2020) as control AC-5, which requires organizations to identify duties of individuals requiring separation, define information system access authorizations to support separation, and document the separation of duties in policies and procedures.

    This sourceControl AC-5 ("Separation of Duties") requires organizations to identify duties requiring separation, define information system access authorizations to support separation, and document the policy in procedures—the canonical operational standard for security separation of duties.

Domain-specific

• Account sharing
  • Formal household profiles or delegated roles avoid some collapse by retaining distinct identities.
• Attack Surface
  • NIST defines it in explicitly boundary-relative terms: the points on the boundary of a system, component, or environment where an attacker can attempt those actions.

Mechanisms

• Collapse Prevention Plan
  • Designed with defense-in-depth,

    This sourceExplains that layered protections can keep a system secure after one protective mechanism fails.

• Out-of-Band Channel
  • When the next identity outage hits, responders dial the bridge, read live device telemetry over the out-of-band link, and drive the recovery — because the channel they are using was designed to survive the failure domain that swallowed everything else.

    This sourceDefines out-of-band channels as separate paths that remain unaffected when the in-band channel is compromised or unavailable.

• Policy Guardrail
  • Its strength is preserving rights and separation of duties across delegation

    This sourceRequires separation of duties and visible, accountable handling of authorized exceptions rather than informal workarounds.

• Signed Commitment Authorization
  • And it is executed by the empowered actor, often under separation of duties

    This sourceRequires separation of duties by dividing mission and support functions among different individuals or roles.

Verification

This reference passed the adversarial substantiation pipeline: it was checked to exist and to support the claim it is attached to. See how references were verified.

Links previously used in the corpus

Before the registry existed this work was also linked 1 other way.

• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf ×1

Registry ID ref:c0729093eb29 · see in the full table