Non-organizationally Owned Systems — Restricted Use
LOW MODERATE HIGHRequirements NIST SOURCE
Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using [restrictions].
Discussion (NIST Supplemental Guidance)
Non-organizationally owned systems or system components include systems or system components owned by other organizations as well as personally owned devices. There are potential risks to using non-organizationally owned systems or components. In some cases, the risk is sufficiently high as to prohibit such use (see AC-20 b. ). In other cases, the use of such systems or system components may be allowed but restricted in some way. Restrictions include requiring the implementation of approved controls prior to authorizing the connection of non-organizationally owned systems and components; limiting access to types of information, services, or applications; using virtualization techniques to limit processing and storage activities to servers or system components provisioned by the organization; and agreeing to the terms and conditions for usage. Organizations consult with the Office of the General Counsel regarding legal issues associated with using personally owned devices, including requirements for conducting forensic analyses during investigations after an incident.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for AC-20(3) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- restrictions on the use of non-organizationally owned systems or system components to process, store, or transmit organizational information are defined;
- the use of non-organizationally owned systems or system components to process, store, or transmit organizational information is restricted using <AC-20(03)_ODP restrictions>.
Examine
[SELECT FROM: Access control policy; procedures addressing the use of external systems; system design documentation; system configuration settings and associated documentation; system connection or processing agreements; account management documents; system audit records, other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with responsibilities for restricting or prohibiting the use of non-organizationally owned systems, system components, or devices; system/network administrators; organizational personnel with information security responsibilities].
Test
[SELECT FROM: Mechanisms implementing restrictions on the use of non-organizationally owned systems, components, or devices].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for AC-20(3). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- Access control policy
Configuration
- system design documentation
- system configuration settings and associated documentation
Testing
- Mechanisms implementing restrictions on the use of non-organizationally owned systems, components, or devices
Other Records
- procedures addressing the use of external systems
- system connection or processing agreements
- account management documents
- system audit records, other relevant documents or records