NIST SP 800-53 AC-3(4) Discretionary Access Control

Requirements NIST SOURCE

Enforce [organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following:

Discussion (NIST Supplemental Guidance)

When discretionary access control policies are implemented, subjects are not constrained with regard to what actions they can take with information for which they have already been granted access. Thus, subjects that have been granted access to information are not prevented from passing the information to other subjects or objects (i.e., subjects have the discretion to pass). Discretionary access control can operate in conjunction with mandatory access control as described in AC-3(3) and AC-3(15) . A subject that is constrained in its operation by mandatory access control policies can still operate under the less rigorous constraints of discretionary access control. Therefore, while AC-3(3) imposes constraints that prevent a subject from passing information to another subject operating at a different impact or classification level, AC-3(4) permits the subject to pass the information to any subject at the same impact or classification level. The policy is bounded by the system. Once the information is passed outside of system control, additional means may be required to ensure that the constraints remain in effect. While traditional definitions of discretionary access control require identity-based access control, that limitation is not required for this particular use of discretionary access control.

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for AC-3(4) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

discretionary access control policy enforced over the set of covered subjects is defined;
discretionary access control policy enforced over the set of covered objects is defined;
<AC-03(04)_ODP[01] discretionary access control policy> is enforced over the set of covered subjects specified in the policy;
<AC-03(04)_ODP[02] discretionary access control policy> is enforced over the set of covered objects specified in the policy;
<AC-03(04)_ODP[01] discretionary access control policy> and <AC-03(04)_ODP[02] discretionary access control policy> are enforced where the policy specifies that a subject that has been granted access to information can pass the information to any other subjects or objects;
<AC-03(04)_ODP[01] discretionary access control policy> and <AC-03(04)_ODP[02] discretionary access control policy> are enforced where the policy specifies that a subject that has been granted access to information can grant its privileges to other subjects;
<AC-03(04)_ODP[01] discretionary access control policy> and <AC-03(04)_ODP[02] discretionary access control policy> are enforced where the policy specifies that a subject that has been granted access to information can change security attributes on subjects, objects, the system, or the system�s components;
<AC-03(04)_ODP[01] discretionary access control policy> and <AC-03(04)_ODP[02] discretionary access control policy> are enforced where the policy specifies that a subject that has been granted access to information can choose the security attributes to be associated with newly created or revised objects;
<AC-03(04)_ODP[01] discretionary access control policy> and <AC-03(04)_ODP[02] discretionary access control policy> are enforced where the policy specifies that a subject that has been granted access to information can change the rules governing access control.

Examine

[SELECT FROM: Access control policy; discretionary access control policies; procedures addressing access enforcement; system design documentation; system configuration settings and associated documentation; list of subjects and objects (i.e., users and resources) requiring enforcement of discretionary access control policies; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with access enforcement responsibilities; system/network administrators; organizational personnel with information security responsibilities; system developers].

Test

[SELECT FROM: Mechanisms implementing discretionary access control policy].

Overlays

Showing the OT/ICS overlay for the parent control AC-3 — see the AC-3(4) entries within each baseline below.

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

Base control: Included (matches standard baseline)

MODERATE

Base control: Included (matches standard baseline)

HIGH

Base control: Included (matches standard baseline)
Added: (11)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for AC-3(4). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

Access control policy
discretionary access control policies
list of subjects and objects (i.e., users and resources) requiring enforcement of discretionary access control policies
system security plan

Configuration

system design documentation
system configuration settings and associated documentation

Testing

Mechanisms implementing discretionary access control policy

Other Records

procedures addressing access enforcement
system audit records
other relevant documents or records