| 💼 AC-1 Policy and Procedures (L)(M)(H) | | | | |
| 💼 AC-2 Account Management (L)(M)(H) | 10 | | 4 | |
|     💼 AC-2(1) Automated System Account Management (M)(H) | | | 16 | |
|     💼 AC-2(2) Automated Temporary and Emergency Account Management (M)(H) | | | | |
|     💼 AC-2(3) Disable Accounts (M)(H) | | | 4 | |
|     💼 AC-2(4) Automated Audit Actions (M)(H) | | | 16 | |
|     💼 AC-2(5) Inactivity Logout (M)(H) | | | | |
|     💼 AC-2(7) Privileged User Accounts (M)(H) | | 6 | 7 | |
|     💼 AC-2(9) Restrictions on Use of Shared and Group Accounts (M)(H) | | 2 | 2 | |
|     💼 AC-2(11) Usage Conditions (H) | | | | |
|     💼 AC-2(12) Account Monitoring for Atypical Usage (M)(H) | | 1 | 1 | |
|     💼 AC-2(13) Disable Accounts for High-risk Individuals (M)(H) | | | | |
| 💼 AC-3 Access Enforcement (L)(M)(H) | | 37 | 67 | |
| 💼 AC-4 Information Flow Enforcement (M)(H) | 2 | 8 | 39 | |
|     💼 AC-4(4) Flow Control of Encrypted Information (H) | | 25 | 26 | |
|     💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H) | | 11 | 46 | |
| 💼 AC-5 Separation of Duties (M)(H) | | | 13 | |
| 💼 AC-6 Least Privilege (M)(H) | 8 | | 27 | |
|     💼 AC-6(1) Authorize Access to Security Functions (M)(H) | | 4 | 4 | |
|     💼 AC-6(2) Non-privileged Access for Nonsecurity Functions (M)(H) | | 1 | 4 | |
|     💼 AC-6(3) Network Access to Privileged Commands (H) | | 1 | 2 | |
|     💼 AC-6(5) Privileged Accounts (M)(H) | | 3 | 5 | |
|     💼 AC-6(7) Review of User Privileges (M)(H) | | 2 | 2 | |
|     💼 AC-6(8) Privilege Levels for Code Execution (H) | | | | |
|     💼 AC-6(9) Log Use of Privileged Functions (M)(H) | | 7 | 26 | |
|     💼 AC-6(10) Prohibit Non-privileged Users from Executing Privileged Functions (M)(H) | | 1 | 3 | |
| 💼 AC-7 Unsuccessful Logon Attempts (L)(M)(H) | | 1 | 1 | |
| 💼 AC-8 System Use Notification (L)(M)(H) | | | | |
| 💼 AC-10 Concurrent Session Control (H) | | | | |
| 💼 AC-11 Device Lock (M)(H) | 1 | | | |
|     💼 AC-11(1) Pattern-hiding Displays (M)(H) | | | | |
| 💼 AC-12 Session Termination (M)(H) | | | | |
| 💼 AC-14 Permitted Actions Without Identification or Authentication (L)(M)(H) | | | | |
| 💼 AC-17 Remote Access (L)(M)(H) | 4 | | 1 | |
|     💼 AC-17(1) Monitoring and Control (M)(H) | | | 1 | |
|     💼 AC-17(2) Protection of Confidentiality and Integrity Using Encryption (M)(H) | | | 17 | |
|     💼 AC-17(3) Managed Access Control Points (M)(H) | | | | |
|     💼 AC-17(4) Privileged Commands and Access (M)(H) | | | | |
| 💼 AC-18 Wireless Access (L)(M)(H) | 4 | | 5 | |
|     💼 AC-18(1) Authentication and Encryption (M)(H) | | | | |
|     💼 AC-18(3) Disable Wireless Networking (M)(H) | | | | |
|     💼 AC-18(4) Restrict Configurations by Users (H) | | | | |
|     💼 AC-18(5) Antennas and Transmission Power Levels (H) | | | | |
| 💼 AC-19 Access Control for Mobile Devices (L)(M)(H) | 1 | | | |
|     💼 AC-19(5) Full Device or Container-based Encryption (M)(H) | | | | |
| 💼 AC-20 Use of External Systems (L)(M)(H) | 2 | | | |
|     💼 AC-20(1) Limits on Authorized Use (M)(H) | | | | |
|     💼 AC-20(2) Portable Storage Devices — Restricted Use (M)(H) | | | | |
| 💼 AC-21 Information Sharing (M)(H) | | | 8 | |
| 💼 AC-22 Publicly Accessible Content (L)(M)(H) | | | | |