# AC-24 Access Control Decisions

NIST SP 800-53 control. Family: AC Access Control. Function: preventative. In no baseline. Mapping licence: CC BY-SA 4.0.

Statement: [Selection (one or more): Establish procedures; Implement mechanisms] to ensure [Assignment: organization-defined access control decisions] are applied to each access request prior to access enforcement.
Guidance: Access control decisions (also known as authorization decisions) occur when authorization information is applied to specific accesses. In contrast, access enforcement occurs when systems enforce access control decisions. While it is common to have access control decisions and access enforcement implemented by the same entity, it is not required, and it is not always an optimal implementation choice. For some architectures and distributed systems, different entities may make access control decisions and enforce access.

## Enhancements (2)
- AC-24(01) Transmit Access Authorization Information
- AC-24(02) No User or Process Identity
Each enhancement's statement: /api/v1/controls/AC-24?fields=enhancements

## Patterns that use it (2)
- Important (2): SP-044 SaaS Identity Lifecycle Management; SP-054 CBDC and Digital Currency Infrastructure (draft)

## Clauses by framework (38 frameworks)
- iso_27001_2022: A.5.15, A.8.3. OSA's own, not in NIST's crosswalk: A.5.15
- iso_27002_2022: 5.15, 8.3
- cobit_2019: DSS05
- nist_csf_2: PR.AA-05
- cis_controls_v8: CIS 6, CIS 6.7
- nis2: Art. 21(2)(i)
- mas_trm: 9
- bsi_grundschutz: ORP.4
- bio2: 5.15, 8.3
- rbi_csf: Annex1.8, ITGRCA.19
- fisc: FISC.T2
- hkma_tme1: TME1.8.1
- mlps_2: 8.1.4.2
- cbb_tm: TM-6
- cbuae: CR-4
- nca_ecc: 2-2
- qatar_nia: AC
- sama_csf: 3.1
- uae_ia: T9
- bom_ctrm: 3.3
- cbe_csf: CTO-1
- cbn_csf: Part3.2
- sa_js2: JS2-7.1
- bot_cyber: Ch2.2
- eba_ict: 3.4.2
- ecb_croe: CROE.2.3.1
- ffiec_is: II.C.7(b), II.C.15(b)
- hipaa_sr: §164.308(a)(4)(i), §164.308(a)(4)(ii)(B), §164.312(a)(1)
- iosco_cyber: PROT-1
- sebi_cscrf: PR.AA
- cmmc_2: AC
- common_criteria: CC Part 2 — FDP
- fda_21_cfr_11: §11.10(g)
- fda_cyber: SA-1
- iso_27799: 9.1
- lloyds_ms: BP2.1, MS8.3
- nhs_dspt: NDG-4.1, NDG-4.4
- pra_ss1_23: P-IT.1
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/AC-24
- Clauses only: /api/v1/controls/AC-24?fields=mappings
- Page for people: /controls/ac-24/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.