--- title: "NIST 800-171 3.1 Access Control" description: "The 22 NIST SP 800-171 Access Control requirements (3.1, CMMC AC): text, SPRS points, POA&M rules and evidence." url: https://policycortex.com/nist-800-171/access-control sealed: 2026-11-11 amended: 2026-11-11 register: nist-800-171/access-control records: 4 digest: sha3:8cb7fff504106bc90900dd36de604af212527be33c6c8e835b56a9c788ef6878 --- # NIST 800-171 3.1 Access Control NIST 800-171 / Access Control Access Control is the largest family: who and what can reach the system, what they may do once inside, and how remote, wireless and mobile access is held to the same rules. Its requirements cover accounts, privileges, sessions and connections to outside systems. 22 requirements · up to 54 SPRS points · 11 can go on a CMMC POA&M ## The 22 Access Control requirements | Requirement | CMMC practice | SPRS points | Requirement text | |---|---|---|---| | [3.1.1 Authorized Access](https://policycortex.com/nist-800-171/access-control/3.1.1) | AC.L2-3.1.1 | 5 points | Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems). | | [3.1.2 Transaction Control](https://policycortex.com/nist-800-171/access-control/3.1.2) | AC.L2-3.1.2 | 5 points | Limit system access to the types of transactions and functions that authorized users are permitted to execute. | | [3.1.3 CUI Flow Control](https://policycortex.com/nist-800-171/access-control/3.1.3) | AC.L2-3.1.3 | 1 point | Control the flow of CUI in accordance with approved authorizations. | | [3.1.4 Separation of Duties](https://policycortex.com/nist-800-171/access-control/3.1.4) | AC.L2-3.1.4 | 1 point | Separate the duties of individuals to reduce the risk of malevolent activity without collusion. | | [3.1.5 Least Privilege](https://policycortex.com/nist-800-171/access-control/3.1.5) | AC.L2-3.1.5 | 3 points | Employ the principle of least privilege, including for specific security functions and privileged accounts. | | [3.1.6 Non-Privileged Accounts](https://policycortex.com/nist-800-171/access-control/3.1.6) | AC.L2-3.1.6 | 1 point | Use non-privileged accounts or roles when accessing nonsecurity functions. | | [3.1.7 Privileged Functions](https://policycortex.com/nist-800-171/access-control/3.1.7) | AC.L2-3.1.7 | 1 point | Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. | | [3.1.8 Unsuccessful Logons](https://policycortex.com/nist-800-171/access-control/3.1.8) | AC.L2-3.1.8 | 1 point | Limit unsuccessful logon attempts. | | [3.1.9 System Use Notices](https://policycortex.com/nist-800-171/access-control/3.1.9) | AC.L2-3.1.9 | 1 point | Provide privacy and security notices consistent with applicable CUI rules. | | [3.1.10 Session Lock](https://policycortex.com/nist-800-171/access-control/3.1.10) | AC.L2-3.1.10 | 1 point | Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity. | | [3.1.11 Session Termination](https://policycortex.com/nist-800-171/access-control/3.1.11) | AC.L2-3.1.11 | 1 point | Terminate (automatically) a user session after a defined condition. | | [3.1.12 Remote Access Control](https://policycortex.com/nist-800-171/access-control/3.1.12) | AC.L2-3.1.12 | 5 points | Monitor and control remote access sessions. | | [3.1.13 Remote Access Encryption](https://policycortex.com/nist-800-171/access-control/3.1.13) | AC.L2-3.1.13 | 5 points | Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. | | [3.1.14 Remote Access Routing](https://policycortex.com/nist-800-171/access-control/3.1.14) | AC.L2-3.1.14 | 1 point | Route remote access via managed access control points. | | [3.1.15 Privileged Remote Access](https://policycortex.com/nist-800-171/access-control/3.1.15) | AC.L2-3.1.15 | 1 point | Authorize remote execution of privileged commands and remote access to security-relevant information. | | [3.1.16 Wireless Authorization](https://policycortex.com/nist-800-171/access-control/3.1.16) | AC.L2-3.1.16 | 5 points | Authorize wireless access prior to allowing such connections. | | [3.1.17 Wireless Protection](https://policycortex.com/nist-800-171/access-control/3.1.17) | AC.L2-3.1.17 | 5 points | Protect wireless access using authentication and encryption. | | [3.1.18 Mobile Device Connection](https://policycortex.com/nist-800-171/access-control/3.1.18) | AC.L2-3.1.18 | 5 points | Control connection of mobile devices. | | [3.1.19 Encrypt CUI on Mobile](https://policycortex.com/nist-800-171/access-control/3.1.19) | AC.L2-3.1.19 | 3 points | Encrypt CUI on mobile devices and mobile computing platforms. | | [3.1.20 External Connections](https://policycortex.com/nist-800-171/access-control/3.1.20) | AC.L2-3.1.20 | 1 point | Verify and control/limit connections to and use of external systems. | | [3.1.21 Portable Storage Use](https://policycortex.com/nist-800-171/access-control/3.1.21) | AC.L2-3.1.21 | 1 point | Limit use of portable storage devices on external systems. | | [3.1.22 Public Information](https://policycortex.com/nist-800-171/access-control/3.1.22) | AC.L2-3.1.22 | 1 point | Control CUI posted or processed on publicly accessible systems. | ## Access Control: points and the CMMC POA&M **Q: How many SPRS points can the Access Control family cost?** A: Up to 54 of the 313 points a score can lose: 7 worth 5 points, 2 worth 3 and 13 worth 1. **Q: Which Access Control requirements can go on a CMMC POA&M?** A: 11 of the 22: 3.1.3, 3.1.4, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.1.10, 3.1.11, 3.1.14, 3.1.15 and 3.1.21, worth 1 point each. 3.1.20 and 3.1.22 are never allowed, whatever the value (32 CFR 170.21(a)(2)(iii)). The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88. ## Related pages - **Calculator**: [SPRS score calculator: mark the Access Control requirements and see what they cost.](https://policycortex.com/sprs-score-calculator#family-AC) - **Sample package**: [Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.](https://policycortex.com/sample-package) - **Next family**: [3.2 Awareness and Training](https://policycortex.com/nist-800-171/awareness-and-training) - **All requirements**: [All 110 NIST SP 800-171 requirements, by family.](https://policycortex.com/nist-800-171) Know the family. Keep the evidence for every requirement in it. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book) ## Register colophon | Seq | Label | SHA3-256 | Prev | |---|---|---|---| | REC 0000 | FAMILY | 4a52240fa707 | 2ed6c2558c1d | | REC 0001 | REQUIREMENTS | cf8fee81bb7a | 4a52240fa707 | | REC 0002 | POINTS AND POA&M | 75ae753c324b | cf8fee81bb7a | | REC 0003 | RELATED | 8cb7fff50410 | 75ae753c324b | Head sha3:8cb7fff504106bc90900dd36de604af212527be33c6c8e835b56a9c788ef6878. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.