| name | AC-3(11)_restrict-access-to-specific-information-types |
| description | Restrict access to data repositories containing [organization-defined]. |
| category | authorization |
| version | 5.2.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-53","rev5","ac-3-11","ac","enhancement"] |
| tech_stack | ["aws","azure","gcp","linux","windows"] |
| cwe_ids | ["CWE-284"] |
| chains_with | ["CM-8","CM-12","CM-13","PM-5"] |
| prerequisites | ["AC-3"] |
| severity_boost | {"CM-8":"Chain with CM-8 for comprehensive security coverage","CM-12":"Chain with CM-12 for comprehensive security coverage","CM-13":"Chain with CM-13 for comprehensive security coverage"} |
AC-3(11) Restrict Access to Specific Information Types
Enhancement of: AC-3
High-Level Description
Family: Access Control (AC)
Framework: NIST SP 800-53 Rev 5
Restricting access to specific information is intended to provide flexibility regarding access control of specific information types within a system. For example, role-based access could be employed to allow access to only a specific type of personally identifiable information within a database rather than allowing access to the database in its entirety. Other examples include restricting access to cryptographic keys, authentication information, and selected system information.
What to Check
How to Test
Step 1: Review Documentation
Examine the System Security Plan (SSP) and related artifacts for AC-3(11) implementation details. Verify the organization has documented how this control is satisfied.
Step 2: Validate Implementation
# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly
# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null
Step 3: Test Operating Effectiveness
Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.
Tools
| Tool | Purpose | Usage |
|---|
| cloud-audit-mcp | Check IAM policies and access controls | cloud_audit_iam_policies |
| hackbrowser-mcp | Test web application access controls | browser_auth_test |
Remediation Guide
Control Statement
Restrict access to data repositories containing [organization-defined].
Implementation Guidance
Restricting access to specific information is intended to provide flexibility regarding access control of specific information types within a system. For example, role-based access could be employed to allow access to only a specific type of personally identifiable information within a database rather than allowing access to the database in its entirety. Other examples include restricting access to cryptographic keys, authentication information, and selected system information.
