Control index

94/409 fetchable across every Rev5 baseline

- KSI onlyAC-01 — Policy and Procedures
- recipe · 1 recipeAC-02 — Account Management
- KSI onlyAC-02 (01) — Automated System Account Management
- recipe · 1 recipeAC-02 (02) — Automated Temporary and Emergency Account Management
- recipe · 1 recipeAC-02 (03) — Disable Accounts
- recipe · 1 recipeAC-02 (04) — Automated Audit Actions
- KSI onlyAC-02 (05) — Inactivity Logout
- orphanAC-02 (07) — Privileged User Accounts — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-02 (09) — Restrictions on Use of Shared and Group Accounts — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-02 (11) — Usage Conditions — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-02 (12) — Account Monitoring for Atypical Usage — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeAC-02 (13) — Disable Accounts for High-risk Individuals
- recipe · 2 recipesAC-03 — Access Enforcement
- KSI onlyAC-04 — Information Flow Enforcement
- orphanAC-04 (04) — Flow Control of Encrypted Information — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-04 (21) — Physical or Logical Separation of Information Flows — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyAC-05 — Separation of Duties
- recipe · 2 recipesAC-06 — Least Privilege
- recipe · 1 recipeAC-06 (01) — Authorize Access to Security Functions
- KSI onlyAC-06 (02) — Non-privileged Access for Nonsecurity Functions
- orphanAC-06 (03) — Network Access to Privileged Commands — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeAC-06 (05) — Privileged Accounts
- recipe · 1 recipeAC-06 (07) — Review of User Privileges
- orphanAC-06 (08) — Privilege Levels for Code Execution — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyAC-06 (09) — Log Use of Privileged Functions
- KSI onlyAC-06 (10) — Prohibit Non-privileged Users from Executing Privileged Functions
- recipe · 1 recipeAC-07 — Unsuccessful Logon Attempts
- orphanAC-08 — System Use Notification — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-10 — Concurrent Session Control — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-11 — Device Lock — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-11 (01) — Pattern-hiding Displays — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyAC-12 — Session Termination
- KSI onlyAC-14 — Permitted Actions Without Identification or Authentication
- recipe · 1 recipeAC-17 — Remote Access
- recipe · 1 recipeAC-17 (01) — Monitoring and Control
- recipe · 1 recipeAC-17 (02) — Protection of Confidentiality and Integrity Using Encryption
- recipe · 1 recipeAC-17 (03) — Managed Access Control Points
- orphanAC-17 (04) — Privileged Commands and Access — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-18 — Wireless Access — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyAC-18 (01) — Authentication and Encryption
- KSI onlyAC-18 (03) — Disable Wireless Networking
- orphanAC-18 (04) — Restrict Configurations by Users — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-18 (05) — Antennas and Transmission Power Levels — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-19 — Access Control for Mobile Devices — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-19 (05) — Full Device or Container-based Encryption — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeAC-20 — Use of External Systems
- KSI onlyAC-20 (01) — Limits on Authorized Use
- orphanAC-20 (02) — Portable Storage Devices — Restricted Use — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-21 — Information Sharing — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-22 — Publicly Accessible Content — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- reached, in no baseline
  - KSI onlyAC-02 (06) — Dynamic Privilege Management
- All AC in the catalog

209 of these have a page: a control no indicator reaches is hollow, and hollow rows are listed rather than linked.

AC-20 Use of External Systemsac-20

Whether an AWS call fetches evidence for this control, and what to run. Its Rev5 baselines, the indicators that reach it and the FedRAMP guidance attached to it open below.

Partial1 of 1 recipe reaches AC-20, and none is rated full — the output narrows the question, a human judgement closes it.

AWS Config · AWS IAM Access Analyzer · AWS Organizations1 recipe · 4 calls

The calls

Collect evidence (1)

Authored AWS recipes whose output is evidence for AC-20. This mapping is this project’s opinion (overlay v3.0.0), versioned separately from the dataset — the upstream FedRAMP rules name none of these tools.

partialThe machine-generated inventory of every resource an external entity can reach — IAM Access Analyzer's active ExternalAccess findings — read against the declared zone of trust, so the terms-and-conditions review has a list to work from rather than a memoryquarterlycli
external-access-inventory-and-trust-boundaryAWS IAM Access Analyzer · AWS Organizations · AWS Config
AC-20 is a two-limb control and only one limb is in this output. The limb that is here: which external entities can reach organization-controlled information. Access Analyzer answers that by logic-based reasoning over resource-based policies, and every access by a principal INSIDE the zone of trust is trusted by definition, so a finding is exactly an access that crosses the boundary the organization declared. The limb that is not here: whether each of those crossings is covered by terms and conditions consistent with the trust relationship. That is an agreement — a contract, an interconnection security agreement, an authorization to connect — and no call returns it. Attach the agreement register and reconcile it finding by finding; the reconciliation, not the finding list, is the AC-20 artifact. The inventory also has a direction. Access Analyzer sees resources you share OUT. It does not see an external system your people use to process organization information — a SaaS tool reached from a workstation leaves no resource policy in your account and produces no finding. That half of AC-20 has to come from your own third-party register, and inventing a join between the two would make the coverage claim wider than the evidence. Three scope facts worth pinning down before the count is quoted. External-access analysis is REGIONAL: an analyzer evaluates only resources in the Region where it is enabled, so one analyzer per Region in use, or the inventory is silently partial. Fifteen resource types are analyzed for external access — S3 buckets and directory buckets, IAM roles, KMS keys, Lambda functions and layers, SQS queues, Secrets Manager secrets, SNS topics, EBS volume snapshots, RDS DB and DB cluster snapshots, ECR repositories, EFS file systems, DynamoDB streams and tables — and a resource type outside that list is not covered by the analyzer at all. And findings refresh within about 30 minutes of a policy change but can lag up to 24 hours when a change notification is missed, so a finding list is a recent state, not a live one.

What NIST requires of AC-20

The control statement from NIST 800-53 Rev5, verbatim. Square brackets are organization-defined parameters — yours to set, not FedRAMP's to dictate.

a. [assignment], consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to: 1. Access the system from external systems; and 2. Process, store, or transmit organization-controlled information using external systems; or b. Prohibit the use of [prohibited types of external systems].

NIST SP 800-53 Rev5 catalog 5.2.0, from usnistgov/oscal-content at 78650f0. The FedRAMP dataset carries no control text; this is borrowed and pinned.

Rev5 baseline membership

Membership is the whole relationship — a baseline is a set of control ids. Class A carries no baseline at all. The Low/Moderate/High labels are an interpretation from control counts, not a dataset fact.

Class Bour reading: Rev5 Low

in baseline

Class B readiness

Class Cour reading: Rev5 Moderate

in baseline

Class C readiness

Class Dour reading: Rev5 High

in baseline

Class D readiness

KSI indicators reaching this control (3)

Under 20x, these indicators are how this control is demonstrated — automated KSI evidence stands in for narrative control evidence.

FedRAMP guidance & parameters

Where you read the rule. Guidance names an FRR document, never a clause, so the links below offer the whole document and leave the reading to you.

The interrelated controls of AC-20, CA-3, and SA-9 should be differentiated as follows:
AC-20 describes system access to and from external systems.
CA-3 describes documentation of an agreement between the respective system owners when data is exchanged between the CSO and an external system.
SA-9 describes the responsibilities of external system owners. These responsibilities would typically be captured in the agreement required by CA-3.

Pages exist for the 209 controls reached by at least one KSI. Baseline-only controls are the orphans on /coverage. Control titles and full text live in the NIST catalog, not this dataset.

Keyboard shortcuts

Go

Move

Act

Control index

AC-20 Use of External Systemsac-20

Collect evidence (1)

What NIST requires of AC-20

Rev5 baseline membership

KSI indicators reaching this control (3)

FedRAMP guidance & parameters