[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fac-20":3},{"item":4,"lessons":18,"controls":68,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ac-20","AC-20","Use of External Systems",38,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must set terms and conditions, or identify controls that external systems must have, before authorised individuals may use external systems to access organisational systems or to process, store or transmit organisational information, and it may prohibit certain external systems.\n\n**In practice.** External systems include personal devices, partner systems and public cloud services not owned by the organisation. Good practice is a clear policy on personal device use and approved external services, enforced through device compliance checks, conditional access and data protection controls. Auditors expect the policy, conditional access configurations and agreements with partners whose systems connect.\n\n**Common gaps.** Unmanaged personal devices with full access to email and files are common. Use of unsanctioned cloud services for work data often goes unnoticed.","a. [Selection: establish {{ insert: param, ac-20_odp.02 }} ; identify {{ insert: param, ac-20_odp.03 }} ] , consistent with the trust relationships established with other organizations owning, operating, and\u002For maintaining external systems, allowing authorized individuals to:\n    1. Access the system from external systems; and\n    2. Process, store, or transmit organization-controlled information using external systems; or\n  b. Prohibit the use of [Assignment: organization-defined prohibited types of external systems].\nDiscussion: External systems are systems that are used by but not part of organizational systems, and for which the organization has no direct control over the implementation of required controls or the assessment of control effectiveness. External systems include personally owned systems, components, or devices; privately owned computing and communications devices in commercial or public facilities; systems owned or controlled by nonfederal organizations; systems managed by contractors; and federal information systems that are not owned by, operated by, or under the direct supervision or authority of the organization. External systems also include systems owned or operated by other components within the same organization and systems within the organization with different authorization boundaries. Organizations have the option to prohibit the use of any type of external system or prohibit the use of specified types of external systems, (e.g., prohibit the use of any external system that is not organizationally owned or prohibit the use of personally-owned systems).\n\nFor some external systems (i.e., systems operated by other organizations), the trust relationships that have been established between those organizations and the originating organization may be such that no explicit terms and conditions are required. Systems within these organizations may not be considered external. These situations occur when, for example, there are pre-existing information exchange agreements (either implicit or explicit) established between organizations or components or when such agreements are specified by applicable laws, executive orders, directives, regulations, policies, or standards. Authorized individuals include organizational personnel, contractors, or other individuals with authorized access to organizational systems and over which organizations have the authority to impose specific rules of behavior regarding system access. Restrictions that organizations impose on authorized individuals need not be uniform, as the restrictions may vary depending on trust relationships between organizations. Therefore, organizations may choose to impose different security restrictions on contractors than on state, local, or tribal governments.\n\nExternal systems used to access public interfaces to organizational systems are outside the scope of [AC-20](#ac-20) . Organizations establish specific terms and conditions for the use of external systems in accordance with organizational security policies and procedures. At a minimum, terms and conditions address the specific types of applications that can be accessed on organizational systems from external systems and the highest security category of information that can be processed, stored, or transmitted on external systems. If the terms and conditions with the owners of the external systems cannot be established, organizations may impose restrictions on organizational personnel using those external systems.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"norway-fines-xandr-for-unlawful-personal-data-processing-tied-to-grindr","Norway Fines Xandr for Unlawful Personal Data Processing Tied to Grindr","2026-10-14T14:21:53.44+00:00",{"slug":25,"title":26,"published_at":27},"finnish-healthcare-provider-fined-33k-for-leaking-therapy-data-to-google-meta-microsoft","Finnish Healthcare Provider Fined €33K for Leaking Therapy Data to Google, Meta & Microsoft","2026-10-12T14:21:55.533+00:00",{"slug":29,"title":30,"published_at":31},"byod-devices-used-as-launchpad-to-compromise-microsoft-365-via-graph-api","BYOD Devices Used as Launchpad to Compromise Microsoft 365 via Graph API","2026-09-10T22:20:40.873+00:00",{"slug":33,"title":34,"published_at":35},"xinbi-guarantee-takedown-highlights-crypto-scam-ecosystem-risks","Xinbi Guarantee Takedown Highlights Crypto Scam Ecosystem Risks","2026-09-09T20:20:39.464+00:00",{"slug":37,"title":38,"published_at":39},"china-systematically-extracting-us-frontier-ai-capabilities-via-model-distillation","China Systematically Extracting US Frontier AI Capabilities via Model Distillation","2026-09-09T14:21:02.634+00:00",{"slug":41,"title":42,"published_at":43},"shadow-ai-power-users-create-outsized-data-leakage-risk","Shadow AI Power Users Create Outsized Data Leakage Risk","2026-08-24T14:22:08.555+00:00",{"slug":45,"title":46,"published_at":47},"shadow-ai-exposes-employee-data-to-chatgpt-and-claude","Shadow AI Exposes Employee Data to ChatGPT and Claude","2026-08-18T12:21:13.038+00:00",{"slug":49,"title":50,"published_at":51},"third-party-logistics-breach-exposes-steam-customer-data","Third-Party Logistics Breach Exposes Steam Customer Data","2026-08-10T12:20:18.672+00:00",{"slug":53,"title":54,"published_at":55},"illicit-claude-api-reseller-exposes-users-and-their-prompts-via-misconfigured-endpoint","Illicit Claude API Reseller Exposes Users and Their Prompts via Misconfigured Endpoint","2026-08-05T18:21:16.968+00:00",{"slug":57,"title":58,"published_at":59},"phaas-toolkit-bypasses-mfa-via-device-code-phishing-and-token-theft","PhaaS Toolkit Bypasses MFA via Device Code Phishing and Token Theft","2026-08-04T18:20:23.556+00:00",{"slug":61,"title":62,"published_at":63},"apt29-hijacks-hotel-wi-fi-to-deliver-fake-updates-and-steal-credentials","APT29 Hijacks Hotel Wi-Fi to Deliver Fake Updates and Steal Credentials","2026-08-01T08:20:34.539+00:00",{"slug":65,"title":66,"published_at":67},"chinese-ai-firm-accused-of-illegally-distilling-us-ai-models-via-large-scale-api-abuse","Chinese AI Firm Accused of Illegally Distilling US AI Models via Large-Scale API Abuse","2026-07-22T18:21:28.984+00:00",[69,74,79,83,88,93],{"slug":70,"name":71,"problem":72,"stories":73},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",12,{"slug":75,"name":76,"problem":77,"stories":78},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",10,{"slug":80,"name":81,"problem":82,"stories":78},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",{"slug":84,"name":85,"problem":86,"stories":87},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",6,{"slug":89,"name":90,"problem":91,"stories":92},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",5,{"slug":94,"name":95,"problem":96,"stories":92},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[98,104,108,114,119,123,127,132],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","3","Control 3","Data Protection",14,{"family":105,"item":106,"code":107,"title":107,"together":103},"itil","overview","ITIL",{"family":109,"item":110,"code":111,"title":112,"together":113},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",13,{"family":115,"item":116,"code":117,"title":118,"together":73},"gdpr","28","Article 28","Processor",{"family":99,"item":120,"code":121,"title":122,"together":73},"15","Control 15","Service Provider Management",{"family":115,"item":124,"code":125,"title":126,"together":78},"32","Article 32","Security of processing",{"family":99,"item":128,"code":129,"title":130,"together":131},"2","Control 2","Inventory and Control of Software Assets",9,{"family":99,"item":133,"code":134,"title":135,"together":136},"14","Control 14","Security Awareness and Skills Training",8]