[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fac-3":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ac-3","AC-3","Access Enforcement",790,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Systems must enforce approved authorisations for logical access to information and resources, in line with the applicable access control policies.\n\n**In practice.** This is the technical layer that makes access decisions real: permissions in directories, file systems, databases, applications and cloud platforms that match what was approved. Good implementations use central, role or attribute-based models and avoid hard-coded or ad hoc permissions. Evidence includes access control configuration, test results showing users cannot reach data outside their role, and alignment between approved access requests and actual permissions.\n\n**Common gaps.** Organisations often approve access in one place but configure it elsewhere, so what is enforced drifts from what was approved. Broken access control in custom web applications, a leading OWASP Top 10 category, is a frequent and serious gap.","Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.\nDiscussion: Access control policies control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (i.e., devices, files, records, domains) in organizational systems. In addition to enforcing authorized access at the system level and recognizing that systems can host many applications and services in support of mission and business functions, access enforcement mechanisms can also be employed at the application and service level to provide increased information security and privacy. In contrast to logical access controls that are implemented within the system, physical access controls are addressed by the controls in the Physical and Environmental Protection ( [PE](#pe) ) family.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"spanish-cycling-federation-fined-4800-after-two-month-data-breach-exposing-261965-records","Spanish Cycling Federation Fined €4,800 After Two-Month Data Breach Exposing 261,965 Records","2026-10-16T16:20:43.825+00:00",{"slug":25,"title":26,"published_at":27},"burger-king-japan-breach-exposes-11m-app-users-personal-data","Burger King Japan Breach Exposes 11M App Users' Personal Data","2026-10-16T15:20:48.695+00:00",{"slug":29,"title":30,"published_at":31},"burger-king-japan-app-breach-exposes-11m-member-records","Burger King Japan App Breach Exposes 11M Member Records","2026-10-16T12:21:23.341+00:00",{"slug":33,"title":34,"published_at":35},"critical-rce-flaws-in-f5-nginx-and-juniper-junos-os-demand-immediate-patching","Critical RCE Flaws in F5 NGINX and Juniper Junos OS Demand Immediate Patching","2026-10-16T10:20:14.366+00:00",{"slug":37,"title":38,"published_at":39},"path-traversal-flaw-in-thermo-fisher-torrent-suite-exposes-sensitive-files","Path Traversal Flaw in Thermo Fisher Torrent Suite Exposes Sensitive Files","2026-10-15T18:21:22.798+00:00",{"slug":41,"title":42,"published_at":43},"uk-legal-aid-agency-breach-exposes-47-years-of-sensitive-records","UK Legal Aid Agency Breach Exposes 47 Years of Sensitive Records","2026-10-15T16:20:35.876+00:00",{"slug":45,"title":46,"published_at":47},"vibetech-exposes-137m-records-in-unsecured-database","Vibetech Exposes 13.7M Records in Unsecured Database","2026-10-15T16:20:19.435+00:00",{"slug":49,"title":50,"published_at":51},"android-rat-hirudo-swaps-legitimate-banking-apps-with-trojanized-clones","Android RAT 'Hirudo' Swaps Legitimate Banking Apps with Trojanized Clones","2026-10-15T12:21:08.907+00:00",{"slug":53,"title":54,"published_at":55},"centerpoint-energy-breach-exposes-1m-texans-pii-via-cybercrime-forum-disclosure","CenterPoint Energy Breach Exposes 1M+ Texans' PII via Cybercrime Forum Disclosure","2026-10-15T10:20:22.506+00:00",{"slug":57,"title":58,"published_at":59},"ai-coding-agents-need-zero-trust-security-boundaries-to-prevent-production-disasters","AI Coding Agents Need Zero-Trust Security Boundaries to Prevent Production Disasters","2026-10-13T22:21:43.666+00:00",{"slug":61,"title":62,"published_at":63},"docker-hub-flaw-allowed-cross-user-image-manipulation-for-over-two-years","Docker Hub Flaw Allowed Cross-User Image Manipulation for Over Two Years","2026-10-13T20:21:33.66+00:00",{"slug":65,"title":66,"published_at":67},"swann-security-cameras-expose-live-feeds-due-to-missing-authentication","Swann Security Cameras Expose Live Feeds Due to Missing Authentication","2026-10-13T16:22:01.797+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"patch-management","Automated patch management","Known holes get closed in days, not months.",204,{"slug":75,"name":76,"problem":77,"stories":78},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",203,{"slug":80,"name":81,"problem":82,"stories":83},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",194,{"slug":85,"name":86,"problem":87,"stories":88},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",151,{"slug":90,"name":91,"problem":92,"stories":93},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",103,{"slug":95,"name":96,"problem":97,"stories":98},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",98,[100,106,112,117,122,127,132,137],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","6","Control 6","Access Control Management",351,{"family":107,"item":108,"code":109,"title":110,"together":111},"gdpr","32","Article 32","Security of processing",331,{"family":101,"item":113,"code":114,"title":115,"together":116},"3","Control 3","Data Protection",277,{"family":101,"item":118,"code":119,"title":120,"together":121},"7","Control 7","Continuous Vulnerability Management",260,{"family":5,"item":123,"code":124,"title":125,"together":126},"ac-2","AC-2","Account Management",239,{"family":101,"item":128,"code":129,"title":130,"together":131},"12","Control 12","Network Infrastructure Management",235,{"family":5,"item":133,"code":134,"title":135,"together":136},"si-2","SI-2","Flaw Remediation",226,{"family":138,"item":139,"code":140,"title":140,"together":141},"itil","overview","ITIL",221]