Of the 14 families in NIST SP 800-171, Access Control (3.1) is the largest, and Identification and Authentication (3.5) contains one of the most operationally painful requirements: multifactor authentication. Together they decide who can touch CUI and how they prove it is really them. Here is what they require in practice.
Access Control (3.1): least privilege, enforced
The theme of the Access Control family is that people and systems should have exactly the access they need and no more. In practice that means:
- Limiting system access to authorized users and the processes acting on their behalf.
- Enforcing least privilege — access matches the role, and privileged accounts are separated from everyday ones.
- Controlling the flow of CUI, including remote access and the use of mobile and personal devices.
- Recertifying access on a schedule, so accounts do not accumulate permissions no one remembers granting.
MFA (3.5.3): the one that stalls programs
Requirement 3.5.3 calls for multifactor authentication for local and network access to privileged accounts, and for network access to non-privileged accounts. In plain terms: something you know plus something you have or are. The stall is usually not the technology — it is coverage. Teams enable MFA on email and call it done, while a legacy application, a jump box, or a service account quietly accepts a password alone.
The gaps assessors find
- Partial MFA — covered on the obvious systems, missing on the ones that matter most.
- Stale access — departed employees or role changes that never triggered a review.
- Shared and service accounts with no accountability for who is actually using them.
Access control is not a product you buy once — it is a discipline you run. Get the coverage complete and the recertification routine, and this family stops being a source of findings. See how we help teams implement and operate the 800-171 controls.