Browse 1,193 controls and enhancements across 20 security and privacy families. Use the GovRAMP crosswalk to locate controls referenced by Security Snapshot, Core, and Moderate.
A shared catalog supports common-control planning; designation as a common, hybrid, or system-specific control depends on your organization’s implementation and inheritance decisions.
Sources and crosswalk scope
NIST OSCAL content 5.1.1+u4, retrieved 2026-09-18. GovRAMP Snapshot v1.4 and Core selection from Moderate v1.06 reference the December 2020 Rev. 5 text. Mappings establish exact identifier correspondence, not identical requirements, inherited implementation, or GovRAMP authorization. GovRAMP parameters and additional requirements remain authoritative for each program. Full Moderate, High, and other programs are not mapped here. Withdrawn controls are retained for reference.
Official pinned NIST sourceSHA-256: 81cf2de45ede9aef3de7ce09d65ea9d32f662c483bbf916f6e346292b22f7763
Access Control · Enhancement
AC-4(24) · Internal Normalized Format
View parent controlControl statement and discussion
NIST control statement
When transferring information between different security domains, parse incoming data into an internal normalized format and regenerate the data to be consistent with its intended specification.
Discussion
Converting data into normalized forms is one of most of effective mechanisms to stop malicious attacks and large classes of data exfiltration.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Access Control · Enhancement
AC-4(25) · Data Sanitization
View parent controlControl statement and discussion
NIST control statement
When transferring information between different security domains, sanitize data to minimize [Selection (one-or-more): delivery of malicious content, command and control of malicious code, malicious code augmentation, and steganography-encoded data; spillage of sensitive information] in accordance with [Assignment: policy].
Discussion
Data sanitization is the process of irreversibly removing or destroying data stored on a memory device (e.g., hard drives, flash memory/solid state drives, mobile devices, CDs, and DVDs) or in hard copy form.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Access Control · Enhancement
AC-4(26) · Audit Filtering Actions
View parent controlControl statement and discussion
NIST control statement
When transferring information between different security domains, record and audit content filtering actions and results for the information being filtered.
Discussion
Content filtering is the process of inspecting information as it traverses a cross-domain solution and determines if the information meets a predefined policy. Content filtering actions and the results of filtering actions are recorded for individual messages to ensure that the correct filter actions were applied. Content filter reports are used to assist in troubleshooting actions by, for example, determining why message content was modified and/or why it failed the filtering process. Audit events are defined in [AU-2](#au-2) . Audit records are generated in [AU-12](#au-12).
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Access Control · Enhancement
AC-4(27) · Redundant/Independent Filtering Mechanisms
View parent controlControl statement and discussion
NIST control statement
When transferring information between different security domains, implement content filtering solutions that provide redundant and independent filtering mechanisms for each data type.
Discussion
Content filtering is the process of inspecting information as it traverses a cross-domain solution and determines if the information meets a predefined policy. Redundant and independent content filtering eliminates a single point of failure filtering system. Independence is defined as the implementation of a content filter that uses a different code base and supporting libraries (e.g., two JPEG filters using different vendors’ JPEG libraries) and multiple, independent system processes.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Access Control · Enhancement
AC-4(28) · Linear Filter Pipelines
View parent controlControl statement and discussion
NIST control statement
When transferring information between different security domains, implement a linear content filter pipeline that is enforced with discretionary and mandatory access controls.
Discussion
Content filtering is the process of inspecting information as it traverses a cross-domain solution and determines if the information meets a predefined policy. The use of linear content filter pipelines ensures that filter processes are non-bypassable and always invoked. In general, the use of parallel filtering architectures for content filtering of a single data type introduces bypass and non-invocation issues.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Access Control · Enhancement
AC-4(29) · Filter Orchestration Engines
View parent controlControl statement and discussion
NIST control statement
When transferring information between different security domains, employ content filter orchestration engines to ensure that:
(a) Content filtering mechanisms successfully complete execution without errors; and
(b) Content filtering actions occur in the correct order and comply with [Assignment: policy].
Discussion
Content filtering is the process of inspecting information as it traverses a cross-domain solution and determines if the information meets a predefined security policy. An orchestration engine coordinates the sequencing of activities (manual and automated) in a content filtering process. Errors are defined as either anomalous actions or unexpected termination of the content filter process. This is not the same as a filter failing content due to non-compliance with policy. Content filter reports are a commonly used mechanism to ensure that expected filtering actions are completed successfully.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Access Control · Enhancement
AC-4(30) · Filter Mechanisms Using Multiple Processes
View parent controlControl statement and discussion
NIST control statement
When transferring information between different security domains, implement content filtering mechanisms using multiple processes.
Discussion
The use of multiple processes to implement content filtering mechanisms reduces the likelihood of a single point of failure.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Access Control · Enhancement
AC-4(31) · Failed Content Transfer Prevention
View parent controlControl statement and discussion
NIST control statement
When transferring information between different security domains, prevent the transfer of failed content to the receiving domain.
Discussion
Content that failed filtering checks can corrupt the system if transferred to the receiving domain.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Access Control · Enhancement
AC-4(32) · Process Requirements for Information Transfer
View parent controlControl statement and discussion
NIST control statement
When transferring information between different security domains, the process that transfers information between filter pipelines:
(a) Does not filter message content;
(b) Validates filtering metadata;
(c) Ensures the content associated with the filtering metadata has successfully completed filtering; and
(d) Transfers the content to the destination filter pipeline.
Discussion
The processes transferring information between filter pipelines have minimum complexity and functionality to provide assurance that the processes operate correctly.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Access Control · Base control
AC-5 · Separation of Duties
Control statement and discussion
NIST control statement
a. Identify and document [Assignment: duties of individuals] ; and
b. Define system access authorizations to support separation of duties.
Discussion
Separation of duties addresses the potential for abuse of authorized privileges and helps to reduce the risk of malevolent activity without collusion. Separation of duties includes dividing mission or business functions and support functions among different individuals or roles, conducting system support functions with different individuals, and ensuring that security personnel who administer access control functions do not also administer audit functions. Because separation of duty violations can span systems and application domains, organizations consider the entirety of systems and system components when developing policy on separation of duties. Separation of duties is enforced through the account management activities in [AC-2](#ac-2) , access control mechanisms in [AC-3](#ac-3) , and identity management activities in [IA-2](#ia-2), [IA-4](#ia-4) , and [IA-12](#ia-12).
GovRAMP crosswalk
- GovRAMP Moderate Readiness · AC-5 — Direct NIST identifier reference. GovRAMP source matrix
Access Control · Base control
AC-6 · Least Privilege
Control statement and discussion
NIST control statement
Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.
Discussion
Organizations employ least privilege for specific duties and systems. The principle of least privilege is also applied to system processes, ensuring that the processes have access to systems and operate at privilege levels no higher than necessary to accomplish organizational missions or business functions. Organizations consider the creation of additional processes, roles, and accounts as necessary to achieve least privilege. Organizations apply least privilege to the development, implementation, and operation of organizational systems.
GovRAMP crosswalk
- GovRAMP Security Snapshot Readiness · AC-6 — Direct NIST identifier reference. GovRAMP source matrix
- GovRAMP Core Readiness — 60 Controls · AC-6 — Direct NIST identifier reference. GovRAMP source matrix
- GovRAMP Moderate Readiness · AC-6 — Direct NIST identifier reference. GovRAMP source matrix
Access Control · Enhancement
AC-6(1) · Authorize Access to Security Functions
View parent controlControl statement and discussion
NIST control statement
Authorize access for [Assignment: individuals and roles] to:
(a) [Assignment: organization-defined security functions (deployed in hardware, software, and firmware)] ; and
(b) [Assignment: security-relevant information].
Discussion
Security functions include establishing system accounts, configuring access authorizations (i.e., permissions, privileges), configuring settings for events to be audited, and establishing intrusion detection parameters. Security-relevant information includes filtering rules for routers or firewalls, configuration parameters for security services, cryptographic key management information, and access control lists. Authorized personnel include security administrators, system administrators, system security officers, system programmers, and other privileged users.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · AC-6 (1) — Direct NIST identifier reference. GovRAMP source matrix
Access Control · Enhancement
AC-6(2) · Non-privileged Access for Nonsecurity Functions
View parent controlControl statement and discussion
NIST control statement
Require that users of system accounts (or roles) with access to [Assignment: security functions or security-relevant information] use non-privileged accounts or roles, when accessing nonsecurity functions.
Discussion
Requiring the use of non-privileged accounts when accessing nonsecurity functions limits exposure when operating from within privileged accounts or roles. The inclusion of roles addresses situations where organizations implement access control policies, such as role-based access control, and where a change of role provides the same degree of assurance in the change of access authorizations for the user and the processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account.
GovRAMP crosswalk
- GovRAMP Security Snapshot Readiness · AC-6 (2) — Direct NIST identifier reference. GovRAMP source matrix
- GovRAMP Core Readiness — 60 Controls · AC-6 (2) — Direct NIST identifier reference. GovRAMP source matrix
- GovRAMP Moderate Readiness · AC-6 (2) — Direct NIST identifier reference. GovRAMP source matrix
Access Control · Enhancement
AC-6(3) · Network Access to Privileged Commands
View parent controlControl statement and discussion
NIST control statement
Authorize network access to [Assignment: privileged commands] only for [Assignment: compelling operational needs] and document the rationale for such access in the security plan for the system.
Discussion
Network access is any access across a network connection in lieu of local access (i.e., user being physically present at the device).
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Access Control · Enhancement
AC-6(4) · Separate Processing Domains
View parent controlControl statement and discussion
NIST control statement
Provide separate processing domains to enable finer-grained allocation of user privileges.
Discussion
Providing separate processing domains for finer-grained allocation of user privileges includes using virtualization techniques to permit additional user privileges within a virtual machine while restricting privileges to other virtual machines or to the underlying physical machine, implementing separate physical domains, and employing hardware or software domain separation mechanisms.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Access Control · Enhancement
AC-6(5) · Privileged Accounts
View parent controlControl statement and discussion
NIST control statement
Restrict privileged accounts on the system to [Assignment: personnel or roles].
Discussion
Privileged accounts, including super user accounts, are typically described as system administrator for various types of commercial off-the-shelf operating systems. Restricting privileged accounts to specific personnel or roles prevents day-to-day users from accessing privileged information or privileged functions. Organizations may differentiate in the application of restricting privileged accounts between allowed privileges for local accounts and for domain accounts provided that they retain the ability to control system configurations for key parameters and as otherwise necessary to sufficiently mitigate risk.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · AC-6 (5) — Direct NIST identifier reference. GovRAMP source matrix
Access Control · Enhancement
AC-6(6) · Privileged Access by Non-organizational Users
View parent controlControl statement and discussion
NIST control statement
Prohibit privileged access to the system by non-organizational users.
Discussion
An organizational user is an employee or an individual considered by the organization to have the equivalent status of an employee. Organizational users include contractors, guest researchers, or individuals detailed from other organizations. A non-organizational user is a user who is not an organizational user. Policies and procedures for granting equivalent status of employees to individuals include a need-to-know, citizenship, and the relationship to the organization.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Access Control · Enhancement
AC-6(7) · Review of User Privileges
View parent controlControl statement and discussion
NIST control statement
(a) Review [Assignment: frequency] the privileges assigned to [Assignment: roles and classes] to validate the need for such privileges; and
(b) Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.
Discussion
The need for certain assigned user privileges may change over time to reflect changes in organizational mission and business functions, environments of operation, technologies, or threats. A periodic review of assigned user privileges is necessary to determine if the rationale for assigning such privileges remains valid. If the need cannot be revalidated, organizations take appropriate corrective actions.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · AC-6 (7) — Direct NIST identifier reference. GovRAMP source matrix
Access Control · Enhancement
AC-6(8) · Privilege Levels for Code Execution
View parent controlControl statement and discussion
NIST control statement
Prevent the following software from executing at higher privilege levels than users executing the software: [Assignment: software].
Discussion
In certain situations, software applications or programs need to execute with elevated privileges to perform required functions. However, depending on the software functionality and configuration, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking such applications or programs, those users may indirectly be provided with greater privileges than assigned.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Access Control · Enhancement
AC-6(9) · Log Use of Privileged Functions
View parent controlControl statement and discussion
NIST control statement
Log the execution of privileged functions.
Discussion
The misuse of privileged functions, either intentionally or unintentionally by authorized users or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Logging and analyzing the use of privileged functions is one way to detect such misuse and, in doing so, help mitigate the risk from insider threats and the advanced persistent threat.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · AC-6 (9) — Direct NIST identifier reference. GovRAMP source matrix
Access Control · Enhancement
AC-6(10) · Prohibit Non-privileged Users from Executing Privileged Functions
View parent controlControl statement and discussion
NIST control statement
Prevent non-privileged users from executing privileged functions.
Discussion
Privileged functions include disabling, circumventing, or altering implemented security or privacy controls, establishing system accounts, performing system integrity checks, and administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Privileged functions that require protection from non-privileged users include circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms. Preventing non-privileged users from executing privileged functions is enforced by [AC-3](#ac-3).
GovRAMP crosswalk
- GovRAMP Security Snapshot Readiness · AC-6 (10) — Direct NIST identifier reference. GovRAMP source matrix
- GovRAMP Core Readiness — 60 Controls · AC-6 (10) — Direct NIST identifier reference. GovRAMP source matrix
- GovRAMP Moderate Readiness · AC-6 (10) — Direct NIST identifier reference. GovRAMP source matrix
Access Control · Base control
AC-7 · Unsuccessful Logon Attempts
Control statement and discussion
NIST control statement
a. Enforce a limit of [Assignment: number] consecutive invalid logon attempts by a user during a [Assignment: time period] ; and
b. Automatically [Selection (one-or-more): lock the account or node for [Assignment: time period] ; lock the account or node until released by an administrator; delay next logon prompt per [Assignment: delay algorithm] ; notify system administrator; take other [Assignment: action] ] when the maximum number of unsuccessful attempts is exceeded.
Discussion
The need to limit unsuccessful logon attempts and take subsequent action when the maximum number of attempts is exceeded applies regardless of whether the logon occurs via a local or network connection. Due to the potential for denial of service, automatic lockouts initiated by systems are usually temporary and automatically release after a predetermined, organization-defined time period. If a delay algorithm is selected, organizations may employ different algorithms for different components of the system based on the capabilities of those components. Responses to unsuccessful logon attempts may be implemented at the operating system and the application levels. Organization-defined actions that may be taken when the number of allowed consecutive invalid logon attempts is exceeded include prompting the user to answer a secret question in addition to the username and password, invoking a lockdown mode with limited user capabilities (instead of full lockout), allowing users to only logon from specified Internet Protocol (IP) addresses, requiring a CAPTCHA to prevent automated attacks, or applying user profiles such as location, time of day, IP address, device, or Media Access Control (MAC) address. If automatic system lockout or execution of a delay algorithm is not implemented in support of the availability objective, organizations consider a combination of other actions to help prevent brute force attacks. In addition to the above, organizations can prompt users to respond to a secret question before the number of allowed unsuccessful logon attempts is exceeded. Automatically unlocking an account after a specified period of time is generally not permitted. However, exceptions may be required based on operational mission or need.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · AC-7 — Direct NIST identifier reference. GovRAMP source matrix
Access Control · Enhancement
AC-7(2) · Purge or Wipe Mobile Device
View parent controlControl statement and discussion
NIST control statement
Purge or wipe information from [Assignment: mobile devices] based on [Assignment: purging or wiping requirements and techniques] after [Assignment: number] consecutive, unsuccessful device logon attempts.
Discussion
A mobile device is a computing device that has a small form factor such that it can be carried by a single individual; is designed to operate without a physical connection; possesses local, non-removable or removable data storage; and includes a self-contained power source. Purging or wiping the device applies only to mobile devices for which the organization-defined number of unsuccessful logons occurs. The logon is to the mobile device, not to any one account on the device. Successful logons to accounts on mobile devices reset the unsuccessful logon count to zero. Purging or wiping may be unnecessary if the information on the device is protected with sufficiently strong encryption mechanisms.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Access Control · Enhancement
AC-7(3) · Biometric Attempt Limiting
View parent controlControl statement and discussion
NIST control statement
Limit the number of unsuccessful biometric logon attempts to [Assignment: number].
Discussion
Biometrics are probabilistic in nature. The ability to successfully authenticate can be impacted by many factors, including matching performance and presentation attack detection mechanisms. Organizations select the appropriate number of attempts for users based on organizationally-defined factors.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Access Control · Enhancement
AC-7(4) · Use of Alternate Authentication Factor
View parent controlControl statement and discussion
NIST control statement
(a) Allow the use of [Assignment: authentication factors] that are different from the primary authentication factors after the number of organization-defined consecutive invalid logon attempts have been exceeded; and
(b) Enforce a limit of [Assignment: number] consecutive invalid logon attempts through use of the alternative factors by a user during a [Assignment: time period].
Discussion
The use of alternate authentication factors supports the objective of availability and allows a user who has inadvertently been locked out to use additional authentication factors to bypass the lockout.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
