AC.L1-b.1.i
Authorized Access Control [FCI Data]
Source and approval
CMMC Assessment Guide — Level 1 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L1-b.1.i in the reference catalog with its NIST cross-references
Official requirement
Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
Assessment objectives
a. authorized users are identified;
b. processes acting on behalf of authorized users are identified;
c. devices (and other systems) authorized to connect to the system are identified;
d. system access is limited to authorized users;
e. system access is limited to processes acting on behalf of authorized users; and
f. system access is limited to authorized devices (including other systems).
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Keep an approved list of people, automated processes, and devices that can access the system, and enforce it.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Your company maintains a list of all personnel authorized to use company information systems [a]. This list is used to support identification and authentication activities conducted by IT when authorizing access to systems [a,d]. Example 2 A coworker wants to buy a new multi- function printer/scanner/fax device and make it available on the company network. You explain that the company controls system and device access to the network, and will prevent network access by unauthorized systems and devices [c]. You help the coworker submit a ticket that asks for the printer to be granted access to the network, and appropriate leadership approves the device [f].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing account management; system security plan45; system design documentation; system configuration settings and associated documentation; list of active system accounts and the name of the individual associated with each account; notifications or records of recently transferred, separated, or terminated employees; list of conditions for group and role membership; list of recently disabled system accounts along with the name of the individual associated with each account; access authorization records; account management compliance reviews; system monitoring records; system audit logs and records; list of devices and systems authorized to connect to organizational systems; other relevant documents or records
Common mistakes
Listing employees but overlooking service accounts, connected devices, or prompt removal of access.