NIST 800-53 REV 5 • ACCESS CONTROL
AC-3(7) — Role-based Access Control
Enforce a role-based access control policy over defined subjects and objects and control access based upon {{ insert: param, ac-3.7_prm_1 }}.
CMMC Practice Mapping
No direct CMMC mapping
NIST 800-171 Mapping
No direct NIST 800-171 mapping
Related Controls
No related controls listed
Supplemental Guidance
Role-based access control (RBAC) is an access control policy that enforces access to objects and system functions based on the defined role (i.e., job function) of the subject. Organizations can create specific roles based on job functions and the authorizations (i.e., privileges) to perform needed operations on the systems associated with the organization-defined roles. When users are assigned to specific roles, they inherit the authorizations or privileges defined for those roles. RBAC simplifies privilege administration for organizations because privileges are not assigned directly to every user (which can be a large number of individuals) but are instead acquired through role assignments. RBAC can also increase privacy and security risk if individuals assigned to a role are given access to information beyond what they need to support organizational missions or business functions. RBAC can be implemented as a mandatory or discretionary form of access control. For organizations implementing RBAC with mandatory access controls, the requirements in [AC-3(3)](#ac-3.3) define the scope of the subjects and objects covered by the policy.
Practitioner Notes
Role-Based Access Control (RBAC) assigns permissions to roles, and users get roles — not direct permissions. This makes management much simpler because when someone changes jobs, you just change their role instead of fixing fifty individual permissions.
Example 1: In Active Directory, create role-based security groups like Role-Finance-Analyst, Role-HR-Manager, Role-IT-HelpDesk. Assign all file share, application, and system permissions to these role groups. When someone transfers departments, remove them from the old role group and add them to the new one.
Example 2: In Azure, use built-in RBAC roles under Subscriptions → Access Control (IAM). Assign Reader to auditors, Contributor to developers, and Owner only to your cloud infrastructure lead. Avoid the Owner role at the management group level — scope permissions as tightly as possible.