NIST 800-53 r5 · Controls catalogue · Family PS

PS-6Access Agreements

Develop and document access agreements for organizational systems; Review and update the access agreements {{ insert: param, ps-06_odp.01 }} ; and Verify that individuals requiring access to organizational information and systems: Sign appropriate access agreements prior to being granted access; and Re-sign access agreements to maintain access to organizational systems when access agreements have been updated or {{ insert: param, ps-06_odp.02 }}.

Last updated: 09 May 2026 03:25 UTC

Implementations targeting this control (0)

No implementations targeting this control yet.

ATT&CK techniques this control mitigates (0)

No ATT&CK techniques mapped to this control yet.

Weaknesses this control addresses (5)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE	Name	CVEs	Why this control addresses it
`CWE-862`	Missing Authorization	8,680	Mandating a signed agreement as a prerequisite for access implements a concrete authorization step that would otherwise be missing.
`CWE-284`	Improper Access Control	4,832	Requiring signed access agreements before any access is granted adds a mandatory procedural gate that directly prevents improper or premature access provisioning.
`CWE-863`	Incorrect Authorization	3,234	Verification that individuals have signed current agreements ensures the authorization decision is based on up-to-date, explicitly accepted rules rather than stale or absent approvals.
`CWE-285`	Improper Authorization	1,230	The control enforces explicit authorization via signed agreements and periodic re-authorization, reducing the chance that access is granted or retained without proper approval.
`CWE-250`	Execution with Unnecessary Privileges	305	Access agreements document and require acknowledgment of assigned privileges, making execution with unnecessary privileges less likely by establishing accountability and expected behavior.

Top CVEs where this control is the strongest mitigation

CVE	Risk	CVSS	EPSS	Match
No CVEs annotated to this control yet — the per-CVE backfill is in progress.

Other controls in family PS

PS-1 PS-2 PS-3 PS-4 PS-5 PS-7 PS-8 PS-9