AC-2 · Access Control · NIST SP 800-53 Rev5
AC-2: Accounts are provisioned, reviewed, and de-provisioned through a managed lifecycle
How NIST SP 800-53 Rev5 control AC-2 (Access Control) maps to FedRAMP 20x Key Security Indicators, and the evidence scm.cc collects for it.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
What AC-2 requires
Accounts are provisioned, reviewed, and de-provisioned through a managed lifecycle.
Paraphrased from NIST SP 800-53 Rev. 5 — Security and Privacy Controls for Information Systems and Organizations (checked 2026-10-31). scm.cc does not reproduce the official control text; read the NIST catalog for the normative wording.
FedRAMP 20x KSIs that cover AC-2
These Key Security Indicators officially cite AC-2 as a related SP 800-53 control, so satisfying them is how a 20x package demonstrates this control.
KSI-IAM-AAM — Automating Account Management
Identity and Access Management · official related-control citation: ac-2.13, ac-2.2, ac-2.3
KSI-IAM-APM — Adopting Passwordless Methods
Identity and Access Management · official related-control citation: ac-2
KSI-IAM-ELP — Ensuring Least Privilege
Identity and Access Management · official related-control citation: ac-2.11, ac-2.5, ac-2.6, ac-2.7, ac-2.9
KSI-IAM-JIT — Authorizing Just-in-Time
Identity and Access Management · official related-control citation: ac-2, ac-2.1, ac-2.11, ac-2.2, ac-2.3, ac-2.4, ac-2.6, ac-2.7
KSI-IAM-SNU — Securing Non-User Authentication
Identity and Access Management · official related-control citation: ac-2, ac-2.2, ac-2.9
KSI-IAM-SUS — Responding to Suspicious Activity
Identity and Access Management · official related-control citation: ac-2, ac-2.1, ac-2.11, ac-2.12, ac-2.13, ac-2.3
KSI-MLA-LET — Logging Event Types
Monitoring, Logging, and Auditing · official related-control citation: ac-2.4
KSI-MLA-RVL — Reviewing Logs
Monitoring, Logging, and Auditing · official related-control citation: ac-2.4
KSI-SVC-ACM — Automating Configuration Management
Service Configuration · official related-control citation: ac-2.4
Evidence scm.cc collects for AC-2
scm.cc tracks this as manual evidence you attach; it validates and replays exactly what you provide (no automated claim beyond that).