NIST 800-53 r5 · Controls catalogue · Family PS

PS-6Access Agreements

Develop and document access agreements for organizational systems; Review and update the access agreements {{ insert: param, ps-06_odp.01 }} ; and Verify that individuals requiring access to organizational information and systems: Sign appropriate access agreements prior to being granted access; and Re-sign access agreements to maintain access to organizational systems when access agreements have been updated or {{ insert: param, ps-06_odp.02 }}.

Last updated: 22 August 2026 07:11 UTC

Implementations targeting this control (0)

No implementations targeting this control yet.

ATT&CK techniques this control mitigates (0)

No ATT&CK techniques mapped to this control yet.

Weaknesses this control addresses (5)AI-assisted

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE	Name	CVEs	Why this control addresses it
`CWE-862`	Missing Authorization	10,200+	Mandating a signed agreement as a prerequisite for access implements a concrete authorization step that would otherwise be missing.
`CWE-284`	Improper Access Control	6,900+	Requiring signed access agreements before any access is granted adds a mandatory procedural gate that directly prevents improper or premature access provisioning.
`CWE-863`	Incorrect Authorization	3,900+	Verification that individuals have signed current agreements ensures the authorization decision is based on up-to-date, explicitly accepted rules rather than stale or absent approvals.
`CWE-285`	Improper Authorization	1,500+	The control enforces explicit authorization via signed agreements and periodic re-authorization, reducing the chance that access is granted or retained without proper approval.
`CWE-250`	Execution with Unnecessary Privileges	300+	Access agreements document and require acknowledgment of assigned privileges, making execution with unnecessary privileges less likely by establishing accountability and expected behavior.

Top CVEs where this control is the strongest mitigation

CVE	Risk	CVSS	EPSS	Match
No CVEs annotated to this control yet — the per-CVE backfill is in progress.

Other controls in family PS

PS-1 PS-2 PS-3 PS-4 PS-5 PS-7 PS-8 PS-9