AC.1.001 — Limit System Access to Authorized Users

CMMC Level 1SPRS if unmet: -5CRITICAL priority~8h to implement

Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).

What AC.1.001 means in plain English

Only people who are supposed to have access to your computer systems and files can actually get in. If someone leaves your shop, their login should be turned off immediately. Your computers should require a username and password to log in — no shared accounts, and no leaving machines unlocked for anyone to walk up and use.

The assessment question

“Do all users have individual accounts with unique usernames and passwords to access computers and systems that store or process government contract information, and are accounts promptly disabled when employees leave or change roles?”

How to implement AC.1.001

Enable Windows user accounts on every computer: go to Settings > Accounts > Family & other users, create a named account for each employee, and set a strong password requirement.
Disable or delete accounts within 24 hours of an employee departing: maintain a simple offboarding checklist that includes "disable Windows account" and "remove from Microsoft 365".
If using Microsoft 365 GCC, review active users at admin.microsoft.com monthly and remove any accounts that are no longer needed.
Ensure no shared "shop" or "generic" accounts exist — every user must log in with their own credentials so activity can be traced back to an individual.
Enable screen lock via Group Policy or Windows Settings so computers lock automatically after 15 minutes of inactivity, requiring a password to return.

Evidence your assessor will ask for

Screenshot or export of all active user accounts on each system
Written user access policy or procedure stating accounts are individual and reviewed
Sample of offboarding checklist showing account-disable step
Evidence of disabled/deleted accounts for departed employees (admin logs or screenshots)
Screen lock policy configuration (Group Policy screenshot or Windows Settings photo)

Does AI prompt monitoring help with this control? Honestly, no.

AC.1.001 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Access Control controls

AC.1.002

Limit System Access to Authorized Transaction Types

AC.2.003

Control CUI Flow per Authorizations

AC.2.004

Separate Duties to Reduce Risk

AC.2.005

Employ Least Privilege

AC.2.006

Use Non-Privileged Accounts for Non-Security Functions

AC.2.007

Prevent Non-Privileged Users from Executing Privileged Functions

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment

NIST 800-171 Controls · Access Control