AC.1.002 — Limit System Access to Authorized Transaction Types

CMMC Level 1SPRS if unmet: -5CRITICAL priority~10h to implement

Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

What AC.1.002 means in plain English

Just because someone has a login doesn't mean they should be able to do everything on your systems. Your shop floor worker doesn't need access to accounting files. Your bookkeeper doesn't need to install software. Give people access only to the folders and programs they actually need to do their job — nothing more.

The assessment question

“Are user accounts restricted so each person can only access the files, folders, and applications they need for their specific job role — for example, production workers cannot access contract finance files, and regular employees cannot install software?”

How to implement AC.1.002

Audit current folder permissions on shared drives or file servers: right-click any shared folder > Properties > Security tab, and verify that only the appropriate people or groups have Read/Write access.
Create Windows user groups by role (e.g., "Shop Floor", "Office Admin", "Management") and assign folder permissions to groups rather than individuals so changes are easier to manage.
In Microsoft 365 SharePoint or OneDrive, set site and folder sharing permissions so CUI contract documents are only accessible to staff who work with those contracts.
Remove standard users from the local "Administrators" group on their computers: go to Settings > Accounts > Your Account and confirm they are set as "Standard User" not "Administrator".
Document each role's approved access in a simple spreadsheet: employee name, role, systems they can access, and date last reviewed.

Evidence your assessor will ask for

Screenshot of folder permission settings on shared drives showing role-based access
List of user roles and their approved access levels (access matrix)
Confirmation that standard users do not have local administrator rights (screenshot)
SharePoint or OneDrive sharing permission screenshots for CUI document libraries
Written Access Control Policy defining permitted transaction types by role

Does AI prompt monitoring help with this control? Honestly, no.

AC.1.002 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Access Control controls

AC.1.001

Limit System Access to Authorized Users

AC.2.003

Control CUI Flow per Authorizations

AC.2.004

Separate Duties to Reduce Risk

AC.2.005

Employ Least Privilege

AC.2.006

Use Non-Privileged Accounts for Non-Security Functions

AC.2.007

Prevent Non-Privileged Users from Executing Privileged Functions

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment

NIST 800-171 Controls · Access Control