NIST SP 800-210 General Access Control Guidance for Cloud Systems
NIST's access control guidance for cloud systems: shared responsibility and the five cloud characteristics, then IaaS (network, hypervisor, VMs, APIs), PaaS (memory, APIs, replicas), SaaS (data owner control, confidentiality, privileges, tenancy, roles, federated authorisation, APIs) and collaboration between and within clouds.
NIST SP 800-210 General Access Control Guidance for Cloud Systems is a compliance framework from United States with 5 domains and 26 controls. The largest domains are Section 5: Access control guidance for SaaS – NIST SP 800-210 General Access Control Guidance for Cloud Systems (8 controls), Section 3: Access control guidance for IaaS – NIST SP 800-210 General Access Control Guidance for Cloud Systems (7 controls), Section 2: Cloud access control characteristics and shared responsibility – NIST SP 800-210 General Access Control Guidance for Cloud Systems (6 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (5)
Section 2: Cloud access control characteristics and shared responsibility – NIST SP 800-210 General Access Control Guidance for Cloud Systems
| Code | Title |
|---|---|
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::2a | Settle the shared access control responsibilities between consumer, provider and any underlying IaaS provider |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::2b | Control network access to the cloud service |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::2c | Isolate pooled resources and wipe them before reallocation |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::2d | Verify the security of newly provisioned virtual machines before they take on work |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::2e | Let consumers review but never modify their metering data |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::2f | Keep consumer data under consumer control, and flag and report any data the provider can read |
Section 3: Access control guidance for IaaS – NIST SP 800-210 General Access Control Guidance for Cloud Systems
| Code | Title |
|---|---|
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::3.1 | Enforce IaaS network boundaries with allowlists and tenant VLANs |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::3.2 | Restrict hypervisor access to authorised cloud administrators |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::3.3a | Isolate virtual machines from one another and set policy on shared clipboards |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::3.3b | Enforce VM resource quotas and protect guest images and inactive VMs |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::3.4 | Monitor the access control APIs of the IaaS platform |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::3.5a | Use a virtualization management system with tiered administrative access and SLA-backed interoperation controls |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::3.5b | Write IaaS access control policy rules by subject, operation, object and environment condition |
Section 4: Access control guidance for PaaS – NIST SP 800-210 General Access Control Guidance for Cloud Systems
| Code | Title |
|---|---|
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::4.1 | Control access to shared operating system memory in PaaS, flushing highly sensitive data on context switches |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::4.2 | Scope APIs to each application and centralise authorisation for microservices |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::4.3 | Synchronise access policy across replicated PaaS data and write the PaaS policy rules |
Section 5: Access control guidance for SaaS – NIST SP 800-210 General Access Control Guidance for Cloud Systems
| Code | Title |
|---|---|
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::5.1 | Preserve the data owner's control over application data held by the SaaS provider |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::5.2 | Protect SaaS data confidentiality with encryption and attribute-based control without crippling performance |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::5.3 | Assign and revoke privileges through a flexible, real-time mechanism |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::5.4 | Apply one access policy to every replica of the data and synchronise policy changes |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::5.5 | Plan multi-tenancy with segregated tenant data and a deliberately chosen authorisation model |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::5.6 | Agree and size the set of attributes and roles used for access management |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::5.7 | Enforce authorisation without disclosing sensitive access control data to the SaaS provider |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::5.8 | Design SaaS APIs so that access policy cannot be circumvented |
Section 6: Access control for inter-operation and intra-operation – NIST SP 800-210 General Access Control Guidance for Cloud Systems
| Code | Title |
|---|---|
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::6a | Enable intra-operation between a consumer's VMs for the collaboration period only, within and across hosts |
| nist-sp-800-210-general-access-control-guidance-for-cloud-systems::6b | Reconcile attribute semantics and policy integration before inter-operation across providers |
What is NIST SP 800-210 General Access Control Guidance for Cloud Systems and who does it apply to?
NIST SP 800-210 General Access Control Guidance for Cloud Systems is a compliance framework from United States with 5 domains and 26 controls. NIST's access control guidance for cloud systems: shared responsibility and the five cloud characteristics, then IaaS (network, hypervisor, VMs, APIs), PaaS (memory, APIs, replicas), SaaS (data owner control, confidentiality, privileges, tenancy, roles, federated authorisation, APIs) and collaboration between and within clouds. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does NIST SP 800-210 General Access Control Guidance for Cloud Systems actually require?
NIST SP 800-210 General Access Control Guidance for Cloud Systems has 26 controls organised across 5 domains. The largest domains are Section 5: Access control guidance for SaaS – NIST SP 800-210 General Access Control Guidance for Cloud Systems (8 controls), Section 3: Access control guidance for IaaS – NIST SP 800-210 General Access Control Guidance for Cloud Systems (7 controls), Section 2: Cloud access control characteristics and shared responsibility – NIST SP 800-210 General Access Control Guidance for Cloud Systems (6 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of NIST SP 800-210 General Access Control Guidance for Cloud Systems do I already cover?
NIST SP 800-210 General Access Control Guidance for Cloud Systems does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement NIST SP 800-210 General Access Control Guidance for Cloud Systems?
Start your NIST SP 800-210 General Access Control Guidance for Cloud Systems compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NIST SP 800-210 General Access Control Guidance for Cloud Systems requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 26 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required