Key concepts
The publication describes access control characteristics of cloud systems and gives guidance per service model, noting that controls at lower layers generally carry up to higher ones while each model has its own concerns.
How it is organized
- Cloud access control characteristics
- Guidance for IaaS
- Guidance for PaaS
- Guidance for SaaS
- Inter- and intra-operation
What a school district should take from it
- In software-as-a-service, the district controls accounts, roles and sharing settings; review them regularly.
- Administrator roles in cloud consoles deserve the strongest protection.
How to use it in your district
- Review administrator role assignments in Google Workspace or Microsoft 365 each semester.
- Limit external sharing defaults for student data.
- Run the matching evidence collection kit and keep the results.
Common misconceptions
- The cloud provider sets access control for us.
- Providers supply the controls; the district configures who can access what.
Rubric categories and K12 Cyber Forward tools
Cybersecurity Rubric 2.0 categories
- PR.AAIdentity Management, Authentication, and Access Control
Tools in the program portal
- Evidence collection kitsCollect configuration evidence from Microsoft 365, Google and more
- Team and accessNamed accounts, roles and authenticator MFA
Related publications
- SP 800-144Security and privacy in public cloud
Citation and source
SP 800-210, General Access Control Guidance for Cloud Systems. National Institute of Standards and Technology. 2020. https://doi.org/10.6028/NIST.SP.800-210.
Topics: Cloud and connected devices, Identity, passwords and MFA. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.