NIST 800-171 lays out specific requirements to ensure that only authorized users can access and interact with sensitive information systems. These controls are essential for safeguarding Controlled Unclassified Information (CUI), which is nonclassified data that still requires protection.

The first line of defense outlined in NIST 800-171 is limiting access to authorized users, devices, and processes. This means that only those who have a legitimate business need to access a system should be granted permission. NIST 800-171 also dictates that authorized users should only be able to perform specific actions on a system. This principle, known as least privilege, restricts users from having more access than they require to complete their job duties.

Another critical requirement involves managing the flow of CUI. NIST 800-171 mandates that organizations establish a process for approving access to CUI. This ensures that sensitive data is only viewed or handled by those who are permitted to do so. Additionally, NIST 800-171 calls for separating the duties of individuals to reduce the risk of unauthorized activity. By dividing tasks among multiple people, it becomes more difficult for a single person to compromise the system. These access control requirements from NIST 800-171 form the bedrock for a secure information system environment.