Appearance
NIST 800-53 Access Control Policy (AC)
Document ID: PLCY-NIST-AC-001
Version: 1.0
Effective Date: December 30, 2025
Last Review: December 30, 2025
Owner: Hop And Haul Team
CONFIDENTIAL
This document is CONFIDENTIAL and for internal use only. Do not distribute outside the organization.
1. Purpose
This document defines Hop And Haul' implementation of the NIST 800-53 Access Control (AC) family for FedRAMP Moderate authorization. It establishes policies and procedures for managing access to Hop And Haul systems and data, ensuring appropriate controls are in place to protect against unauthorized access.
2. Scope
This policy applies to:
- All Hop And Haul system components within the authorization boundary
- All users (drivers, riders, fleet administrators, support staff, system administrators)
- All access methods (mobile application, web portal, API)
- All data classifications (public, internal, confidential, restricted)
3. Access Control Policy and Procedures (AC-1)
3.1 Policy Statement
Hop And Haul implements access controls that:
- Restrict access to authorized users based on business need and role
- Enforce separation of duties for critical functions
- Implement least privilege for all accounts
- Log all access attempts for audit and accountability
3.2 Responsibilities
| Role | Responsibilities |
|---|---|
| Security Team | Define access control requirements, review policies |
| System Administrators | Implement and maintain access controls |
| Fleet Administrators | Manage user access within their organization |
| All Users | Comply with access control policies |
3.3 Review Frequency
| Activity | Frequency |
|---|---|
| Policy review | Annual |
| Access rights review | Quarterly |
| Privileged account review | Monthly |
4. Account Management (AC-2)
4.1 Account Types
| Account Type | Description | Provisioning | Lifecycle |
|---|---|---|---|
| Driver | Fleet driver mobile access | Fleet admin approval | Employment-based |
| Rider | Mobile app user | Self-registration + org verification | Org membership |
| Fleet Admin | Fleet management portal | Customer onboarding | Contract duration |
| Support Staff | Customer support access | HR + Security approval | Employment-based |
| System Admin | Infrastructure access | Security approval + 2-person | Employment-based |
4.2 Account Management Controls
| Control | Requirement | Implementation |
|---|---|---|
| AC-2(1) | Automated account management | SSO integration with corporate IdP |
| AC-2(2) | Temporary account removal | Auto-disable after 90 days inactivity |
| AC-2(3) | Disable inactive accounts | 30-day warning, 90-day disable |
| AC-2(4) | Automated audit actions | All account changes logged to audit trail |
4.3 Account Provisioning Workflow
Request → Manager Approval → Security Review → IdP Provisioning →
Role Assignment → Access Granted → Audit Log Entry4.4 Account Termination
| Trigger | Action | Timeline |
|---|---|---|
| Employment termination | Immediate disable | Within 4 hours |
| Contract end | Scheduled disable | End of contract day |
| Security incident | Emergency disable | Immediate |
| Inactivity | Warning then disable | 30/90 days |
5. Access Enforcement (AC-3)
5.1 Authorization Model
Hop And Haul implements Role-Based Access Control (RBAC) with organization-scoped permissions:
| Component | Enforcement Point | Mechanism |
|---|---|---|
| Mobile API | API Gateway | JWT claims + middleware validation |
| Admin Portal | Application layer | Session role + permission check |
| Database | PostgreSQL | Row Level Security (RLS) policies |
| Infrastructure | AWS IAM | Policy-based access control |
5.2 Access Decision Process
Request → Authenticate → Extract Claims → Check Role →
Check Org Scope → Check Resource Permission → Allow/Deny5.3 Server-Side Enforcement
All access decisions are made server-side:
| Requirement | Implementation |
|---|---|
| No client-side authorization | All auth logic in API backend |
| No PII before authentication | Data masked until session established |
| No cross-tenant data exposure | Org ID validated on every request |
6. Information Flow Enforcement (AC-4)
6.1 Data Flow Controls
| Flow | Source | Destination | Controls |
|---|---|---|---|
| Location data | Driver device | Hop And Haul API | Fuzzification pre-match |
| Ride details | Hop And Haul | Rider app | Role-filtered response |
| Fleet data | Hop And Haul | Admin portal | Org-scoped queries |
| Audit logs | Application | Log storage | Append-only, encrypted |
6.2 Tenant Isolation
| Layer | Control | Implementation |
|---|---|---|
| Application | Org ID validation | Middleware enforces org context |
| Database | Row Level Security | PostgreSQL RLS policies |
| Storage | Key separation | Per-tenant encryption keys |
7. Separation of Duties (AC-5)
7.1 Function Separation
| Function | Cannot Be Combined With |
|---|---|
| User provisioning | Security audit review |
| Code deployment | Code review approval |
| Database administration | Application administration |
| Financial approval | Financial execution |
| Safety override | Safety investigation |
7.2 Implementation
| Control | Mechanism |
|---|---|
| Dual control for critical operations | 2-person approval workflow |
| No self-approval | System prevents self-approval |
| Audit trail | All approvals logged with approver ID |
8. Least Privilege (AC-6)
8.1 Privilege Levels
| Role | Base Privileges | Elevated Privileges |
|---|---|---|
| Driver | View own rides, accept offers | None |
| Rider | Request rides, view own history | None |
| Fleet Admin | Manage own fleet users | View fleet reports |
| Support Staff | View assigned tickets | Time-boxed data access |
| System Admin | Infrastructure management | Break-glass emergency access |
8.2 Privilege Restrictions
| Control | Implementation | Reference |
|---|---|---|
| AC-6(1) | Security functions require explicit authorization | Role assignment workflow |
| AC-6(2) | Non-privileged access for non-security functions | Default role restrictions |
| AC-6(5) | Privileged accounts separately managed | Dedicated admin accounts |
| AC-6(9) | Privileged function use logged | Audit trail logging |
| AC-6(10) | Privileged functions blocked for non-privileged users | RBAC enforcement |
9. Unsuccessful Logon Attempts (AC-7)
9.1 Lockout Policy
| Parameter | Value |
|---|---|
| Maximum failed attempts | 5 |
| Lockout duration | 15 minutes (auto-unlock) |
| Counter reset | After successful login |
| Notification | User + Security team (>3 failures) |
9.2 Response Actions
| Threshold | Action |
|---|---|
| 3 failed attempts | Security alert generated |
| 5 failed attempts | Account locked, user notified |
| 10 failed attempts (within 24h) | Security investigation triggered |
| Geographic anomaly | Step-up authentication required |
10. System Use Notification (AC-8)
10.1 Banner Requirements
All systems display use notification before authentication:
This is a Hop And Haul system. Access is restricted to authorized
users only. All activities are monitored and logged. Unauthorized
access attempts will be reported to appropriate authorities.10.2 Acknowledgment
| System | Acknowledgment Method |
|---|---|
| Mobile app | Accept terms on first launch |
| Admin portal | Banner display before login |
| API | Terms in developer agreement |
11. Session Controls (AC-11, AC-12)
11.1 Session Lock (AC-11)
| Platform | Inactivity Timeout | Lock Mechanism |
|---|---|---|
| Mobile app | 15 minutes | Require biometric/PIN to resume |
| Admin portal | 30 minutes | Re-authentication required |
| API session | 15 minutes (token expiry) | New token required |
11.2 Session Termination (AC-12)
| Trigger | Action |
|---|---|
| User logout | Immediate session invalidation |
| Token expiry | Access denied, refresh required |
| Security event | All user sessions terminated |
| Device change | Previous sessions invalidated |
11.3 Token Management
| Token Type | Lifetime | Scope | Revocation |
|---|---|---|---|
| Access token | 15 minutes | User session | Automatic expiry |
| Refresh token | 7 days | Token renewal | Revocation list |
| Ride tracking | Ride + 15 min | Single ride | Auto-expire |
| API bearer | 24 hours | Integration | Manual rotation |
12. Remote Access (AC-17)
12.1 Remote Access Methods
| Method | Use Case | Controls |
|---|---|---|
| Mobile API | Driver/Rider apps | TLS 1.3, JWT auth, device binding |
| Admin portal | Fleet management | TLS 1.3, SSO, MFA required |
| VPN | Infrastructure access | Cloudflare Zero Trust, MFA |
| SSH | Emergency access | Jump host, key-based, logged |
12.2 Remote Access Controls
| Control | Implementation |
|---|---|
| AC-17(1) Monitoring | All remote sessions logged |
| AC-17(2) Encryption | TLS 1.3 for all connections |
| Geographic restrictions | Access blocked from high-risk regions |
| Device posture | MDM compliance check (planned) |
13. Mobile Device Access (AC-19)
13.1 Mobile Access Requirements
| Requirement | Implementation | Status |
|---|---|---|
| Device authentication | Biometric or PIN required | Implemented |
| Secure storage | iOS Keychain / Android Keystore | Implemented |
| Root/jailbreak detection | App-level check | Implemented |
| MDM enrollment | Fleet-managed devices | Planned (Phase 2) |
13.2 Mobile Security Controls
| Control | Description |
|---|---|
| App transport security | Enforce TLS, certificate pinning |
| Data protection | Encryption at rest on device |
| Session binding | Session tied to device fingerprint |
| Remote wipe | Admin can revoke device access |
14. Hop And Haul-Specific Access Controls
14.1 Location Data Access
| Phase | Access Level | Controls |
|---|---|---|
| Pre-match | Fuzzed location (1-2 mi radius) | No precise GPS exposed |
| Post-accept | Precise pickup point | Time-limited access |
| Post-ride | No location access | Token auto-expired |
| Safety incident | Full trail access | Break-glass, logged |
14.2 Rate Limiting
| Resource | Limit | Rationale |
|---|---|---|
| Ride offers | 3 per hour | Prevent stalking patterns |
| Post-decline suppression | 30 minutes | Anti-harassment |
| Data export | 100 records | Prevent bulk extraction |
| API requests | 1000/hour | DoS prevention |
15. FedRAMP-Specific Enhancements (Planned)
| Enhancement | Target Control | Timeline | Description |
|---|---|---|---|
| PIV/CAC authentication | IA-2(12) | Phase 3 | Federal credential support |
| FIPS 140-2 crypto | SC-13 | Phase 3 | Validated cryptographic modules |
| Automated provisioning | AC-2(1) | Phase 2 | SCIM integration |
| Device attestation | AC-19 | Phase 2 | MDM compliance verification |
16. Related Documents
| Document | Relationship |
|---|---|
| PLCY-SEC-001 | Security controls implementation |
| PLCY-ACC-001 | Access control matrix |
| PLCY-AUD-001 | Audit logging requirements |
| PLCY-FED-005 | NIST control mapping |
17. Document Control
| Version | Date | Author | Changes |
|---|---|---|---|
| 1.0 | December 30, 2025 | Hop And Haul Team | Initial release |