In Episode 16 of my NIST SP 800-53 Rev 5 Access Control series, I break down AC-19 (Access Control for Mobile Devices) and simplify what the control is really asking you to do. I walk through what “mobile devices” means in the NIST discussion (smartphones, tablets, small form factor devices with storage and power), and I explain the practical access control mechanisms organizations typically use—PIN/passwords and patterns, biometrics like fingerprint/face recognition, device encryption, and remote wipe capabilities to protect data when devices are lost or stolen. Then I get into the actual AC-19 requirement: establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices—especially when they’re outside the organizational perimeter—and authorize how those devices connect to organizational systems. I also call out an important reality: AC-19 is often not applicable for many systems unless your system actually relies on mobile device connectivity. Finally, I cover how I assess/test AC-19 during an SCA or continuous monitoring. My approach starts with examining the SSP plus access control policies/procedures to understand the organization’s specific restrictions and connection requirements. From there, I validate the implementation by testing a real connection (or reviewing configuration evidence like screenshots) to confirm the restrictions are actually effective.