NIST Special Publication 800-178 A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications Extensible Access Control Markup Language (XACML) and Next Generation Access Control (NGAC) David Ferraiolo Ramaswamy Chandramouli Vincent Hu Rick Kuhn T his publication is available free of charge from: http://dx.doi.org/10.6028/NIST.SP.800- 178 C O M P U T E R S E C U R I T Y NIST Special Publication 800-178 A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications Extensible Access Control Markup Language (XACML) and Next Generation Access Control (NGAC) D avid Ferraiolo Ramaswamy Chandramouli Vincent Hu Rick Kuhn Computer Security Division Information Technology Laboratory T his publication is available free of charge from: http://dx.doi.org/10.6028/NIST.SP.800- 178 Octob er 2016 U. S. Department of Commerce Penny Pritzker, Secretary N ational Institute of Standards and Technology Willie May , Under Secretary of Commerce for Standards and Technology and Director Authority This publ ication has be en developed by NIST i n accordance w ith its statutory r esponsibilities und er the Federal Information Se curity M odernization Act (FISMA) of 201 4, 44 U.S.C. § 35 51 et seq ., Public Law (P.L.) 1 13-283. NIST is responsib le for developing information security s tandards a nd guidelines, including minimum r equirements f or federal i nformation systems, but s uch standards a nd guidelines s hall not apply to national s ecurity systems w ithout the express a pproval of a ppropriate f ederal o fficials exercising policy a uthority over such systems. T his g uideline i s consistent w ith the r equirements of t he Office of M anagement an d Budget ( OMB) C ircular A -130. Nothing in this publ ication s hould be taken to contradict t he standards a nd guidelines made mandatory and bi nding o n federal a gencies by t he Secretary of C ommerce unde r statutory authority. Nor should these guidelines be interpreted as altering o r superseding the existing au thorities of t he Secretary o f Commerce, Director of t he O MB, o r any other f ederal o fficial. This publication may b e used by nongovernmental or ganizations on a voluntary ba sis and is no t subject t o copyright i n the U nited States. Attribution would, however, be appreciated by N IST. National Institute of Standards and Technology Special Publication 800-1 78 Natl. Inst. Stand. Technol. Spec. Publ. 800-1 78, 68 pages (October 2016) CODEN: NSPUE2 This publicati on is availabl e free of char ge from: http://dx.doi.org/10.6028/ NIST.SP.800 -178 Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory re sponsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guideline s, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications , ot her than the ones noted above, are available at http://csrc.nist.gov/publications . Comments on this publication may be submitted to: National Institute of Standar