Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

NIST IR 8504 (Initial Public Draft)

Access Control on NoSQL Databases

Date Published: January 30, 2024
Comments Due: March 15, 2024 (public comment period is CLOSED)
Email Questions to:


Vincent Hu (NIST)


NoSQL (i.e., “not only SQL” or “non-SQL”) database systems and data stores often outperform traditional relational database management systems (RDBMSs) in various aspects, such as data analysis efficiency, system performance, ease of deployment, flexibility/scalability of data management, and users’ availability. However, with an increasing number of people storing sensitive data in NoSQL databases, access control issues have become a fundamental data protection requirement for database management systems.

This document discusses access control on NoSQL database systems by illustrating the NoSQL database types and their support for access control models. It operates under the assumption that the access control system stores and manages access control data (e.g., subjects, objects, and attributes) in the NoSQL database and describes considerations from the perspective of access control in general.

A public comment period is open through March 15, 2024.

NOTE: A call for patent claims is included on page ii of this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy Inclusion of Patents in ITL Publications.



access control; attribute-based access control; authorization; database systems; No-SQL; SQL
Control Families

None selected


Download URL

Supplemental Material:
None available

Document History:
01/30/24: IR 8504 (Draft)
05/07/24: IR 8504 (Final)


Security and Privacy

access control