+AC-03(11) Restrict Access to Specific Information Types
|
AC-03(11) Restrict Access to Specific Information Types
Control
Restrict access to data repositories containing [Assignement: information types].
Discussion
Restricting access to specific information is intended to provide flexibility regarding access control of specific information types within a system. For example, role-based access could be employed to allow access to only a specific type of personally identifiable information within a database rather than allowing access to the database in its entirety. Other examples include restricting access to cryptographic keys, authentication information, and selected system information.
Assessment Objective
access to data repositories containing [Assignement: information types] is restricted.
Assessment Method
Examine
Access control policy
procedures addressing access enforcement
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with access enforcement responsibilities
organizational personnel with responsibilities for data repositories
system/network administrators
organizational personnel with information security responsibilities
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|