|
+AC-03(11) Restrict Access to Specific Information Types |
AC-03(11) Restrict Access to Specific Information TypesControlRestrict access to data repositories containing [Assignement: information types].DiscussionRestricting access to specific information is intended to provide flexibility regarding access control of specific information types within a system. For example, role-based access could be employed to allow access to only a specific type of personally identifiable information within a database rather than allowing access to the database in its entirety. Other examples include restricting access to cryptographic keys, authentication information, and selected system information.Assessment Objectiveaccess to data repositories containing [Assignement: information types] is restricted.Assessment MethodExamineAccess control policy procedures addressing access enforcement system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or recordsInterviewOrganizational personnel with access enforcement responsibilities organizational personnel with responsibilities for data repositories system/network administrators organizational personnel with information security responsibilities1. Επισκόπηση
1.1 Παραπομπές1.2 Εντοπισμένες απαιτήσεις1.3 Σχετικοί κανονισμοί2. Εντοπισμένες απαιτήσεις
3. Σχετικοί κανονισμοί
Συνδεδεμένα ζητήματα |