AC Access Control

Control

1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
   1. [Selection(one-or-more): organization-level; mission/business process-level; system-level] access control policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
   2. Procedures to facilitate the implementation of the access control policy and the associated access controls;
2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the access control policy and procedures; and
3. Review and update the current access control:
   1. Policy [Assignement: frequency] and following [Assignement: events] ; and
   2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

Assessment Objective

1. 1. an access control policy is developed and documented;
   2. the access control policy is disseminated to [Assignement: personnel or roles];
   3. access control procedures to facilitate the implementation of the access control policy and associated controls are developed and documented;
   4. the access control procedures are disseminated to [Assignement: personnel or roles];
   5. 1. 1. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] access control policy addresses purpose;
         2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] access control policy addresses scope;
         3. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] access control policy addresses roles;
         4. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] access control policy addresses responsibilities;
         5. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] access control policy addresses management commitment;
         6. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] access control policy addresses coordination among organizational entities;
         7. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] access control policy addresses compliance;
      2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] access control policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the access control policy and procedures;
3. 1. 1. the current access control policy is reviewed and updated [Assignement: frequency];
      2. the current access control policy is reviewed and updated following [Assignement: events];
   2. 1. the current access control procedures are reviewed and updated [Assignement: frequency];
      2. the current access control procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

Interview

Control

1. Define and document the types of accounts allowed and specifically prohibited for use within the system;
2. Assign account managers;
3. Require [Assignement: prerequisites and criteria] for group and role membership;
4. Specify:
   1. Authorized users of the system;
   2. Group and role membership; and
   3. Access authorizations (i.e., privileges) and [Assignement: attributes (as required)] for each account;
5. Require approvals by [Assignement: personnel or roles] for requests to create accounts;
6. Create, enable, modify, disable, and remove accounts in accordance with [Assignement: policy, procedures, prerequisites, and criteria];
7. Monitor the use of accounts;
8. Notify account managers and [Assignement: personnel or roles] within:
   1. [Assignement: time period] when accounts are no longer required;
   2. [Assignement: time period] when users are terminated or transferred; and
   3. [Assignement: time period] when system usage or need-to-know changes for an individual;
9. Authorize access to the system based on:
   1. A valid access authorization;
   2. Intended system usage; and
   3. [Assignement: attributes (as required)];
10. Review accounts for compliance with account management requirements [Assignement: frequency];
11. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and
12. Align account management processes with personnel termination and transfer processes.

Discussion

Assessment Objective

1. 1. account types allowed for use within the system are defined and documented;
   2. account types specifically prohibited for use within the system are defined and documented;
2. account managers are assigned;
3. [Assignement: prerequisites and criteria] for group and role membership are required;
4. 1. authorized users of the system are specified;
   2. group and role membership are specified;
   3. 1. access authorizations (i.e., privileges) are specified for each account;
      2. [Assignement: attributes (as required)] are specified for each account;
5. approvals are required by [Assignement: personnel or roles] for requests to create accounts;
6. 1. accounts are created in accordance with [Assignement: policy, procedures, prerequisites, and criteria];
   2. accounts are enabled in accordance with [Assignement: policy, procedures, prerequisites, and criteria];
   3. accounts are modified in accordance with [Assignement: policy, procedures, prerequisites, and criteria];
   4. accounts are disabled in accordance with [Assignement: policy, procedures, prerequisites, and criteria];
   5. accounts are removed in accordance with [Assignement: policy, procedures, prerequisites, and criteria];
7. the use of accounts is monitored;
8. 1. account managers and [Assignement: personnel or roles] are notified within [Assignement: time period] when accounts are no longer required;
   2. account managers and [Assignement: personnel or roles] are notified within [Assignement: time period] when users are terminated or transferred;
   3. account managers and [Assignement: personnel or roles] are notified within [Assignement: time period] when system usage or the need to know changes for an individual;
9. 1. access to the system is authorized based on a valid access authorization;
   2. access to the system is authorized based on intended system usage;
   3. access to the system is authorized based on [Assignement: attributes (as required)];
10. accounts are reviewed for compliance with account management requirements [Assignement: frequency];
11. 1. a process is established for changing shared or group account authenticators (if deployed) when individuals are removed from the group;
    2. a process is implemented for changing shared or group account authenticators (if deployed) when individuals are removed from the group;
12. 1. account management processes are aligned with personnel termination processes;
    2. account management processes are aligned with personnel transfer processes.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

1. Identify and document [Assignement: duties of individuals] ; and
2. Define system access authorizations to support separation of duties.

Discussion

Assessment Objective

1. [Assignement: duties of individuals] are identified and documented;
2. system access authorizations to support separation of duties are defined.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

1. Enforce a limit of [Assignement: number] consecutive invalid logon attempts by a user during a [Assignement: time period] ; and
2. Automatically [Selection(one-or-more): lock the account or node for {{ insert: param, ac-07_odp.04 }} ; lock the account or node until released by an administrator; delay next logon prompt per {{ insert: param, ac-07_odp.05 }} ; notify system administrator; take other {{ insert: param, ac-07_odp.06 }} ] when the maximum number of unsuccessful attempts is exceeded.

Discussion

Assessment Objective

1. a limit of [Assignement: number] consecutive invalid logon attempts by a user during [Assignement: time period] is enforced;
2. automatically [Selection(one-or-more): lock the account or node for {{ insert: param, ac-07_odp.04 }} ; lock the account or node until released by an administrator; delay next logon prompt per {{ insert: param, ac-07_odp.05 }} ; notify system administrator; take other {{ insert: param, ac-07_odp.06 }} ] when the maximum number of unsuccessful attempts is exceeded.

Assessment Method

Examine

Interview

Control

1. Display [Assignement: system use notification] to users before granting access to the system that provides privacy and security notices consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and state that:
   1. Users are accessing a U.S. Government system;
   2. System usage may be monitored, recorded, and subject to audit;
   3. Unauthorized use of the system is prohibited and subject to criminal and civil penalties; and
   4. Use of the system indicates consent to monitoring and recording;
2. Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system; and
3. For publicly accessible systems:
   1. Display system use information [Assignement: conditions] , before granting further access to the publicly accessible system;
   2. Display references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and
   3. Include a description of the authorized uses of the system.

Discussion

Assessment Objective

1. [Assignement: system use notification] is displayed to users before granting access to the system that provides privacy and security notices consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
   1. the system use notification states that users are accessing a U.S. Government system;
   2. the system use notification states that system usage may be monitored, recorded, and subject to audit;
   3. the system use notification states that unauthorized use of the system is prohibited and subject to criminal and civil penalties; and
   4. the system use notification states that use of the system indicates consent to monitoring and recording;
2. the notification message or banner is retained on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system;
3. 1. for publicly accessible systems, system use information [Assignement: conditions] is displayed before granting further access to the publicly accessible system;
   2. for publicly accessible systems, any references to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities are displayed;
   3. for publicly accessible systems, a description of the authorized uses of the system is included.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

1. Prevent further access to the system by [Selection(one-or-more): initiating a device lock after {{ insert: param, ac-11_odp.02 }} of inactivity; requiring the user to initiate a device lock before leaving the system unattended] ; and
2. Retain the device lock until the user reestablishes access using established identification and authentication procedures.

Discussion

Assessment Objective

1. further access to the system is prevented by [Selection(one-or-more): initiating a device lock after {{ insert: param, ac-11_odp.02 }} of inactivity; requiring the user to initiate a device lock before leaving the system unattended];
2. device lock is retained until the user re-establishes access using established identification and authentication procedures.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

1. Identify [Assignement: user actions] that can be performed on the system without identification or authentication consistent with organizational mission and business functions; and
2. Document and provide supporting rationale in the security plan for the system, user actions not requiring identification or authentication.

Discussion

Assessment Objective

1. [Assignement: user actions] that can be performed on the system without identification or authentication consistent with organizational mission and business functions are identified;
2. 1. user actions not requiring identification or authentication are documented in the security plan for the system;
   2. a rationale for user actions not requiring identification or authentication is provided in the security plan for the system.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

1. Provide the means to associate [Assignement: organization-defined types of security and privacy attributes] with [Assignement: organization-defined security and privacy attribute values] for information in storage, in process, and/or in transmission;
2. Ensure that the attribute associations are made and retained with the information;
3. Establish the following permitted security and privacy attributes from the attributes defined in [AC-16a](#ac-16_smt.a) for [Assignement: organization-defined systems]: [Assignement: organization-defined security and privacy attributes];
4. Determine the following permitted attribute values or ranges for each of the established attributes: [Assignement: attribute values or ranges];
5. Audit changes to attributes; and
6. Review [Assignement: organization-defined security and privacy attributes] for applicability [Assignement: organization-defined frequency].

Discussion

Assessment Objective

1. 1. the means to associate [Assignement: types of security attributes] with [Assignement: security attribute values] for information in storage, in process, and/or in transmission are provided;
   2. the means to associate [Assignement: types of privacy attributes] with [Assignement: privacy attribute values] for information in storage, in process, and/or in transmission are provided;
2. 1. attribute associations are made;
   2. attribute associations are retained with the information;
3. 1. the following permitted security attributes are established from the attributes defined in AC-16_ODP[01] for [Assignement: systems]: [Assignement: security attributes];
   2. the following permitted privacy attributes are established from the attributes defined in AC-16_ODP[02] for [Assignement: systems]: [Assignement: privacy attributes];
4. the following permitted attribute values or ranges for each of the established attributes are determined: [Assignement: attribute values or ranges];
5. changes to attributes are audited;
6. 1. [Assignement: security attributes] are reviewed for applicability [Assignement: frequency];
   2. [Assignement: privacy attributes] are reviewed for applicability [Assignement: frequency].

Assessment Method

Examine

Interview

Control

1. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and
2. Authorize each type of remote access to the system prior to allowing such connections.

Discussion

Assessment Objective

1. 1. usage restrictions are established and documented for each type of remote access allowed;
   2. configuration/connection requirements are established and documented for each type of remote access allowed;
   3. implementation guidance is established and documented for each type of remote access allowed;
2. each type of remote access to the system is authorized prior to allowing such connections.

Assessment Method

Examine

Interview

Control

1. Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and
2. Authorize each type of wireless access to the system prior to allowing such connections.

Discussion

Assessment Objective

1. 1. configuration requirements are established for each type of wireless access;
   2. connection requirements are established for each type of wireless access;
   3. implementation guidance is established for each type of wireless access;
2. each type of wireless access to the system is authorized prior to allowing such connections.

Assessment Method

Examine

Interview

Control

1. Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas; and
2. Authorize the connection of mobile devices to organizational systems.

Discussion

Assessment Objective

1. 1. configuration requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area;
   2. connection requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area;
   3. implementation guidance is established for organization-controlled mobile devices, including when such devices are outside of the controlled area;
2. the connection of mobile devices to organizational systems is authorized.

Assessment Method

Examine

Interview

Control

1. [Selection(one-or-more): establish {{ insert: param, ac-20_odp.02 }} ; identify {{ insert: param, ac-20_odp.03 }} ] , consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to:
   1. Access the system from external systems; and
   2. Process, store, or transmit organization-controlled information using external systems; or
2. Prohibit the use of [Assignement: prohibited types of external systems].

Discussion

Assessment Objective

1. 1. [Selection(one-or-more): establish {{ insert: param, ac-20_odp.02 }} ; identify {{ insert: param, ac-20_odp.03 }} ] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to access the system from external systems (if applicable);
   2. [Selection(one-or-more): establish {{ insert: param, ac-20_odp.02 }} ; identify {{ insert: param, ac-20_odp.03 }} ] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to process, store, or transmit organization-controlled information using external systems (if applicable);
2. the use of [Assignement: prohibited types of external systems] is prohibited (if applicable).

Assessment Method

Examine

Interview

Control

1. Enable authorized users to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for [Assignement: information-sharing circumstances] ; and
2. Employ [Assignement: automated mechanisms] to assist users in making information sharing and collaboration decisions.

Discussion

Assessment Objective

1. authorized users are enabled to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for [Assignement: information-sharing circumstances];
2. [Assignement: automated mechanisms] are employed to assist users in making information-sharing and collaboration decisions.

Assessment Method

Examine

Interview

Control

1. Designate individuals authorized to make information publicly accessible;
2. Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information;
3. Review the proposed content of information prior to posting onto the publicly accessible system to ensure that nonpublic information is not included; and
4. Review the content on the publicly accessible system for nonpublic information [Assignement: frequency] and remove such information, if discovered.

Discussion

Assessment Objective

1. designated individuals are authorized to make information publicly accessible;
2. authorized individuals are trained to ensure that publicly accessible information does not contain non-public information;
3. the proposed content of information is reviewed prior to posting onto the publicly accessible system to ensure that non-public information is not included;
4. 1. the content on the publicly accessible system is reviewed for non-public information [Assignement: frequency];
   2. non-public information is removed from the publicly accessible system, if discovered.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview