Assessment Objective
Determine if:
- AC-16(02)[01] authorized individuals (or processes acting on behalf of individuals) are provided with the capability to define or change the value of associated security attributes;
- AC-16(02)[02] authorized individuals (or processes acting on behalf of individuals) are provided with the capability to define or change the value of associated privacy attributes.
Assessment Methods
Examine
- Access control policy
- procedures addressing the change of security and privacy attribute values
- system design documentation
- system configuration settings and associated documentation
- list of individuals authorized to change security and privacy attributes
- system audit records
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for changing values of security and privacy attributes
- organizational personnel with information security and privacy responsibilities
- system developers
Test
- Mechanisms permitting changes to values of security and privacy attributes
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | AC-16(02) Attribute Value Changes by Authorized Individuals |