3.1 Access Control

Statement

Enforce dual authorization for {{ insert: param, A.03.01.01E.ODP.01 }} .

Guidance

Dual authorization is also known as two-person control. Dual authorization reduces risk related to insider threats, including adversaries who have obtained credentials. Dual authorization requires the approval of two authorized individuals to execute privileged commands and/or other organizational actions that may affect the protection of CUI. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. Organizations also consider the risk associated with implementing dual authorization when immediate responses are necessary to ensure public and environmental safety. This requirement enhances SP 800-171 requirement 03.01.02.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

dual authorization is enforced for {{ insert: param, A.03.01.01E.ODP.01 }}.

Assessment method

• Access control policy procedures addressing access enforcement and dual authorization system design documentation system configuration settings and associated documentation list of actions requiring dual authorization list of privileged commands requiring dual authorization list of approved authorizations (user privileges) system security plan other relevant documents or records

Assessment method

• Personnel with access enforcement responsibilities system/network administrators system developers personnel with information security responsibilities

Assessment method

• Dual authorization mechanisms implementing access control policy

Statement

Restrict the use of non-organizationally owned systems or system components to process, store, or transmit CUI using {{ insert: param, A.03.01.02E.ODP.01 }}.

Guidance

Non-organizationally owned systems or system components include systems or system components owned by other organizations as well as personally owned devices. These also include systems and system components that are leased, part of subscription services, government-furnished equipment, or "bring your own" devices. There are risks to using non-organizationally owned systems or components. In some cases, the risk is sufficiently high as to prohibit such use. In other cases, the use of such systems or system components may be allowed but restricted in some way. Restrictions include requiring the implementation of approved safeguards prior to authorizing connections to non-organizationally owned systems and components; limiting access to types of information, services, or applications; using virtualization techniques to limit processing and storage activities to system components that are provisioned by the organization; and agreeing to the terms and conditions for usage. This requirement enhances SP 800-171 requirement 03.01.20

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

the use of non-organizationally owned systems or system components to process, store, or transmit CUI is restricted using {{ insert: param, A.03.01.02E.ODP.01 }}.

Assessment method

• Access control policy procedures addressing the use of external systems system design documentation system configuration settings and associated documentation system connection or processing agreements account management documents system audit records other relevant documents or records

Assessment method

• Personnel with responsibilities for restricting or prohibiting the use of non-organizationally owned systems, system components, or devices system/network administrators personnel with information security responsibilities

Assessment method

• Mechanisms implementing restrictions on the use of non-organizationally owned systems, components, or devices

Statement

Limit the number of concurrent sessions for each {{ insert: param, A.03.01.04E.ODP.01 }} to {{ insert: param, A.03.01.04E.ODP.02 }}.

Guidance

Organizations may define the maximum number of concurrent sessions for system accounts globally, by account type, by account, or any combination thereof. For example, organizations may limit the number of concurrent sessions for system administrators or other individuals working in particularly sensitive domains or mission-critical applications. Concurrent session control addresses concurrent sessions for system accounts. It does not, however, address concurrent sessions by single users via multiple system accounts. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes contain and exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

the number of concurrent sessions for each {{ insert: param, A.03.01.04E.ODP.01 }} is limited to {{ insert: param, A.03.01.04E.ODP.02 }}.

Assessment method

• Access control policy procedures addressing concurrent session control system design documentation system configuration settings and associated documentation security plan system security plan other relevant documents or records

Assessment method

• System/network administrators personnel with information security responsibilities system developers

Assessment method

• Mechanisms implementing access control policy for concurrent session control

Statement

Employ automated mechanisms to monitor and control remote access methods.

Guidance

Monitoring and controlling remote access methods allows organizations to detect attacks and ensure compliance with remote access policies. This is accomplished by auditing the connection activities of remote users on system components, including servers, notebook computers, workstations, smart phones, and tablets. This requirement enhances SP 800-171 requirement 03.01.02.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

automated mechanisms are employed to monitor remote access methods.

Assessment objective

automated mechanisms are employed to control remote access methods.

Assessment method

• Access control policy procedures addressing remote access to the system system design documentation system configuration settings and associated documentation system audit records system monitoring records system security plan other relevant documents or records

Assessment method

• System/network administrators personnel with information security responsibilities system developers

Assessment method

• Automated mechanisms monitoring and controlling remote access methods

Statement

Protect information about remote access mechanisms from unauthorized use and disclosure.

Guidance

Access to organizational information about remote access mechanisms by non-organizational entities can increase the risk of unauthorized use and disclosure. The organization considers including remote access requirements in the information exchange agreements with other organizations, as applicable. Remote access requirements can also be included in rules of behavior and access agreements. This requirement enhances SP 800-171 requirement 03.01.12.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

information about remote access mechanisms is protected from unauthorized use and disclosure.

Assessment method

• Access control policy procedures addressing remote access to the system system security plan other relevant documents or records

Assessment method

• Personnel with responsibilities for implementing or monitoring remote access to the system system users with knowledge of information about remote access mechanisms personnel with information security responsibilities

Statement

Use automated mechanisms to audit account creation, modification, enabling, disabling, and removal actions.

Guidance

The use of automated mechanisms to audit account management activities provides more timely and comprehensive data to guide and inform needed actions by system administrators. Security information and event management (SIEM) tools can help automate account management audit activities. This requirement enhances SP 800-171 requirement 03.01.01.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

automated mechanisms are used to audit account creation actions.

Assessment objective

automated mechanisms are used to audit account modification actions.

Assessment objective

automated mechanisms are used to audit account enabling actions.

Assessment objective

automated mechanisms are used to audit account disabling actions.

Assessment objective

automated mechanisms are used to audit account removal actions.

Assessment method

• Access control policy procedures addressing account management system design documentation system configuration settings and associated documentation notifications or alerts of account creation, modification, enabling, disabling, and removal actions system audit records system security plan other relevant documents or records

Assessment method

• Personnel with account management responsibilities system/network administrators personnel with information security responsibilities

Assessment method

• Automated mechanisms implementing account management functions

Statement

• Monitor system accounts for {{ insert: param, A.03.01.08E.ODP.01 }} .

• Report atypical usage of system accounts to {{ insert: param, A.03.01.08E.ODP.02 }}.

Guidance

Atypical usage includes accessing systems at certain times of the day or from locations that are not consistent with the normal usage patterns of individuals. Monitoring for atypical usage may reveal rogue behavior by individuals or an attack in progress. This requirement enhances SP 800-171 requirement 03.01.01.

Statement

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

system accounts are monitored for {{ insert: param, A.03.01.08E.ODP.01 }}.

Assessment objective

atypical usage of system accounts is reported to {{ insert: param, A.03.01.08E.ODP.02 }}.

Assessment method

• Access control policy procedures addressing account management system design documentation system configuration settings and associated documentation system monitoring records system audit records audit tracking and monitoring reports system security plan other relevant documents or records

Assessment method

• Personnel with account management responsibilities system/network administrators personnel with information security responsibilities

Assessment method

• Mechanisms implementing account management functions

Statement

• Enforce attribute-based access control policy over defined subjects and objects.

• Control access based upon {{ insert: param, A.03.01.09E.ODP.01 }} .

Guidance

Attribute-based access control is an access control policy that restricts system access to authorized users based on specified organizational attributes (e.g., job function, role, identity), action attributes (e.g., read, write, delete), environmental attributes (e.g., time of day, location), and resource attributes (e.g., document classification). Organizations can create rules based on specified attributes and the authorizations (i.e., privileges) to perform needed operations on the systems associated with organization-defined attributes and rules. When users are assigned to attributes defined in attribute-based access control policies or rules, they can be provisioned to a system with the appropriate privileges or dynamically granted access to a protected resource. Attribute-based access control can be implemented as either a mandatory or discretionary form of access control. This requirement enhances SP 800-171 requirement 03.01.02.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

the attribute-based access control policy is enforced over defined subjects.

Assessment objective

the attribute-based access control policy is enforced over defined objects.

Assessment objective

access is controlled based upon {{ insert: param, A.03.01.09E.ODP.01 }} .

Assessment method

• Access control policy procedures addressing access enforcement system design documentation system configuration settings and associated documentation list of subjects and objects (i.e., users and resources) requiring enforcement of attribute-based access control policies system audit records system security plan other relevant documents or records

Assessment method

• Personnel with access enforcement responsibilities system/network administrators personnel with information security responsibilities

Assessment method

• Mechanisms implementing access enforcement functions

Statement

Use {{ insert: param, A.03.01.10E.ODP.01 }} associated with {{ insert: param, A.03.01.10E.ODP.02 }} to enforce {{ insert: param, A.03.01.10E.ODP.03 }} as a basis for flow control decisions.

Guidance

Organizations implement information flow control policies and enforcement mechanisms to control the flow of CUI between designated sources and destinations within systems and between connected systems. Flow control is based on the characteristics of the information and/or the information path. Enforcement occurs, for example, in boundary protection devices that employ rule sets or establish configuration settings that restrict system services, provide a packet-filtering capability based on header information, or provide a message-filtering capability based on message content. Information flow enforcement mechanisms compare the security attributes associated with information (i.e., data content and structure) and source and destination objects and respond appropriately when the enforcement mechanisms encounter information flows that are not explicitly allowed by information flow policies. Security attributes can also include source and destination addresses employed in traffic filter firewalls. Flow enforcement using explicit security attributes can be used, for example, to control the release of certain types of information. This requirement enhances SP 800-171 requirement 03.01.03.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

{{ insert: param, A.03.01.10E.ODP.01 }} associated with {{ insert: param, A.03.01.10E.ODP.02 }}, {{ insert: param, A.03.01.10E.ODP.03 }}, and {{ insert: param, A.03.01.10E.ODP.04 }} are used to enforce {{ insert: param, A.03.01.10E.ODP.05 }} as a basis for flow control decisions.

Assessment method

• Access control policy information flow control policies procedures addressing information flow enforcement system design documentation system configuration settings and associated documentation list of security attributes and associated source and destination objects system audit records system security plan other relevant documents or records

Assessment method

• System/network administrators personnel with information security responsibilities system developers

Assessment method

• Mechanisms implementing information flow enforcement policy

Statement

• Enforce a role-based access control policy over defined subjects and objects.

• Control access based upon {{ insert: param, A.03.01.11E.ODP.01 }} .

Guidance

Role-based access control (RBAC) is an access control policy that enforces access to objects and system functions based on the defined role (i.e., job function) of the subject. Organizations can create specific roles based on job functions and the authorizations (i.e., privileges) to perform needed operations on the systems associated with the organization-defined roles. When users are assigned to specific roles, they inherit the authorizations or privileges defined for those roles. RBAC simplifies privilege administration for organizations because privileges are not assigned directly to every user (which can be a large number of individuals) but are instead acquired through role assignments. RBAC can also increase security risks if individuals assigned to a role are given access to information beyond what they need to support organizational mission or business functions. RBAC can be implemented as a mandatory or discretionary form of access control. This requirement enhances SP 800-171 requirement 03.01.02.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

a role-based access control policy over defined subjects and objects is enforced.

Assessment objective

access is controlled based upon {{ insert: param, A.03.01.11E.ODP.01 }} .

Assessment method

• Access control policy role-based access control policies procedures addressing access enforcement system design documentation system configuration settings and associated documentation list of roles, users, and associated privileges required to control system access system audit records system security plan other relevant documents or records

Assessment method

• Organizational personnel with access enforcement responsibilities system/network administrators organizational personnel with information security responsibilities system developers

Assessment method

• Mechanisms implementing role-based access control policy

Statement

Separate CUI flows logically or physically using {{ insert: param, A.03.01.12E.ODP.01 }}.

Guidance

Enforcing the separation of information flows associated with defined types of data can enhance protection by ensuring that CUI is not commingled while in transit and by enabling flow control by transmission paths that are not otherwise achievable. This requirement enhances SP 800-171 requirement 03.01.03.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

CUI flows are logically or physically separated using {{ insert: param, A.03.01.12E.ODP.01 }}.

Assessment method

• Information flow enforcement policy information flow control policies procedures addressing information flow enforcement system design documentation system configuration settings and associated documentation list of required separation of information flows by information types list of mechanisms and/or techniques used to logically or physically separate information flows system audit records system security plan other relevant documents or records

Assessment method

• Organizational personnel with information flow enforcement responsibilities system/network administrators organizational personnel with information security responsibilities system developers

Assessment method

• Mechanisms implementing information flow enforcement functions

Statement

Enforce information flow control based on {{ insert: param, A.03.01.13E.ODP.01 }}.

Guidance

Metadata is information that describes the characteristics of data. Metadata can include structural metadata that describes data structures or descriptive metadata that describes data content. The enforcement of allowed information flows based on metadata enables simpler and more effective flow control. Organizations consider the trustworthiness of metadata regarding data accuracy (i.e., knowledge that the metadata values are correct with respect to the data), data integrity (i.e., protecting against unauthorized changes to metadata tags), and the binding of metadata to the data payload (i.e., employing sufficiently strong binding techniques with appropriate assurance). This requirement enhances SP 800-171 requirement 03.01.03.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

information flow control based on {{ insert: param, A.03.01.13E.ODP.01 }} is enforced.

Assessment method

• Access control policy information flow control policies procedures addressing information flow enforcement system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Assessment method

• System/network administrators organizational personnel with information security responsibilities system developers

Assessment method

• Mechanisms implementing information flow enforcement policy

Statement

• Enforce information flow control using {{ insert: param, A.03.01.14E.ODP.01 }} as a basis for flow control decisions for {{ insert: param, A.03.01.14E.ODP.02 }}.

• {{ insert: param, A.03.01.14E.ODP.03 }} data after a filter processing failure in accordance with {{ insert: param, A.03.01.14E.ODP.04 }}.

Guidance

Security policy filters for data structures check for maximum file lengths, maximum field sizes, and data/file types for structured and unstructured data. Security policy filters for data content check for specific words, enumerated values or data value ranges, and hidden content. Structured data permits the interpretation of data content by applications. Unstructured data refers to digital information without a data structure or with a data structure that does not facilitate the development of rule sets to address the criticality or sensitivity of information conveyed by the data or the flow enforcement decisions. Unstructured data consists of bitmap objects that are inherently non-language-based (e.g., image, video, or audio files) and textual objects that are based on written or printed languages. This requirement enhances SP 800-171 requirement 03.01.03.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

information flow control is enforced using {{ insert: param, A.03.01.14E.ODP.01 }} as a basis for flow control decisions for {{ insert: param, A.03.01.14E.ODP.02 }}.

Assessment objective

{{ insert: param, A.03.01.14E.ODP.03 }} data after a filter processing failure in accordance with {{ insert: param, A.03.01.14E.ODP.04 }}.

Assessment method

• Access control policy information flow control policies procedures addressing information flow enforcement system design documentation system configuration settings and associated documentation list of security policy filters regulating flow control decisions system audit records system security plan other relevant documents or records

Assessment method

• System/network administrators organizational personnel with information security responsibilities system developers

Assessment method

• Mechanisms implementing information flow enforcement policy security policy filters

Statement

Use {{ insert: param, A.03.01.15E.ODP.01 }} to validate data that is essential for information flow decisions when transferring CUI between security domains.

Guidance

Data type identifiers include filenames, file types, file signatures or tokens, and multiple internal file signatures or tokens. Systems only allow for the transfer of data that is compliant with data type format specifications. The identification and validation of data types is based on defined specifications associated with each allowed data format. The filename and number alone are not used for data type identification. Content is validated syntactically and semantically against its specification to ensure that it is the proper data type. This requirement enhances SP 800-171 requirement 03.01.03.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

when transferring information between security domains, {{ insert: param, A.03.01.15E.ODP.01 }} are used to validate data that is essential for information flow decisions.

Assessment method

• Access control policy information flow control policies procedures addressing information flow enforcement system design documentation system configuration settings and associated documentation list of data type identifiers system audit records system security plan other relevant documents or records

Assessment method

• System/network administrators organizational personnel with information security responsibilities system developers

Assessment method

• Mechanisms implementing information flow enforcement policy

Statement

Decompose CUI into {{ insert: param, A.03.01.16E.ODP.01 }} for submission to policy enforcement mechanisms when transferring CUI between different security domains.

Guidance

Decomposing CUI into policy-relevant subcomponents prior to information transfer facilitates policy decisions on source, destination, certificates, and other security-related component differentiators. Policy enforcement mechanisms apply filtering, inspection, and/or sanitization rules to the policy-relevant subcomponents of information to facilitate flow enforcement prior to transferring such information to different security domains. This requirement enhances SP 800-171 requirement 03.01.03.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

when transferring information between different security domains, CUI is decomposed into {{ insert: param, A.03.01.16E.ODP.01 }} for submission to policy enforcement mechanisms

Assessment method

• Access control policy information flow control policies procedures addressing information flow enforcement system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Assessment method

• System/network administrators personnel with information security responsibilities system developers

Assessment method

• Mechanisms implementing information flow enforcement policy

Statement

• Examine CUI for the presence of {{ insert: param, A.03.01.17E.ODP.01 }} when transferring information between different security domains.

• Prohibit the transfer of the CUI defined in 03.01.17E.a in accordance with the {{ insert: param, A.03.01.17E.ODP.02 }}.

Guidance

Unsanctioned information includes malicious code, information that is inappropriate for release from the source network, information that is not authorized to be stored or processed on the system, or executable code that could disrupt or harm services or systems on the destination network. This requirement enhances SP 800-171 requirement 03.01.03.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

when transferring information between different security domains, information is examined for the presence of {{ insert: param, A.03.01.17E.ODP.01 }} .

Assessment objective

the transfer of CUI defined in 03.01.17E.a is prohibited in accordance with {{ insert: param, A.03.01.17E.ODP.02 }}.

Assessment method

• Access control policy information flow control policies procedures addressing information flow enforcement system design documentation system configuration settings and associated documentation list of unsanctioned information types and associated information system audit records system security plan other relevant documents or records

Assessment method

• Organizational personnel with information security responsibilities system developers

Assessment method

• Mechanisms implementing information flow enforcement policy