AC-16 Security and Privacy Attributes

Assessment Objective

Determine if:

AC-16a.
- AC-16a.[01] the means to associate [Assignment: types of security attributes] with [Assignment: security attribute values] for information in storage, in process, and/or in transmission are provided;
- AC-16a.[02] the means to associate [Assignment: types of privacy attributes] with [Assignment: privacy attribute values] for information in storage, in process, and/or in transmission are provided;
AC-16b.
- AC-16b.[01] attribute associations are made;
- AC-16b.[02] attribute associations are retained with the information;
AC-16c.
- AC-16c.[01] the following permitted security attributes are established from the attributes defined in AC-16_ODP[01] for [Assignment: systems]: [Assignment: security attributes];
- AC-16c.[02] the following permitted privacy attributes are established from the attributes defined in AC-16_ODP[02] for [Assignment: systems]: [Assignment: privacy attributes];
AC-16d. the following permitted attribute values or ranges for each of the established attributes are determined: [Assignment: attribute values or ranges];
AC-16e. changes to attributes are audited;
AC-16f.
- AC-16f.[01] [Assignment: security attributes] are reviewed for applicability [Assignment: frequency];
- AC-16f.[02] [Assignment: privacy attributes] are reviewed for applicability [Assignment: frequency].

Access control policy
procedures addressing the association of security and privacy attributes to information in storage, in process, and in transmission
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
privacy plan
other relevant documents or records

Organizational capability supporting and maintaining the association of security and privacy attributes to information in storage, in process, and in transmission

Powiązania
Typ powiązania	Zgłoszenie
blocks	AC-16 Security and Privacy Attributes