Assessment Objective

Determine if:

• AC-16(06)[01] personnel are required to associate and maintain the association of [Assignment: security attributes] with [Assignment: subjects] in accordance with [Assignment: security policies];
• AC-16(06)[02] personnel are required to associate and maintain the association of [Assignment: security attributes] with [Assignment: objects] in accordance with [Assignment: security policies];
• AC-16(06)[03] personnel are required to associate and maintain the association of [Assignment: privacy attributes] with [Assignment: subjects] in accordance with [Assignment: privacy policies];
• AC-16(06)[04] personnel are required to associate and maintain the association of [Assignment: privacy attributes] with [Assignment: objects] in accordance with [Assignment: privacy policies].

Assessment Methods

Examine

• Access control policy
• procedures addressing association of security and privacy attributes with subjects and objects
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for associating and maintaining association of security and privacy attributes with subjects and objects
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Mechanisms supporting associations of security and privacy attributes to subjects and objects

Pedidos ligados

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final