/
800-53-controls.rst
17695 lines (9698 loc) · 848 KB
/
800-53-controls.rst
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
:tocdepth: 2
NIST 800-53 Rev4
================
Control Family: ACCESS CONTROL
-------------------------------
.. _AC-1:
AC-1 : ACCESS CONTROL POLICY AND PROCEDURES
"""""""""""""""""""""""""""""""""""""""""""
**Priority:** P1
**Baseline-Impact:** LOW, *MODERATE*, **HIGH**
The organization:
.. NOTE::
This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AC family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures.
**Related Controls:** `PM-9`_
.. _AC-1a.:
AC-1a.
""""""
Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:
.. _AC-1a.1.:
AC-1a.1.
""""""""
An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
.. _AC-1a.2.:
AC-1a.2.
""""""""
Procedures to facilitate the implementation of the access control policy and associated access controls; and
.. _AC-1b.:
AC-1b.
""""""
Reviews and updates the current:
.. _AC-1b.1.:
AC-1b.1.
""""""""
Access control policy [Assignment: organization-defined frequency]; and
.. _AC-1b.2.:
AC-1b.2.
""""""""
Access control procedures [Assignment: organization-defined frequency].
Control Family: ACCESS CONTROL
-------------------------------
.. _AC-2:
AC-2 : ACCOUNT MANAGEMENT
"""""""""""""""""""""""""
**Priority:** P1
**Baseline-Impact:** LOW, *MODERATE*, **HIGH**
The organization:
.. NOTE::
Information system account types include, for example, individual, shared, group, system, guest/anonymous, emergency, developer/manufacturer/vendor, temporary, and service. Some of the account management requirements listed above can be implemented by organizational information systems. The identification of authorized users of the information system and the specification of access privileges reflects the requirements in other security controls in the security plan. Users requiring administrative privileges on information system accounts receive additional scrutiny by appropriate organizational personnel (e.g., system owner, mission/business owner, or chief information security officer) responsible for approving such accounts and privileged access. Organizations may choose to define access privileges or other attributes by account, by type of account, or a combination of both. Other attributes required for authorizing access include, for example, restrictions on time-of-day, day-of-week, and point-of-origin. In defining other account attributes, organizations consider system-related requirements (e.g., scheduled maintenance, system upgrades) and mission/business requirements, (e.g., time zone differences, customer requirements, remote access to support travel requirements). Failure to consider these factors could affect information system availability. Temporary and emergency accounts are accounts intended for short-term use. Organizations establish temporary accounts as a part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. Organizations establish emergency accounts in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes. Emergency and temporary accounts are not to be confused with infrequently used accounts (e.g., local logon accounts used for special tasks defined by organizations or when network resources are unavailable). Such accounts remain available and are not subject to automatic disabling or removal dates. Conditions for disabling or deactivating accounts include, for example: (i) when shared/group, emergency, or temporary accounts are no longer required; or (ii) when individuals are transferred or terminated. Some types of information system accounts may require specialized training.
**Related Controls:** `AC-3`_, `AC-4`_, `AC-5`_, `AC-6`_, `AC-10`_, `AC-17`_, `AC-19`_, `AC-20`_, `AU-9`_, `IA-2`_, `IA-4`_, `IA-5`_, `IA-8`_, `CM-5`_, `CM-6`_, `CM-11`_, `MA-3`_, `MA-4`_, `MA-5`_, `PL-4`_, `SC-13`_
.. _AC-2a.:
AC-2a.
""""""
Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types];
.. _AC-2b.:
AC-2b.
""""""
Assigns account managers for information system accounts;
.. _AC-2c.:
AC-2c.
""""""
Establishes conditions for group and role membership;
.. _AC-2d.:
AC-2d.
""""""
Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;
.. _AC-2e.:
AC-2e.
""""""
Requires approvals by [Assignment: organization-defined personnel or roles] for requests to create information system accounts;
.. _AC-2f.:
AC-2f.
""""""
Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions];
.. _AC-2g.:
AC-2g.
""""""
Monitors the use of information system accounts;
.. _AC-2h.:
AC-2h.
""""""
Notifies account managers:
.. _AC-2h.1.:
AC-2h.1.
""""""""
When accounts are no longer required;
.. _AC-2h.2.:
AC-2h.2.
""""""""
When users are terminated or transferred; and
.. _AC-2h.3.:
AC-2h.3.
""""""""
When individual information system usage or need-to-know changes;
.. _AC-2i.:
AC-2i.
""""""
Authorizes access to the information system based on:
.. _AC-2i.1.:
AC-2i.1.
""""""""
A valid access authorization;
.. _AC-2i.2.:
AC-2i.2.
""""""""
Intended system usage; and
.. _AC-2i.3.:
AC-2i.3.
""""""""
Other attributes as required by the organization or associated missions/business functions;
.. _AC-2j.:
AC-2j.
""""""
Reviews accounts for compliance with account management requirements [Assignment: organization-defined frequency]; and
.. _AC-2k.:
AC-2k.
""""""
Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.
.. _AC-2 (1):
AC-2 (1) : AUTOMATED SYSTEM ACCOUNT MANAGEMENT
""""""""""""""""""""""""""""""""""""""""""""""
**Baseline-Impact:** *MODERATE*, **HIGH**
The organization employs automated mechanisms to support the management of information system accounts.
.. NOTE::
The use of automated mechanisms can include, for example: using email or text messaging to automatically notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using telephonic notification to report atypical system account usage.
.. _AC-2 (2):
AC-2 (2) : REMOVAL OF TEMPORARY / EMERGENCY ACCOUNTS
""""""""""""""""""""""""""""""""""""""""""""""""""""
**Baseline-Impact:** *MODERATE*, **HIGH**
The information system automatically [Selection: removes; disables] temporary and emergency accounts after [Assignment: organization-defined time period for each type of account].
.. NOTE::
This control enhancement requires the removal of both temporary and emergency accounts automatically after a predefined period of time has elapsed, rather than at the convenience of the systems administrator.
.. _AC-2 (3):
AC-2 (3) : DISABLE INACTIVE ACCOUNTS
""""""""""""""""""""""""""""""""""""
**Baseline-Impact:** *MODERATE*, **HIGH**
The information system automatically disables inactive accounts after [Assignment: organization-defined time period].
.. _AC-2 (4):
AC-2 (4) : AUTOMATED AUDIT ACTIONS
""""""""""""""""""""""""""""""""""
**Baseline-Impact:** *MODERATE*, **HIGH**
The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles].
**Related Controls:** `AU-2`_, `AU-12`_
.. _AC-2 (5):
AC-2 (5) : INACTIVITY LOGOUT
""""""""""""""""""""""""""""
**Baseline-Impact:** **HIGH**
The organization requires that users log out when [Assignment: organization-defined time-period of expected inactivity or description of when to log out].
**Related Controls:** `SC-23`_
.. _AC-2 (6):
AC-2 (6) : DYNAMIC PRIVILEGE MANAGEMENT
"""""""""""""""""""""""""""""""""""""""
The information system implements the following dynamic privilege management capabilities: [Assignment: organization-defined list of dynamic privilege management capabilities].
.. NOTE::
In contrast to conventional access control approaches which employ static information system accounts and predefined sets of user privileges, dynamic access control approaches (e.g., service-oriented architectures) rely on run time access control decisions facilitated by dynamic privilege management. While user identities may remain relatively constant over time, user privileges may change more frequently based on ongoing mission/business requirements and operational needs of organizations. Dynamic privilege management can include, for example, the immediate revocation of privileges from users, as opposed to requiring that users terminate and restart their sessions to reflect any changes in privileges. Dynamic privilege management can also refer to mechanisms that change the privileges of users based on dynamic rules as opposed to editing specific user profiles. This type of privilege management includes, for example, automatic adjustments of privileges if users are operating out of their normal work times, or if information systems are under duress or in emergency maintenance situations. This control enhancement also includes the ancillary effects of privilege changes, for example, the potential changes to encryption keys used for communications. Dynamic privilege management can support requirements for information system resiliency.
**Related Controls:** `AC-16`_
.. _AC-2 (7):
AC-2 (7) : ROLE-BASED SCHEMES
"""""""""""""""""""""""""""""
The organization:
.. NOTE::
Privileged roles are organization-defined roles assigned to individuals that allow those individuals to perform certain security-relevant functions that ordinary users are not authorized to perform. These privileged roles include, for example, key management, account management, network and system administration, database administration, and web administration.
.. _AC-2 (7)(a):
AC-2 (7)(a)
"""""""""""
Establishes and administers privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles;
.. _AC-2 (7)(b):
AC-2 (7)(b)
"""""""""""
Monitors privileged role assignments; and
.. _AC-2 (7)(c):
AC-2 (7)(c)
"""""""""""
Takes [Assignment: organization-defined actions] when privileged role assignments are no longer appropriate.
.. _AC-2 (8):
AC-2 (8) : DYNAMIC ACCOUNT CREATION
"""""""""""""""""""""""""""""""""""
The information system creates [Assignment: organization-defined information system accounts] dynamically.
.. NOTE::
Dynamic approaches for creating information system accounts (e.g., as implemented within service-oriented architectures) rely on establishing accounts (identities) at run time for entities that were previously unknown. Organizations plan for dynamic creation of information system accounts by establishing trust relationships and mechanisms with the appropriate authorities to validate related authorizations and privileges.
**Related Controls:** `AC-16`_
.. _AC-2 (9):
AC-2 (9) : RESTRICTIONS ON USE OF SHARED / GROUP ACCOUNTS
"""""""""""""""""""""""""""""""""""""""""""""""""""""""""
The organization only permits the use of shared/group accounts that meet [Assignment: organization-defined conditions for establishing shared/group accounts].
.. _AC-2 (10):
AC-2 (10) : SHARED / GROUP ACCOUNT CREDENTIAL TERMINATION
"""""""""""""""""""""""""""""""""""""""""""""""""""""""""
The information system terminates shared/group account credentials when members leave the group.
.. _AC-2 (11):
AC-2 (11) : USAGE CONDITIONS
""""""""""""""""""""""""""""
**Baseline-Impact:** **HIGH**
The information system enforces [Assignment: organization-defined circumstances and/or usage conditions] for [Assignment: organization-defined information system accounts].
.. NOTE::
Organizations can describe the specific conditions or circumstances under which information system accounts can be used, for example, by restricting usage to certain days of the week, time of day, or specific durations of time.
.. _AC-2 (12):
AC-2 (12) : ACCOUNT MONITORING / ATYPICAL USAGE
"""""""""""""""""""""""""""""""""""""""""""""""
**Baseline-Impact:** **HIGH**
The organization:
.. NOTE::
Atypical usage includes, for example, accessing information systems at certain times of the day and from locations that are not consistent with the normal usage patterns of individuals working in organizations.
**Related Controls:** `CA-7`_
.. _AC-2 (12)(a):
AC-2 (12)(a)
""""""""""""
Monitors information system accounts for [Assignment: organization-defined atypical usage]; and
.. _AC-2 (12)(b):
AC-2 (12)(b)
""""""""""""
Reports atypical usage of information system accounts to [Assignment: organization-defined personnel or roles].
.. _AC-2 (13):
AC-2 (13) : DISABLE ACCOUNTS FOR HIGH-RISK INDIVIDUALS
""""""""""""""""""""""""""""""""""""""""""""""""""""""
**Baseline-Impact:** **HIGH**
The organization disables accounts of users posing a significant risk within [Assignment: organization-defined time period] of discovery of the risk.
.. NOTE::
Users posing a significant risk to organizations include individuals for whom reliable evidence or intelligence indicates either the intention to use authorized access to information systems to cause harm or through whom adversaries will cause harm. Harm includes potential adverse impacts to organizational operations and assets, individuals, other organizations, or the Nation. Close coordination between authorizing officials, information system administrators, and human resource managers is essential in order for timely execution of this control enhancement.
**Related Controls:** `PS-4`_
Control Family: ACCESS CONTROL
-------------------------------
.. _AC-3:
AC-3 : ACCESS ENFORCEMENT
"""""""""""""""""""""""""
**Priority:** P1
**Baseline-Impact:** LOW, *MODERATE*, **HIGH**
The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
.. NOTE::
Access control policies (e.g., identity-based policies, role-based policies, control matrices, cryptography) control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (e.g., devices, files, records, domains) in information systems. In addition to enforcing authorized access at the information system level and recognizing that information systems can host many applications and services in support of organizational missions and business operations, access enforcement mechanisms can also be employed at the application and service level to provide increased information security.
**Related Controls:** `AC-2`_, `AC-4`_, `AC-5`_, `AC-6`_, `AC-16`_, `AC-17`_, `AC-18`_, `AC-19`_, `AC-20`_, `AC-21`_, `AC-22`_, `AU-9`_, `CM-5`_, `CM-6`_, `CM-11`_, `MA-3`_, `MA-4`_, `MA-5`_, `PE-3`_
.. _AC-3 (1):
AC-3 (1) : RESTRICTED ACCESS TO PRIVILEGED FUNCTIONS
""""""""""""""""""""""""""""""""""""""""""""""""""""
[Withdrawn: Incorporated into AC-6].
.. _AC-3 (2):
AC-3 (2) : DUAL AUTHORIZATION
"""""""""""""""""""""""""""""
The information system enforces dual authorization for [Assignment: organization-defined privileged commands and/or other organization-defined actions].
.. NOTE::
Dual authorization mechanisms require the approval of two authorized individuals in order to execute. Organizations do not require dual authorization mechanisms when immediate responses are necessary to ensure public and environmental safety. Dual authorization may also be known as two-person control.
**Related Controls:** `CP-9`_, `MP-6`_
.. _AC-3 (3):
AC-3 (3) : MANDATORY ACCESS CONTROL
"""""""""""""""""""""""""""""""""""
The information system enforces [Assignment: organization-defined mandatory access control policy] over all subjects and objects where the policy:
.. NOTE::
Mandatory access control as defined in this control enhancement is synonymous with nondiscretionary access control, and is not constrained only to certain historical uses (e.g., implementations using the Bell-LaPadula Model). The above class of mandatory access control policies constrains what actions subjects can take with information obtained from data objects for which they have already been granted access, thus preventing the subjects from passing the information to unauthorized subjects and objects. This class of mandatory access control policies also constrains what actions subjects can take with respect to the propagation of access control privileges; that is, a subject with a privilege cannot pass that privilege to other subjects. The policy is uniformly enforced over all subjects and objects to which the information system has control. Otherwise, the access control policy can be circumvented. This enforcement typically is provided via an implementation that meets the reference monitor concept (see AC-25). The policy is bounded by the information system boundary (i.e., once the information is passed outside of the control of the system, additional means may be required to ensure that the constraints on the information remain in effect). The trusted subjects described above are granted privileges consistent with the concept of least privilege (see AC-6). Trusted subjects are only given the minimum privileges relative to the above policy necessary for satisfying organizational mission/business needs. The control is most applicable when there is some policy mandate (e.g., law, Executive Order, directive, or regulation) that establishes a policy regarding access to sensitive/classified information and some users of the information system are not authorized access to all sensitive/classified information resident in the information system. This control can operate in conjunction with AC-3 (4). A subject that is constrained in its operation by policies governed by this control is still able to operate under the less rigorous constraints of AC-3 (4), but policies governed by this control take precedence over the less rigorous constraints of AC-3 (4). For example, while a mandatory access control policy imposes a constraint preventing a subject from passing information to another subject operating at a different sensitivity label, AC-3 (4) permits the subject to pass the information to any subject with the same sensitivity label as the subject.
**Related Controls:** `AC-25`_, `SC-11`_
.. _AC-3 (3)(a):
AC-3 (3)(a)
"""""""""""
Is uniformly enforced across all subjects and objects within the boundary of the information system;
.. _AC-3 (3)(b):
AC-3 (3)(b)
"""""""""""
Specifies that a subject that has been granted access to information is constrained from doing any of the following;
.. _AC-3 (3)(b)(1):
AC-3 (3)(b)(1)
""""""""""""""
Passing the information to unauthorized subjects or objects;
.. _AC-3 (3)(b)(2):
AC-3 (3)(b)(2)
""""""""""""""
Granting its privileges to other subjects;
.. _AC-3 (3)(b)(3):
AC-3 (3)(b)(3)
""""""""""""""
Changing one or more security attributes on subjects, objects, the information system, or information system components;
.. _AC-3 (3)(b)(4):
AC-3 (3)(b)(4)
""""""""""""""
Choosing the security attributes and attribute values to be associated with newly created or modified objects; or
.. _AC-3 (3)(b)(5):
AC-3 (3)(b)(5)
""""""""""""""
Changing the rules governing access control; and
.. _AC-3 (3)(c):
AC-3 (3)(c)
"""""""""""
Specifies that [Assignment: organization-defined subjects] may explicitly be granted [Assignment: organization-defined privileges (i.e., they are trusted subjects)] such that they are not limited by some or all of the above constraints.
.. _AC-3 (4):
AC-3 (4) : DISCRETIONARY ACCESS CONTROL
"""""""""""""""""""""""""""""""""""""""
The information system enforces [Assignment: organization-defined discretionary access control policy] over defined subjects and objects where the policy specifies that a subject that has been granted access to information can do one or more of the following:
.. NOTE::
When discretionary access control policies are implemented, subjects are not constrained with regard to what actions they can take with information for which they have already been granted access. Thus, subjects that have been granted access to information are not prevented from passing (i.e., the subjects have the discretion to pass) the information to other subjects or objects. This control enhancement can operate in conjunction with AC-3 (3). A subject that is constrained in its operation by policies governed by AC-3 (3) is still able to operate under the less rigorous constraints of this control enhancement. Thus, while AC-3 (3) imposes constraints preventing a subject from passing information to another subject operating at a different sensitivity level, AC-3 (4) permits the subject to pass the information to any subject at the same sensitivity level. The policy is bounded by the information system boundary. Once the information is passed outside of the control of the information system, additional means may be required to ensure that the constraints remain in effect. While the older, more traditional definitions of discretionary access control require identity-based access control, that limitation is not required for this use of discretionary access control.
.. _AC-3 (4)(a):
AC-3 (4)(a)
"""""""""""
Pass the information to any other subjects or objects;
.. _AC-3 (4)(b):
AC-3 (4)(b)
"""""""""""
Grant its privileges to other subjects;
.. _AC-3 (4)(c):
AC-3 (4)(c)
"""""""""""
Change security attributes on subjects, objects, the information system, or the information system�s components;
.. _AC-3 (4)(d):
AC-3 (4)(d)
"""""""""""
Choose the security attributes to be associated with newly created or revised objects; or
.. _AC-3 (4)(e):
AC-3 (4)(e)
"""""""""""
Change the rules governing access control.
.. _AC-3 (5):
AC-3 (5) : SECURITY-RELEVANT INFORMATION
""""""""""""""""""""""""""""""""""""""""
The information system prevents access to [Assignment: organization-defined security-relevant information] except during secure, non-operable system states.
.. NOTE::
Security-relevant information is any information within information systems that can potentially impact the operation of security functions or the provision of security services in a manner that could result in failure to enforce system security policies or maintain the isolation of code and data. Security-relevant information includes, for example, filtering rules for routers/firewalls, cryptographic key management information, configuration parameters for security services, and access control lists. Secure, non-operable system states include the times in which information systems are not performing mission/business-related processing (e.g., the system is off-line for maintenance, troubleshooting, boot-up, shut down).
**Related Controls:** `CM-3`_
.. _AC-3 (6):
AC-3 (6) : PROTECTION OF USER AND SYSTEM INFORMATION
""""""""""""""""""""""""""""""""""""""""""""""""""""
[Withdrawn: Incorporated into MP-4 and SC-28].
.. _AC-3 (7):
AC-3 (7) : ROLE-BASED ACCESS CONTROL
""""""""""""""""""""""""""""""""""""
The information system enforces a role-based access control policy over defined subjects and objects and controls access based upon [Assignment: organization-defined roles and users authorized to assume such roles].
.. NOTE::
Role-based access control (RBAC) is an access control policy that restricts information system access to authorized users. Organizations can create specific roles based on job functions and the authorizations (i.e., privileges) to perform needed operations on organizational information systems associated with the organization-defined roles. When users are assigned to the organizational roles, they inherit the authorizations or privileges defined for those roles. RBAC simplifies privilege administration for organizations because privileges are not assigned directly to every user (which can be a significant number of individuals for mid- to large-size organizations) but are instead acquired through role assignments. RBAC can be implemented either as a mandatory or discretionary form of access control. For organizations implementing RBAC with mandatory access controls, the requirements in AC-3 (3) define the scope of the subjects and objects covered by the policy.
.. _AC-3 (8):
AC-3 (8) : REVOCATION OF ACCESS AUTHORIZATIONS
""""""""""""""""""""""""""""""""""""""""""""""
The information system enforces the revocation of access authorizations resulting from changes to the security attributes of subjects and objects based on [Assignment: organization-defined rules governing the timing of revocations of access authorizations].
.. NOTE::
Revocation of access rules may differ based on the types of access revoked. For example, if a subject (i.e., user or process) is removed from a group, access may not be revoked until the next time the object (e.g., file) is opened or until the next time the subject attempts a new access to the object. Revocation based on changes to security labels may take effect immediately. Organizations can provide alternative approaches on how to make revocations immediate if information systems cannot provide such capability and immediate revocation is necessary.
.. _AC-3 (9):
AC-3 (9) : CONTROLLED RELEASE
"""""""""""""""""""""""""""""
The information system does not release information outside of the established system boundary unless:
.. NOTE::
Information systems can only protect organizational information within the confines of established system boundaries. Additional security safeguards may be needed to ensure that such information is adequately protected once it is passed beyond the established information system boundaries. Examples of information leaving the system boundary include transmitting information to an external information system or printing the information on one of its printers. In cases where the information system is unable to make a determination of the adequacy of the protections provided by entities outside its boundary, as a mitigating control, organizations determine procedurally whether the external information systems are providing adequate security. The means used to determine the adequacy of the security provided by external information systems include, for example, conducting inspections or periodic testing, establishing agreements between the organization and its counterpart organizations, or some other process. The means used by external entities to protect the information received need not be the same as those used by the organization, but the means employed are sufficient to provide consistent adjudication of the security policy to protect the information. This control enhancement requires information systems to employ technical or procedural means to validate the information prior to releasing it to external systems. For example, if the information system passes information to another system controlled by another organization, technical means are employed to validate that the security attributes associated with the exported information are appropriate for the receiving system. Alternatively, if the information system passes information to a printer in organization-controlled space, procedural means can be employed to ensure that only appropriately authorized individuals gain access to the printer. This control enhancement is most applicable when there is some policy mandate (e.g., law, Executive Order, directive, or regulation) that establishes policy regarding access to the information, and that policy applies beyond the realm of a particular information system or organization.
.. _AC-3 (9)(a):
AC-3 (9)(a)
"""""""""""
The receiving [Assignment: organization-defined information system or system component] provides [Assignment: organization-defined security safeguards]; and
.. _AC-3 (9)(b):
AC-3 (9)(b)
"""""""""""
[Assignment: organization-defined security safeguards] are used to validate the appropriateness of the information designated for release.
.. _AC-3 (10):
AC-3 (10) : AUDITED OVERRIDE OF ACCESS CONTROL MECHANISMS
"""""""""""""""""""""""""""""""""""""""""""""""""""""""""
The organization employs an audited override of automated access control mechanisms under [Assignment: organization-defined conditions].
**Related Controls:** `AU-2`_, `AU-6`_
Control Family: ACCESS CONTROL
-------------------------------
.. _AC-4:
AC-4 : INFORMATION FLOW ENFORCEMENT
"""""""""""""""""""""""""""""""""""
**Priority:** P1
**Baseline-Impact:** *MODERATE*, **HIGH**
The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on [Assignment: organization-defined information flow control policies].
.. NOTE::
Information flow control regulates where information is allowed to travel within an information system and between information systems (as opposed to who is allowed to access the information) and without explicit regard to subsequent accesses to that information. Flow control restrictions include, for example, keeping export-controlled information from being transmitted in the clear to the Internet, blocking outside traffic that claims to be from within the organization, restricting web requests to the Internet that are not from the internal web proxy server, and limiting information transfers between organizations based on data structures and content. Transferring information between information systems representing different security domains with different security policies introduces risk that such transfers violate one or more domain security policies. In such situations, information owners/stewards provide guidance at designated policy enforcement points between interconnected systems. Organizations consider mandating specific architectural solutions when required to enforce specific security policies. Enforcement includes, for example: (i) prohibiting information transfers between interconnected systems (i.e., allowing access only); (ii) employing hardware mechanisms to enforce one-way information flows; and (iii) implementing trustworthy regrading mechanisms to reassign security attributes and security labels.
Organizations commonly employ information flow control policies and enforcement mechanisms to control the flow of information between designated sources and destinations (e.g., networks, individuals, and devices) within information systems and between interconnected systems. Flow control is based on the characteristics of the information and/or the information path. Enforcement occurs, for example, in boundary protection devices (e.g., gateways, routers, guards, encrypted tunnels, firewalls) that employ rule sets or establish configuration settings that restrict information system services, provide a packet-filtering capability based on header information, or message-filtering capability based on message content (e.g., implementing key word searches or using document characteristics). Organizations also consider the trustworthiness of filtering/inspection mechanisms (i.e., hardware, firmware, and software components) that are critical to information flow enforcement. Control enhancements 3 through 22 primarily address cross-domain solution needs which focus on more advanced filtering techniques, in-depth analysis, and stronger flow enforcement mechanisms implemented in cross-domain products, for example, high-assurance guards. Such capabilities are generally not available in commercial off-the-shelf information technology products.
**Related Controls:** `AC-3`_, `AC-17`_, `AC-19`_, `AC-21`_, `CM-6`_, `CM-7`_, `SA-8`_, `SC-2`_, `SC-5`_, `SC-7`_, `SC-18`_
.. _AC-4 (1):
AC-4 (1) : OBJECT SECURITY ATTRIBUTES
"""""""""""""""""""""""""""""""""""""
The information system uses [Assignment: organization-defined security attributes] associated with [Assignment: organization-defined information, source, and destination objects] to enforce [Assignment: organization-defined information flow control policies] as a basis for flow control decisions.
.. NOTE::
Information flow enforcement mechanisms compare security attributes associated with information (data content and data structure) and source/destination objects, and respond appropriately (e.g., block, quarantine, alert administrator) when the mechanisms encounter information flows not explicitly allowed by information flow policies. For example, an information object labeled Secret would be allowed to flow to a destination object labeled Secret, but an information object labeled Top Secret would not be allowed to flow to a destination object labeled Secret. Security attributes can also include, for example, source and destination addresses employed in traffic filter firewalls. Flow enforcement using explicit security attributes can be used, for example, to control the release of certain types of information.
**Related Controls:** `AC-16`_
.. _AC-4 (2):
AC-4 (2) : PROCESSING DOMAINS
"""""""""""""""""""""""""""""
The information system uses protected processing domains to enforce [Assignment: organization-defined information flow control policies] as a basis for flow control decisions.
.. NOTE::
Within information systems, protected processing domains are processing spaces that have controlled interactions with other processing spaces, thus enabling control of information flows between these spaces and to/from data/information objects. A protected processing domain can be provided, for example, by implementing domain and type enforcement. In domain and type enforcement, information system processes are assigned to domains; information is identified by types; and information flows are controlled based on allowed information accesses (determined by domain and type), allowed signaling among domains, and allowed process transitions to other domains.
.. _AC-4 (3):
AC-4 (3) : DYNAMIC INFORMATION FLOW CONTROL
"""""""""""""""""""""""""""""""""""""""""""
The information system enforces dynamic information flow control based on [Assignment: organization-defined policies].
.. NOTE::
Organizational policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changing conditions or mission/operational considerations. Changing conditions include, for example, changes in organizational risk tolerance due to changes in the immediacy of mission/business needs, changes in the threat environment, and detection of potentially harmful or adverse events.
**Related Controls:** `SI-4`_
.. _AC-4 (4):
AC-4 (4) : CONTENT CHECK ENCRYPTED INFORMATION
""""""""""""""""""""""""""""""""""""""""""""""
The information system prevents encrypted information from bypassing content-checking mechanisms by [Selection (one or more): decrypting the information; blocking the flow of the encrypted information; terminating communications sessions attempting to pass encrypted information; [Assignment: organization-defined procedure or method]].
**Related Controls:** `SI-4`_
.. _AC-4 (5):
AC-4 (5) : EMBEDDED DATA TYPES
""""""""""""""""""""""""""""""
The information system enforces [Assignment: organization-defined limitations] on embedding data types within other data types.
.. NOTE::
Embedding data types within other data types may result in reduced flow control effectiveness. Data type embedding includes, for example, inserting executable files as objects within word processing files, inserting references or descriptive information into a media file, and compressed or archived data types that may include multiple embedded data types. Limitations on data type embedding consider the levels of embedding and prohibit levels of data type embedding that are beyond the capability of the inspection tools.
.. _AC-4 (6):
AC-4 (6) : METADATA
"""""""""""""""""""
The information system enforces information flow control based on [Assignment: organization-defined metadata].
.. NOTE::
Metadata is information used to describe the characteristics of data. Metadata can include structural metadata describing data structures (e.g., data format, syntax, and semantics) or descriptive metadata describing data contents (e.g., age, location, telephone number). Enforcing allowed information flows based on metadata enables simpler and more effective flow control. Organizations consider the trustworthiness of metadata with regard to data accuracy (i.e., knowledge that the metadata values are correct with respect to the data), data integrity (i.e., protecting against unauthorized changes to metadata tags), and the binding of metadata to the data payload (i.e., ensuring sufficiently strong binding techniques with appropriate levels of assurance).
**Related Controls:** `AC-16`_, `SI-7`_
.. _AC-4 (7):
AC-4 (7) : ONE-WAY FLOW MECHANISMS
""""""""""""""""""""""""""""""""""
The information system enforces [Assignment: organization-defined one-way information flows] using hardware mechanisms.
.. _AC-4 (8):
AC-4 (8) : SECURITY POLICY FILTERS
""""""""""""""""""""""""""""""""""
The information system enforces information flow control using [Assignment: organization-defined security policy filters] as a basis for flow control decisions for [Assignment: organization-defined information flows].
.. NOTE::
Organization-defined security policy filters can address data structures and content. For example, security policy filters for data structures can check for maximum file lengths, maximum field sizes, and data/file types (for structured and unstructured data). Security policy filters for data content can check for specific words (e.g., dirty/clean word filters), enumerated values or data value ranges, and hidden content. Structured data permits the interpretation of data content by applications. Unstructured data typically refers to digital information without a particular data structure or with a data structure that does not facilitate the development of rule sets to address the particular sensitivity of the information conveyed by the data or the associated flow enforcement decisions. Unstructured data consists of: (i) bitmap objects that are inherently non language-based (i.e., image, video, or audio files); and (ii) textual objects that are based on written or printed languages (e.g., commercial off-the-shelf word processing documents, spreadsheets, or emails). Organizations can implement more than one security policy filter to meet information flow control objectives (e.g., employing clean word lists in conjunction with dirty word lists may help to reduce false positives).
.. _AC-4 (9):
AC-4 (9) : HUMAN REVIEWS
""""""""""""""""""""""""
The information system enforces the use of human reviews for [Assignment: organization-defined information flows] under the following conditions: [Assignment: organization-defined conditions].
.. NOTE::
Organizations define security policy filters for all situations where automated flow control decisions are possible. When a fully automated flow control decision is not possible, then a human review may be employed in lieu of, or as a complement to, automated security policy filtering. Human reviews may also be employed as deemed necessary by organizations.
.. _AC-4 (10):
AC-4 (10) : ENABLE / DISABLE SECURITY POLICY FILTERS
""""""""""""""""""""""""""""""""""""""""""""""""""""
The information system provides the capability for privileged administrators to enable/disable [Assignment: organization-defined security policy filters] under the following conditions: [Assignment: organization-defined conditions].
.. NOTE::
For example, as allowed by the information system authorization, administrators can enable security policy filters to accommodate approved data types.
.. _AC-4 (11):
AC-4 (11) : CONFIGURATION OF SECURITY POLICY FILTERS
""""""""""""""""""""""""""""""""""""""""""""""""""""
The information system provides the capability for privileged administrators to configure [Assignment: organization-defined security policy filters] to support different security policies.
.. NOTE::
For example, to reflect changes in security policies, administrators can change the list of �dirty words� that security policy mechanisms check in accordance with the definitions provided by organizations.
.. _AC-4 (12):
AC-4 (12) : DATA TYPE IDENTIFIERS
"""""""""""""""""""""""""""""""""
The information system, when transferring information between different security domains, uses [Assignment: organization-defined data type identifiers] to validate data essential for information flow decisions.
.. NOTE::
Data type identifiers include, for example, filenames, file types, file signatures/tokens, and multiple internal file signatures/tokens. Information systems may allow transfer of data only if compliant with data type format specifications.
.. _AC-4 (13):
AC-4 (13) : DECOMPOSITION INTO POLICY-RELEVANT SUBCOMPONENTS
""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
The information system, when transferring information between different security domains, decomposes information into [Assignment: organization-defined policy-relevant subcomponents] for submission to policy enforcement mechanisms.
.. NOTE::
Policy enforcement mechanisms apply filtering, inspection, and/or sanitization rules to the policy-relevant subcomponents of information to facilitate flow enforcement prior to transferring such information to different security domains. Parsing transfer files facilitates policy decisions on source, destination, certificates, classification, attachments, and other security-related component differentiators.
.. _AC-4 (14):
AC-4 (14) : SECURITY POLICY FILTER CONSTRAINTS
""""""""""""""""""""""""""""""""""""""""""""""
The information system, when transferring information between different security domains, implements [Assignment: organization-defined security policy filters] requiring fully enumerated formats that restrict data structure and content.
.. NOTE::
Data structure and content restrictions reduce the range of potential malicious and/or unsanctioned content in cross-domain transactions. Security policy filters that restrict data structures include, for example, restricting file sizes and field lengths. Data content policy filters include, for example: (i) encoding formats for character sets (e.g., Universal Character Set Transformation Formats, American Standard Code for Information Interchange); (ii) restricting character data fields to only contain alpha-numeric characters; (iii) prohibiting special characters; and (iv) validating schema structures.
.. _AC-4 (15):
AC-4 (15) : DETECTION OF UNSANCTIONED INFORMATION
"""""""""""""""""""""""""""""""""""""""""""""""""
The information system, when transferring information between different security domains, examines the information for the presence of [Assignment: organized-defined unsanctioned information] and prohibits the transfer of such information in accordance with the [Assignment: organization-defined security policy].
.. NOTE::
Detection of unsanctioned information includes, for example, checking all information to be transferred for malicious code and dirty words.
**Related Controls:** `SI-3`_
.. _AC-4 (16):
AC-4 (16) : INFORMATION TRANSFERS ON INTERCONNECTED SYSTEMS
"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
[Withdrawn: Incorporated into AC-4].
.. _AC-4 (17):
AC-4 (17) : DOMAIN AUTHENTICATION
"""""""""""""""""""""""""""""""""
The information system uniquely identifies and authenticates source and destination points by [Selection (one or more): organization, system, application, individual] for information transfer.
.. NOTE::
Attribution is a critical component of a security concept of operations. The ability to identify source and destination points for information flowing in information systems, allows the forensic reconstruction of events when required, and encourages policy compliance by attributing policy violations to specific organizations/individuals. Successful domain authentication requires that information system labels distinguish among systems, organizations, and individuals involved in preparing, sending, receiving, or disseminating information.
**Related Controls:** `IA-2`_, `IA-3`_, `IA-4`_, `IA-5`_
.. _AC-4 (18):
AC-4 (18) : SECURITY ATTRIBUTE BINDING
""""""""""""""""""""""""""""""""""""""
The information system binds security attributes to information using [Assignment: organization-defined binding techniques] to facilitate information flow policy enforcement.
.. NOTE::
Binding techniques implemented by information systems affect the strength of security attribute binding to information. Binding strength and the assurance associated with binding techniques play an important part in the trust organizations have in the information flow enforcement process. The binding techniques affect the number and degree of additional reviews required by organizations.
**Related Controls:** `AC-16`_, `SC-16`_
.. _AC-4 (19):
AC-4 (19) : VALIDATION OF METADATA
""""""""""""""""""""""""""""""""""
The information system, when transferring information between different security domains, applies the same security policy filtering to metadata as it applies to data payloads.
.. NOTE::
This control enhancement requires the validation of metadata and the data to which the metadata applies. Some organizations distinguish between metadata and data payloads (i.e., only the data to which the metadata is bound). Other organizations do not make such distinctions, considering metadata and the data to which the metadata applies as part of the payload. All information (including metadata and the data to which the metadata applies) is subject to filtering and inspection.
.. _AC-4 (20):
AC-4 (20) : APPROVED SOLUTIONS
""""""""""""""""""""""""""""""
The organization employs [Assignment: organization-defined solutions in approved configurations] to control the flow of [Assignment: organization-defined information] across security domains.
.. NOTE::
Organizations define approved solutions and configurations in cross-domain policies and guidance in accordance with the types of information flows across classification boundaries. The Unified Cross Domain Management Office (UCDMO) provides a baseline listing of approved cross-domain solutions.
.. _AC-4 (21):
AC-4 (21) : PHYSICAL / LOGICAL SEPARATION OF INFORMATION FLOWS
""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
The information system separates information flows logically or physically using [Assignment: organization-defined mechanisms and/or techniques] to accomplish [Assignment: organization-defined required separations by types of information].
.. NOTE::
Enforcing the separation of information flows by type can enhance protection by ensuring that information is not commingled while in transit and by enabling flow control by transmission paths perhaps not otherwise achievable. Types of separable information include, for example, inbound and outbound communications traffic, service requests and responses, and information of differing security categories.
.. _AC-4 (22):
AC-4 (22) : ACCESS ONLY
"""""""""""""""""""""""
The information system provides access from a single device to computing platforms, applications, or data residing on multiple different security domains, while preventing any information flow between the different security domains.
.. NOTE::
The information system, for example, provides a desktop for users to access each connected security domain without providing any mechanisms to allow transfer of information between the different security domains.
Control Family: ACCESS CONTROL
-------------------------------
.. _AC-5:
AC-5 : SEPARATION OF DUTIES
"""""""""""""""""""""""""""
**Priority:** P1
**Baseline-Impact:** *MODERATE*, **HIGH**
The organization:
.. NOTE::
Separation of duties addresses the potential for abuse of authorized privileges and helps to reduce the risk of malevolent activity without collusion. Separation of duties includes, for example: (i) dividing mission functions and information system support functions among different individuals and/or roles; (ii) conducting information system support functions with different individuals (e.g., system management, programming, configuration management, quality assurance and testing, and network security); and (iii) ensuring security personnel administering access control functions do not also administer audit functions.
**Related Controls:** `AC-3`_, `AC-6`_, `PE-3`_, `PE-4`_, `PS-2`_
.. _AC-5a.:
AC-5a.
""""""
Separates [Assignment: organization-defined duties of individuals];
.. _AC-5b.:
AC-5b.
""""""
Documents separation of duties of individuals; and
.. _AC-5c.:
AC-5c.
""""""
Defines information system access authorizations to support separation of duties.
Control Family: ACCESS CONTROL
-------------------------------
.. _AC-6:
AC-6 : LEAST PRIVILEGE
""""""""""""""""""""""
**Priority:** P1
**Baseline-Impact:** *MODERATE*, **HIGH**
The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.
.. NOTE::
Organizations employ least privilege for specific duties and information systems. The principle of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions/business functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary, to achieve least privilege. Organizations also apply least privilege to the development, implementation, and operation of organizational information systems.
**Related Controls:** `AC-2`_, `AC-3`_, `AC-5`_, `CM-6`_, `CM-7`_, `PL-2`_
.. _AC-6 (1):
AC-6 (1) : AUTHORIZE ACCESS TO SECURITY FUNCTIONS
"""""""""""""""""""""""""""""""""""""""""""""""""
**Baseline-Impact:** *MODERATE*, **HIGH**
The organization explicitly authorizes access to [Assignment: organization-defined security functions (deployed in hardware, software, and firmware) and security-relevant information].
.. NOTE::
Security functions include, for example, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Security-relevant information includes, for example, filtering rules for routers/firewalls, cryptographic key management information, configuration parameters for security services, and access control lists. Explicitly authorized personnel include, for example, security administrators, system and network administrators, system security officers, system maintenance personnel, system programmers, and other privileged users.
**Related Controls:** `AC-17`_, `AC-18`_, `AC-19`_
.. _AC-6 (2):
AC-6 (2) : NON-PRIVILEGED ACCESS FOR NONSECURITY FUNCTIONS
""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
**Baseline-Impact:** *MODERATE*, **HIGH**
The organization requires that users of information system accounts, or roles, with access to [Assignment: organization-defined security functions or security-relevant information], use non-privileged accounts or roles, when accessing nonsecurity functions.
.. NOTE::
This control enhancement limits exposure when operating from within privileged accounts or roles. The inclusion of roles addresses situations where organizations implement access control policies such as role-based access control and where a change of role provides the same degree of assurance in the change of access authorizations for both the user and all processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account.
**Related Controls:** `PL-4`_
.. _AC-6 (3):
AC-6 (3) : NETWORK ACCESS TO PRIVILEGED COMMANDS
""""""""""""""""""""""""""""""""""""""""""""""""
**Baseline-Impact:** **HIGH**
The organization authorizes network access to [Assignment: organization-defined privileged commands] only for [Assignment: organization-defined compelling operational needs] and documents the rationale for such access in the security plan for the information system.
.. NOTE::
Network access is any access across a network connection in lieu of local access (i.e., user being physically present at the device).
**Related Controls:** `AC-17`_