NIST 800-171 - Access Enforcement (3.1.2)

Overview:
Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

Action Items:
3.1.2[a]
Determine if: the types of transactions and functions that authorized users are permitted to execute are defined.

3.1.2[b]
Determine if: system access is limited to the defined types of transactions and functions for authorized users.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1
Examine: Access control policy; procedures addressing access enforcement; system security plan; system design documentation; list of approved authorizations including remote access authorizations; system audit logs and records; system configuration settings and associated documentation; other relevant documents or records].

2
Interview: Personnel with access enforcement responsibilities; system or network administrators; personnel with information security responsibilities; system developers].

3
Test: Mechanisms implementing access control policy].

Related Documents (document name and content will vary by organization):
1) Access control policy
2) procedures addressing access enforcement
3) system security plan
4) system design documentation
5) list of approved authorizations including remote access authorizations
6) system audit logs and records
7) system configuration settings and associated documentation
8) other relevant documents or records

Additional Guidance:
System account types include, for example, individual, shared, group, system, guest/anonymous, emergency, developer/manufacturer/vendor, and temporary. Organizations may choose to define access privileges or other attributes by account, by type of account, or a combination of both. Other attributes required for authorizing access include, for example: restrictions on time-of-day, day-of- week, and point-of-origin. In defining other account attributes, organizations may consider system related requirements (e.g., scheduled maintenance, system upgrades) and mission or business requirements, (e.g., time zone differences, customer requirements, remote access to support travel requirements). Failure to consider these factors could affect system availability.