Access Control (AC)

Overview:The organization:a. Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; andb. Authorizes the connection of mobile devices to... Read More

Overview:The organization:a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:1. An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among... Read More

Overview:The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies. Supplemental Guidance:Access control policies (e.g., identity-based... Read More

Overview:The organization:a. Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types];b. Assigns account... Read More

Overview:The organization:(a) Monitors information system accounts for [Assignment: organization-defined atypical use]; and(b) Reports atypical usage of information system accounts to [Assignment: organization-defined personnel or roles].... Read More

Overview:The information system audits the execution of privileged functions. Supplemental Guidance:Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have... Read More

Overview:The information system protects wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption. Related Controls:>/b> SC-8, SC-13.   Action Items:1) Ensure encryption requirements exists... Read More

Overview:The organization explicitly authorizes access to [Assignment: organization-defined security functions (deployed in hardware, software, and firmware) and security-relevant information]. Supplemental Guidance:Security functions include, for... Read More

Overview:The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles]. Related controls: AU-2, AU-12 Action Items:1) Enable... Read More

Overview:The information system monitors and controls remote access methods. Supplemental Guidance:Automated monitoring and control of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote... Read More