Access Control (AC)

Overview:The organization employs automated mechanisms to support the management of information system accounts. Supplemental Guidance:The use of automated mechanisms can include, for example: using email or text messaging to automatically notify... Read More

Overview:The information system limits the number of concurrent sessions for each [Assignment: organization-defined account and/or account type] to [Assignment: organization-defined number]. Supplemental Guidance:Organizations may define the maximum... Read More

Overview:The information system automatically disables inactive accounts after [Assignment: organization-defined time period]. Action Items:1) Disable inactive accounts on a predefined basis Related Documents:1) Access Control Policy 2) Identity and... Read More

Overview:The organization provides the capability to expeditiously disconnect or disable remote access to the information system within [Assignment: organization-defined time period]. Supplemental Guidance:This control enhancement requires... Read More

Overview:The organization employs [Selection: full-device encryption; container encryption] to protect the confidentiality and integrity of information on [Assignment: organization-defined mobile devices]. Supplemental Guidance:Container-based... Read More

Overview:The information system terminates shared/group account credentials when members leave the group. Action Items:1) Terminate shared account credentials when members leave the group Related Documents:1) Access Control Policy 2) Identity and... Read More

Overview:The organization requires that users log out when [Assignment: organization-defined time-period of expected inactivity or description of when to log out] Related control: SC-23 Action Items:1) Enable logouts due to a specific period of... Read More

Overview:The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on [Assignment: organization-defined information flow control policies]. Supplemental... Read More

Overview:The organization:a. Facilitates information sharing by enabling authorized users to determine whether access authorizations assigned to the sharing partner match the access restrictions on the information for [Assignment: organization... Read More

Overview:The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and... Read More