Access Control (AC)

Overview:The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions. Supplemental Guidance:The encryption strength of mechanism is selected based on the security categorization of... Read More

Overview:The organization:a. Designates individuals authorized to post information onto a publicly accessible information system;b. Trains authorized individuals to ensure that publicly accessible information does not contain nonpublic information;c.... Read More

Overview:The organization:a. Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; andb. Authorizes remote access to the information system prior to... Read More

Overview:The information system automatically [Selection: removes; disables] temporary and emergency accounts after [Assignment: organization-defined time period for each type of account]. Supplemental Guidance:This control enhancement requires the... Read More

Overview:The organization only permits the use of shared/group accounts that meet [Assignment: organization-defined conditions for establishing shared/group accounts]. Action Items:1) Define conditions for use of shared/group accounts if utilized... Read More

Overview:The organization:(a) Establishes and administers privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles;(b) Monitors privileged role assignments; and... Read More

Overview:The organization:a. Separates [Assignment: organization-defined duties of individuals];b. Documents separation of duties of individuals; andc. Defines information system access authorizations to support separation of duties. Supplemental... Read More

Overview:The information system:a. Prevents further access to the system by initiating a session lock after [Assignment: organization-defined time period] of inactivity or upon receiving a request from a user; andb. Retains the session lock until the... Read More

Overview:The information system automatically terminates a user session after [Assignment: organization-defined conditions or trigger events requiring session disconnect]. Supplemental Guidance:This control addresses the termination of user-initiated... Read More

Overview:The information system:a. Displays to users [Assignment: organization-defined system use notification message or banner] before granting access to the system that provides privacy and security notices consistent with applicable federal laws,... Read More