Access Control

Overview:Control connection of mobile devices. Action Items:3.1.18[a]Determine if: mobile devices that process, store, or transmit CUI are identified. 3.1.18[b]Determine if: mobile device connections are authorized. 3.1.18[c]Determine if: mobile... Read More

Overview:Limit information system access to the types of transactions and functions that authorized users are permitted to execute. Action Items:3.1.2[a]Determine if: the types of transactions and functions that authorized users are permitted to... Read More

Overview:Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems). Action Items:3.1.1[a]Determine if: authorized users are identified. 3.1.1[b]Determine if: Processes acting on... Read More

Overview:Prevent non-privileged users from executing privileged functions and audit the execution of such functions. Action Items:3.1.7[a]Determine if: privileged functions are defined. 3.1.7[b]Determine if: non-privileged users are defined. 3.1.7[c... Read More

Overview:Encrypt CUI on mobile devices. Action Items:3.1.19[a]Determine if: mobile devices and mobile computing platforms that process, store, or transmit CUI are identified. 3.1.19[b]Determine if: encryption is employed to protect CUI on identified... Read More

Overview:Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. Action Items:3.1.13[a]Determine if: cryptographic mechanisms to protect the confidentiality of remote access sessions are identified. 3.1.13[b... Read More

Overview:Control the flow of CUI in accordance with approved authorizations. Action Items:3.1.3[a]Determine if: information flow control policies are defined. 3.1.3[b]Determine if: methods and enforcement mechanisms for controlling the flow of CUI... Read More

Overview:Employ the principle of least privilege, including for specific security functions and privileged accounts. Action Items:3.1.5[a]Determine if: privileged accounts are identified. 3.1.5[b]Determine if: access to privileged accounts is... Read More

Overview:Route remote access via managed access control points. Action Items:3.1.14[a]Determine if: managed access control points are identified and implemented. 3.1.14[b]Determine if: remote access is routed through managed network access control... Read More

Overview:Use non-privileged accounts or roles when accessing non-security functions. Action Items:3.1.6[a]Determine if: nonsecurity functions are identified. 3.1.6[b]Determine if: users are required to use non-privileged accounts or roles when... Read More