The organization: a. Develops, documents, and disseminates to {{ insert: param, ac-1_prm_1 }}: 1. An access control policy that addresses purpose, scope, roles, responsibilities, management c...

The organization employs automated mechanisms to support the management of information system accounts.

The information system automatically {{ insert: param, ac-2.2_prm_1 }} temporary and emergency accounts after {{ insert: param, ac-2.2_prm_2 }}.

The information system automatically disables inactive accounts after {{ insert: param, ac-2.3_prm_1 }}.

The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies {{ insert: param, ac-2.4_prm_1 }}.

The organization requires that users log out when {{ insert: param, ac-2.5_prm_1 }}.

The information system implements the following dynamic privilege management capabilities: {{ insert: param, ac-2.6_prm_1 }}.

The organization: (a) Establishes and administers privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles...

The information system creates {{ insert: param, ac-2.8_prm_1 }} dynamically.

The organization only permits the use of shared/group accounts that meet {{ insert: param, ac-2.9_prm_1 }}.

The information system terminates shared/group account credentials when members leave the group.

The information system enforces {{ insert: param, ac-2.11_prm_1 }} for {{ insert: param, ac-2.11_prm_2 }}.

The organization: (a) Monitors information system accounts for {{ insert: param, ac-2.12_prm_1 }}; and (b) Reports atypical usage of information system accounts to {{ insert: param, ac-2.12_prm...

The organization disables accounts of users posing a significant risk within {{ insert: param, ac-2.13_prm_1 }} of discovery of the risk.

The information system enforces dual authorization for {{ insert: param, ac-3.2_prm_1 }}.

The information system enforces {{ insert: param, ac-3.3_prm_1 }} over all subjects and objects where the policy: (a) Is uniformly enforced across all subjects and objects within the boundary of ...

The information system enforces {{ insert: param, ac-3.4_prm_1 }} over defined subjects and objects where the policy specifies that a subject that has been granted access to information can do one ...

The information system prevents access to {{ insert: param, ac-3.5_prm_1 }} except during secure, non-operable system states.

The information system enforces a role-based access control policy over defined subjects and objects and controls access based upon {{ insert: param, ac-3.7_prm_1 }}.

The information system enforces the revocation of access authorizations resulting from changes to the security attributes of subjects and objects based on {{ insert: param, ac-3.8_prm_1 }}.

The information system does not release information outside of the established system boundary unless: (a) The receiving {{ insert: param, ac-3.9_prm_1 }} provides {{ insert: param, ac-3.9_prm_2 ...

The organization employs an audited override of automated access control mechanisms under {{ insert: param, ac-3.10_prm_1 }}.

The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on {{ insert: param, ac-4_prm_1 }}.

The information system uses {{ insert: param, ac-4.1_prm_1 }} associated with {{ insert: param, ac-4.1_prm_2 }} to enforce {{ insert: param, ac-4.1_prm_3 }} as a basis for flow control decisions.

The information system uses protected processing domains to enforce {{ insert: param, ac-4.2_prm_1 }} as a basis for flow control decisions.

The information system enforces dynamic information flow control based on {{ insert: param, ac-4.3_prm_1 }}.

The information system prevents encrypted information from bypassing content-checking mechanisms by {{ insert: param, ac-4.4_prm_1 }}.

The information system enforces {{ insert: param, ac-4.5_prm_1 }} on embedding data types within other data types.

The information system enforces information flow control based on {{ insert: param, ac-4.6_prm_1 }}.

The information system enforces {{ insert: param, ac-4.7_prm_1 }} using hardware mechanisms.

The information system enforces information flow control using {{ insert: param, ac-4.8_prm_1 }} as a basis for flow control decisions for {{ insert: param, ac-4.8_prm_2 }}.

The information system enforces the use of human reviews for {{ insert: param, ac-4.9_prm_1 }} under the following conditions: {{ insert: param, ac-4.9_prm_2 }}.

The information system provides the capability for privileged administrators to enable/disable {{ insert: param, ac-4.10_prm_1 }} under the following conditions: {{ insert: param, ac-4.10_prm_2 }}.

The information system provides the capability for privileged administrators to configure {{ insert: param, ac-4.11_prm_1 }} to support different security policies.

The information system, when transferring information between different security domains, uses {{ insert: param, ac-4.12_prm_1 }} to validate data essential for information flow decisions.

The information system, when transferring information between different security domains, decomposes information into {{ insert: param, ac-4.13_prm_1 }} for submission to policy enforcement mechani...

The information system, when transferring information between different security domains, implements {{ insert: param, ac-4.14_prm_1 }} requiring fully enumerated formats that restrict data structu...

The information system, when transferring information between different security domains, examines the information for the presence of {{ insert: param, ac-4.15_prm_1 }} and prohibits the transfer ...

The information system uniquely identifies and authenticates source and destination points by {{ insert: param, ac-4.17_prm_1 }} for information transfer.

The information system binds security attributes to information using {{ insert: param, ac-4.18_prm_1 }} to facilitate information flow policy enforcement.

The information system, when transferring information between different security domains, applies the same security policy filtering to metadata as it applies to data payloads.

The organization employs {{ insert: param, ac-4.20_prm_1 }} to control the flow of {{ insert: param, ac-4.20_prm_2 }} across security domains.

The information system separates information flows logically or physically using {{ insert: param, ac-4.21_prm_1 }} to accomplish {{ insert: param, ac-4.21_prm_2 }}.

The information system provides access from a single device to computing platforms, applications, or data residing on multiple different security domains, while preventing any information flow betw...

The organization: a. Separates {{ insert: param, ac-5_prm_1 }}; b. Documents separation of duties of individuals; and c. Defines information system access authorizations to support separation...

The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in a...

The organization explicitly authorizes access to {{ insert: param, ac-6.1_prm_1 }}.

The organization requires that users of information system accounts, or roles, with access to {{ insert: param, ac-6.2_prm_1 }}, use non-privileged accounts or roles, when accessing nonsecurity fun...

The organization authorizes network access to {{ insert: param, ac-6.3_prm_1 }} only for {{ insert: param, ac-6.3_prm_2 }} and documents the rationale for such access in the security plan for the i...

The information system provides separate processing domains to enable finer-grained allocation of user privileges.

The organization restricts privileged accounts on the information system to {{ insert: param, ac-6.5_prm_1 }}.

The organization prohibits privileged access to the information system by non-organizational users.

The organization: (a) Reviews {{ insert: param, ac-6.7_prm_1 }} the privileges assigned to {{ insert: param, ac-6.7_prm_2 }} to validate the need for such privileges; and (b) Reassigns or remov...

The information system prevents {{ insert: param, ac-6.8_prm_1 }} from executing at higher privilege levels than users executing the software.

The information system audits the execution of privileged functions.

The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

The information system purges/wipes information from {{ insert: param, ac-7.2_prm_1 }} based on {{ insert: param, ac-7.2_prm_2 }} after {{ insert: param, ac-7.2_prm_3 }} consecutive, unsuccessful d...

The information system: a. Displays to users {{ insert: param, ac-8_prm_1 }} before granting access to the system that provides privacy and security notices consistent with applicable federal law...

The information system notifies the user, upon successful logon (access) to the system, of the date and time of the last logon (access).

The information system notifies the user, upon successful logon/access, of the number of unsuccessful logon/access attempts since the last successful logon/access.

The information system notifies the user of the number of {{ insert: param, ac-9.2_prm_1 }} during {{ insert: param, ac-9.2_prm_2 }}.

The information system notifies the user of changes to {{ insert: param, ac-9.3_prm_1 }} during {{ insert: param, ac-9.3_prm_2 }}.

The information system notifies the user, upon successful logon (access), of the following additional information: {{ insert: param, ac-9.4_prm_1 }}.

The information system limits the number of concurrent sessions for each {{ insert: param, ac-10_prm_1 }} to {{ insert: param, ac-10_prm_2 }}.

The information system: a. Prevents further access to the system by initiating a session lock after {{ insert: param, ac-11_prm_1 }} of inactivity or upon receiving a request from a user; and b...

The information system conceals, via the session lock, information previously visible on the display with a publicly viewable image.

The information system automatically terminates a user session after {{ insert: param, ac-12_prm_1 }}.

The information system: (a) Provides a logout capability for user-initiated communications sessions whenever authentication is used to gain access to {{ insert: param, ac-12.1_prm_1 }}; and (b)...

The organization: a. Identifies {{ insert: param, ac-14_prm_1 }} that can be performed on the information system without identification or authentication consistent with organizational missions/b...

The organization: a. Provides the means to associate {{ insert: param, ac-16_prm_1 }} having {{ insert: param, ac-16_prm_2 }} with information in storage, in process, and/or in transmission; b....

The information system dynamically associates security attributes with {{ insert: param, ac-16.1_prm_1 }} in accordance with {{ insert: param, ac-16.1_prm_2 }} as information is created and combined.

The information system provides authorized individuals (or processes acting on behalf of individuals) the capability to define or change the value of associated security attributes.

The information system maintains the association and integrity of {{ insert: param, ac-16.3_prm_1 }} to {{ insert: param, ac-16.3_prm_2 }}.

The information system supports the association of {{ insert: param, ac-16.4_prm_1 }} with {{ insert: param, ac-16.4_prm_2 }} by authorized individuals (or processes acting on behalf of individuals).

The information system displays security attributes in human-readable form on each object that the system transmits to output devices to identify {{ insert: param, ac-16.5_prm_1 }} using {{ insert:...

The organization allows personnel to associate, and maintain the association of {{ insert: param, ac-16.6_prm_1 }} with {{ insert: param, ac-16.6_prm_2 }} in accordance with {{ insert: param, ac-16...

The organization provides a consistent interpretation of security attributes transmitted between distributed information system components.

The information system implements {{ insert: param, ac-16.8_prm_1 }} with {{ insert: param, ac-16.8_prm_2 }} in associating security attributes to information.

The organization ensures that security attributes associated with information are reassigned only via re-grading mechanisms validated using {{ insert: param, ac-16.9_prm_1 }}.

The information system provides authorized individuals the capability to define or change the type and value of security attributes available for association with subjects and objects.

The organization: a. Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b. Authorizes r...

The information system monitors and controls remote access methods.

The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.

The information system routes all remote accesses through {{ insert: param, ac-17.3_prm_1 }} managed network access control points.

The organization: (a) Authorizes the execution of privileged commands and access to security-relevant information via remote access only for {{ insert: param, ac-17.4_prm_1 }}; and (b) Document...

The organization ensures that users protect information about remote access mechanisms from unauthorized use and disclosure.

The organization provides the capability to expeditiously disconnect or disable remote access to the information system within {{ insert: param, ac-17.9_prm_1 }}.

The organization: a. Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and b. Authorizes wireless access to the information...

The information system protects wireless access to the system using authentication of {{ insert: param, ac-18.1_prm_1 }} and encryption.

The organization disables, when not intended for use, wireless networking capabilities internally embedded within information system components prior to issuance and deployment.

The organization identifies and explicitly authorizes users allowed to independently configure wireless networking capabilities.

The organization selects radio antennas and calibrates transmission power levels to reduce the probability that usable signals can be received outside of organization-controlled boundaries.

The organization: a. Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and b. Authoriz...

The organization: (a) Prohibits the use of unclassified mobile devices in facilities containing information systems processing, storing, or transmitting classified information unless specifically...

The organization employs {{ insert: param, ac-19.5_prm_1 }} to protect the confidentiality and integrity of information on {{ insert: param, ac-19.5_prm_2 }}.

The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, a...

The organization permits authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only whe...

The organization {{ insert: param, ac-20.2_prm_1 }} the use of organization-controlled portable storage devices by authorized individuals on external information systems.

The organization {{ insert: param, ac-20.3_prm_1 }} the use of non-organizationally owned information systems, system components, or devices to process, store, or transmit organizational information.

The organization prohibits the use of {{ insert: param, ac-20.4_prm_1 }} in external information systems.

The organization: a. Facilitates information sharing by enabling authorized users to determine whether access authorizations assigned to the sharing partner match the access restrictions on the i...

The information system enforces information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.

The information system implements information search and retrieval services that enforce {{ insert: param, ac-21.2_prm_1 }}.

The organization: a. Designates individuals authorized to post information onto a publicly accessible information system; b. Trains authorized individuals to ensure that publicly accessible inf...

The organization employs {{ insert: param, ac-23_prm_1 }} for {{ insert: param, ac-23_prm_2 }} to adequately detect and protect against data mining.

The organization establishes procedures to ensure {{ insert: param, ac-24_prm_1 }} are applied to each access request prior to access enforcement.

The information system transmits {{ insert: param, ac-24.1_prm_1 }} using {{ insert: param, ac-24.1_prm_2 }} to {{ insert: param, ac-24.1_prm_3 }} that enforce access control decisions.

The information system enforces access control decisions based on {{ insert: param, ac-24.2_prm_1 }} that do not include the identity of the user or process acting on behalf of the user.

The information system implements a reference monitor for {{ insert: param, ac-25_prm_1 }} that is tamperproof, always invoked, and small enough to be subject to analysis and testing, the completen...