a. Develop, document, and disseminate to {{ insert: param, ac-1_prm_1 }}: 1. {{ insert: param, ac-01_odp.03 }} access control policy that: (a) Addresses purpose, scope, roles, responsib...

a. Define and document the types of accounts allowed and specifically prohibited for use within the system; b. Assign account managers; c. Require {{ insert: param, ac-02_odp.01 }} for group ...

Support the management of system accounts using {{ insert: param, ac-02.01_odp }}.

Automatically {{ insert: param, ac-02.02_odp.01 }} temporary and emergency accounts after {{ insert: param, ac-02.02_odp.02 }}.

Disable accounts within {{ insert: param, ac-02.03_odp.01 }} when the accounts: (a) Have expired; (b) Are no longer associated with a user or individual; (c) Are in violation of organizationa...

Automatically audit account creation, modification, enabling, disabling, and removal actions.

Require that users log out when {{ insert: param, ac-02.05_odp }}.

Implement {{ insert: param, ac-02.06_odp }}.

(a) Establish and administer privileged user accounts in accordance with {{ insert: param, ac-02.07_odp }}; (b) Monitor privileged role or attribute assignments; (c) Monitor changes to roles ...

Create, activate, manage, and deactivate {{ insert: param, ac-02.08_odp }} dynamically.

Only permit the use of shared and group accounts that meet {{ insert: param, ac-02.09_odp }}.

Enforce {{ insert: param, ac-02.11_odp.01 }} for {{ insert: param, ac-02.11_odp.02 }}.

(a) Monitor system accounts for {{ insert: param, ac-02.12_odp.01 }} ; and (b) Report atypical usage of system accounts to {{ insert: param, ac-02.12_odp.02 }}.

Disable accounts of individuals within {{ insert: param, ac-02.13_odp.01 }} of discovery of {{ insert: param, ac-02.13_odp.02 }}.

Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Enforce dual authorization for {{ insert: param, ac-03.02_odp }}.

Enforce {{ insert: param, ac-3.3_prm_1 }} over the set of covered subjects and objects specified in the policy, and where the policy: (a) Is uniformly enforced across the covered subjects and obj...

Enforce {{ insert: param, ac-3.4_prm_1 }} over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to informa...

Prevent access to {{ insert: param, ac-03.05_odp }} except during secure, non-operable system states.

Enforce a role-based access control policy over defined subjects and objects and control access based upon {{ insert: param, ac-3.7_prm_1 }}.

Enforce the revocation of access authorizations resulting from changes to the security attributes of subjects and objects based on {{ insert: param, ac-03.08_odp }}.

Release information outside of the system only if: (a) The receiving {{ insert: param, ac-03.09_odp.01 }} provides {{ insert: param, ac-03.09_odp.02 }} ; and (b) {{ insert: param, ac-03.09_odp....

Employ an audited override of automated access control mechanisms under {{ insert: param, ac-03.10_odp.01 }} by {{ insert: param, ac-03.10_odp.02 }}.

Restrict access to data repositories containing {{ insert: param, ac-03.11_odp }}.

(a) Require applications to assert, as part of the installation process, the access needed to the following system applications and functions: {{ insert: param, ac-03.12_odp }}; (b) Provide an ...

Enforce attribute-based access control policy over defined subjects and objects and control access based upon {{ insert: param, ac-03.13_odp }}.

Provide {{ insert: param, ac-03.14_odp.01 }} to enable individuals to have access to the following elements of their personally identifiable information: {{ insert: param, ac-03.14_odp.02 }}.

(a) Enforce {{ insert: param, ac-3.15_prm_1 }} over the set of covered subjects and objects specified in the policy; and (b) Enforce {{ insert: param, ac-3.15_prm_2 }} over the set of covered s...

Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on {{ insert: param, ac-04_odp }}.

Use {{ insert: param, ac-4.1_prm_1 }} associated with {{ insert: param, ac-4.1_prm_2 }} to enforce {{ insert: param, ac-04.01_odp.09 }} as a basis for flow control decisions.

Use protected processing domains to enforce {{ insert: param, ac-04.02_odp }} as a basis for flow control decisions.

Enforce {{ insert: param, ac-04.03_odp }}.

Prevent encrypted information from bypassing {{ insert: param, ac-04.04_odp.01 }} by {{ insert: param, ac-04.04_odp.02 }}.

Enforce {{ insert: param, ac-04.05_odp }} on embedding data types within other data types.

Enforce information flow control based on {{ insert: param, ac-04.06_odp }}.

Enforce one-way information flows through hardware-based flow control mechanisms.

(a) Enforce information flow control using {{ insert: param, ac-4.8_prm_1 }} as a basis for flow control decisions for {{ insert: param, ac-4.8_prm_2 }} ; and (b) {{ insert: param, ac-04.08_odp...

Enforce the use of human reviews for {{ insert: param, ac-04.09_odp.01 }} under the following conditions: {{ insert: param, ac-04.09_odp.02 }}.

Provide the capability for privileged administrators to enable and disable {{ insert: param, ac-4.10_prm_1 }} under the following conditions: {{ insert: param, ac-4.10_prm_2 }}.

Provide the capability for privileged administrators to configure {{ insert: param, ac-4.11_prm_1 }} to support different security or privacy policies.

When transferring information between different security domains, use {{ insert: param, ac-04.12_odp }} to validate data essential for information flow decisions.

When transferring information between different security domains, decompose information into {{ insert: param, ac-04.13_odp }} for submission to policy enforcement mechanisms.

When transferring information between different security domains, implement {{ insert: param, ac-4.14_prm_1 }} requiring fully enumerated formats that restrict data structure and content.

When transferring information between different security domains, examine the information for the presence of {{ insert: param, ac-04.15_odp.01 }} and prohibit the transfer of such information in a...

Uniquely identify and authenticate source and destination points by {{ insert: param, ac-04.17_odp }} for information transfer.

When transferring information between different security domains, implement {{ insert: param, ac-4.19_prm_1 }} on metadata.

Employ {{ insert: param, ac-04.20_odp.01 }} to control the flow of {{ insert: param, ac-04.20_odp.02 }} across security domains.

Separate information flows logically or physically using {{ insert: param, ac-4.21_prm_1 }} to accomplish {{ insert: param, ac-04.21_odp.03 }}.

Provide access from a single device to computing platforms, applications, or data residing in multiple different security domains, while preventing information flow between the different security d...

When transferring information between different security domains, modify non-releasable information by implementing {{ insert: param, ac-04.23_odp }}.

When transferring information between different security domains, parse incoming data into an internal normalized format and regenerate the data to be consistent with its intended specification.

When transferring information between different security domains, sanitize data to minimize {{ insert: param, ac-04.25_odp.01 }} in accordance with {{ insert: param, ac-04.25_odp.02 }}.

When transferring information between different security domains, record and audit content filtering actions and results for the information being filtered.

When transferring information between different security domains, implement content filtering solutions that provide redundant and independent filtering mechanisms for each data type.

When transferring information between different security domains, implement a linear content filter pipeline that is enforced with discretionary and mandatory access controls.

When transferring information between different security domains, employ content filter orchestration engines to ensure that: (a) Content filtering mechanisms successfully complete execution with...

When transferring information between different security domains, implement content filtering mechanisms using multiple processes.

When transferring information between different security domains, prevent the transfer of failed content to the receiving domain.

When transferring information between different security domains, the process that transfers information between filter pipelines: (a) Does not filter message content; (b) Validates filtering m...

a. Identify and document {{ insert: param, ac-05_odp }} ; and b. Define system access authorizations to support separation of duties.

Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.

Authorize access for {{ insert: param, ac-06.01_odp.01 }} to: (a) {{ insert: param, ac-6.1_prm_2 }} ; and (b) {{ insert: param, ac-06.01_odp.05 }}.

Require that users of system accounts (or roles) with access to {{ insert: param, ac-06.02_odp }} use non-privileged accounts or roles, when accessing nonsecurity functions.

Authorize network access to {{ insert: param, ac-06.03_odp.01 }} only for {{ insert: param, ac-06.03_odp.02 }} and document the rationale for such access in the security plan for the system.

Provide separate processing domains to enable finer-grained allocation of user privileges.

Restrict privileged accounts on the system to {{ insert: param, ac-06.05_odp }}.

Prohibit privileged access to the system by non-organizational users.

(a) Review {{ insert: param, ac-06.07_odp.01 }} the privileges assigned to {{ insert: param, ac-06.07_odp.02 }} to validate the need for such privileges; and (b) Reassign or remove privileges, ...

Prevent the following software from executing at higher privilege levels than users executing the software: {{ insert: param, ac-06.08_odp }}.

Log the execution of privileged functions.

Prevent non-privileged users from executing privileged functions.

a. Enforce a limit of {{ insert: param, ac-07_odp.01 }} consecutive invalid logon attempts by a user during a {{ insert: param, ac-07_odp.02 }} ; and b. Automatically {{ insert: param, ac-07_od...

Purge or wipe information from {{ insert: param, ac-07.02_odp.01 }} based on {{ insert: param, ac-07.02_odp.02 }} after {{ insert: param, ac-07.02_odp.03 }} consecutive, unsuccessful device logon a...

Limit the number of unsuccessful biometric logon attempts to {{ insert: param, ac-07.03_odp }}.

(a) Allow the use of {{ insert: param, ac-07.04_odp.01 }} that are different from the primary authentication factors after the number of organization-defined consecutive invalid logon attempts ha...

a. Display {{ insert: param, ac-08_odp.01 }} to users before granting access to the system that provides privacy and security notices consistent with applicable laws, executive orders, directives...

Notify the user, upon successful logon to the system, of the date and time of the last logon.

Notify the user, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.

Notify the user, upon successful logon, of the number of {{ insert: param, ac-09.02_odp.01 }} during {{ insert: param, ac-09.02_odp.02 }}.

Notify the user, upon successful logon, of changes to {{ insert: param, ac-09.03_odp.01 }} during {{ insert: param, ac-09.03_odp.02 }}.

Notify the user, upon successful logon, of the following additional information: {{ insert: param, ac-09.04_odp }}.

Limit the number of concurrent sessions for each {{ insert: param, ac-10_odp.01 }} to {{ insert: param, ac-10_odp.02 }}.

a. Prevent further access to the system by {{ insert: param, ac-11_odp.01 }} ; and b. Retain the device lock until the user reestablishes access using established identification and authenticat...

Conceal, via the device lock, information previously visible on the display with a publicly viewable image.

Automatically terminate a user session after {{ insert: param, ac-12_odp }}.

Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to {{ insert: param, ac-12.01_odp }}.

Display an explicit logout message to users indicating the termination of authenticated communications sessions.

Display an explicit message to users indicating that the session will end in {{ insert: param, ac-12.03_odp }}.

a. Identify {{ insert: param, ac-14_odp }} that can be performed on the system without identification or authentication consistent with organizational mission and business functions; and b. Doc...

a. Provide the means to associate {{ insert: param, ac-16_prm_1 }} with {{ insert: param, ac-16_prm_2 }} for information in storage, in process, and/or in transmission; b. Ensure that the attri...

Dynamically associate security and privacy attributes with {{ insert: param, ac-16.1_prm_1 }} in accordance with the following security and privacy policies as information is created and combined: ...

Provide authorized individuals (or processes acting on behalf of individuals) the capability to define or change the value of associated security and privacy attributes.

Maintain the association and integrity of {{ insert: param, ac-16.3_prm_1 }} to {{ insert: param, ac-16.3_prm_2 }}.

Provide the capability to associate {{ insert: param, ac-16.4_prm_1 }} with {{ insert: param, ac-16.4_prm_2 }} by authorized individuals (or processes acting on behalf of individuals).

Display security and privacy attributes in human-readable form on each object that the system transmits to output devices to identify {{ insert: param, ac-16.05_odp.01 }} using {{ insert: param, ac...

Require personnel to associate and maintain the association of {{ insert: param, ac-16.6_prm_1 }} with {{ insert: param, ac-16.6_prm_2 }} in accordance with {{ insert: param, ac-16.6_prm_3 }}.

Provide a consistent interpretation of security and privacy attributes transmitted between distributed system components.

Implement {{ insert: param, ac-16.8_prm_1 }} in associating security and privacy attributes to information.

Change security and privacy attributes associated with information only via regrading mechanisms validated using {{ insert: param, ac-16.9_prm_1 }}.

Provide authorized individuals the capability to define or change the type and value of security and privacy attributes available for association with subjects and objects.

a. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b. Authorize each type of remote acc...

Employ automated mechanisms to monitor and control remote access methods.

Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.

Route remote accesses through authorized and managed network access control points.

(a) Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: {{...

Protect information about remote access mechanisms from unauthorized use and disclosure.

Provide the capability to disconnect or disable remote access to the system within {{ insert: param, ac-17.09_odp }}.

Implement {{ insert: param, ac-17.10_odp.01 }} to authenticate {{ insert: param, ac-17.10_odp.02 }}.

a. Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and b. Authorize each type of wireless access to the system prior...

Protect wireless access to the system using authentication of {{ insert: param, ac-18.01_odp }} and encryption.

Disable, when not intended for use, wireless networking capabilities embedded within system components prior to issuance and deployment.

Identify and explicitly authorize users allowed to independently configure wireless networking capabilities.

Select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.

a. Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled ar...

(a) Prohibit the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing o...

Employ {{ insert: param, ac-19.05_odp.01 }} to protect the confidentiality and integrity of information on {{ insert: param, ac-19.05_odp.02 }}.

a. {{ insert: param, ac-20_odp.01 }} , consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized ind...

Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after: (a) Verification of the implementati...

Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using {{ insert: param, ac-20.02_odp }}.

Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using {{ insert: param, ac-20.03_odp }}.

Prohibit the use of {{ insert: param, ac-20.04_odp }} in external systems.

Prohibit the use of organization-controlled portable storage devices by authorized individuals on external systems.

a. Enable authorized users to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for {{ insert: param, ac-21_odp.01 }} ; and...

Employ {{ insert: param, ac-21.01_odp }} to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be...

Implement information search and retrieval services that enforce {{ insert: param, ac-21.02_odp }}.

a. Designate individuals authorized to make information publicly accessible; b. Train authorized individuals to ensure that publicly accessible information does not contain nonpublic informatio...

Employ {{ insert: param, ac-23_odp.01 }} for {{ insert: param, ac-23_odp.02 }} to detect and protect against unauthorized data mining.

{{ insert: param, ac-24_odp.01 }} to ensure {{ insert: param, ac-24_odp.02 }} are applied to each access request prior to access enforcement.

Transmit {{ insert: param, ac-24.01_odp.01 }} using {{ insert: param, ac-24.01_odp.02 }} to {{ insert: param, ac-24.01_odp.03 }} that enforce access control decisions.

Enforce access control decisions based on {{ insert: param, ac-24.2_prm_1 }} that do not include the identity of the user or process acting on behalf of the user.

Implement a reference monitor for {{ insert: param, ac-25_odp }} that is tamperproof, always invoked, and small enough to be subject to analysis and testing, the completeness of which can be assured.