Practice AC.L2-3.1.2 Details - Revision history

David: /* AC.L1-3.1.2 – TRANSACTION & FUNCTION CONTROL */

2025-03-15T19:48:02Z

AC.L1-3.1.2 – TRANSACTION & FUNCTION CONTROL

← Older revision		Revision as of 19:48, 15 March 2025
Line 3:		Line 3:
	For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

	== AC.L1-3.1.2 – TRANSACTION & FUNCTION CONTROL ==		== AC.L2-3.1.2 – TRANSACTION & FUNCTION CONTROL ==
	Level 1 Reference: AC.L1-b.1.ii		Level 1 Reference: AC.L1-b.1.ii
	=== SECURITY REQUIREMENT ===		=== SECURITY REQUIREMENT ===

David: David moved page Practice AC.L1-3.1.2 Details to Practice AC.L2-3.1.2 Details

2025-03-10T03:45:47Z

David moved page Practice AC.L1-3.1.2 Details to Practice AC.L2-3.1.2 Details

← Older revision		Revision as of 03:45, 10 March 2025
(No difference)

David at 03:45, 10 March 2025

2025-03-10T03:45:37Z

← Older revision		Revision as of 03:45, 10 March 2025
Line 1:		Line 1:
	'''Source of Reference: The official [https://~~www~~.~~acq~~.~~osd.mil~~/cmmc/~~documentation.html~~ CMMC Level ~~1 Self-~~Assessment Guide] from the ~~Office of the Under Secretary~~ of Defense ~~Acquisition & Sustainment~~.'''		'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 2 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).'''

	For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

	== AC.L1-3.1.2 – TRANSACTION & FUNCTION CONTROL ==		== AC.L1-3.1.2 – TRANSACTION & FUNCTION CONTROL ==
			Level 1 Reference: AC.L1-b.1.ii
	=== SECURITY REQUIREMENT ===		=== SECURITY REQUIREMENT ===
	Limit information system access to the types of transactions and functions that authorized users are permitted to execute.		Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
Line 13:		Line 14:
	'''Examine'''		'''Examine'''

	[SELECT FROM: Access control policy; procedures addressing access enforcement; system security plan;system design documentation;list of approved authorizations including remote access authorizations; system audit logs and records; system configuration settings and associated documentation; other relevant documents or records].		[SELECT FROM: Access control policy; procedures addressing access enforcement; system security plan; system design documentation; list of approved authorizations including remote access authorizations; system audit logs and records; system configuration settings and associated documentation; other relevant documents or records].

	'''Interview'''		'''Interview'''
Line 23:		Line 24:
	[SELECT FROM: Mechanisms implementing access control policy].		[SELECT FROM: Mechanisms implementing access control policy].
	=== DISCUSSION ===		=== DISCUSSION ===
	Organizations may choose to define access privileges or other attributes by account, by type of account, or a combination of both. System account types include individual, shared, group, system, anonymous, guest, emergency, developer, manufacturer, vendor, and temporary.Other attributes required for authorizing access include restrictions on time-of-day, day-of- week, and point-of-origin.In defining other account attributes, organizations consider system-related requirements (e.g., system upgrades scheduled maintenance,) and mission or business requirements, (e.g., time zone differences, customer requirements, remote access to support travel requirements).		Organizations may choose to define access privileges or other attributes by account, by type of account, or a combination of both. System account types include individual, shared, group, system, anonymous, guest, emergency, developer, manufacturer, vendor, and temporary. Other attributes required for authorizing access include restrictions on time-of-day, day-of- week, and point-of-origin. In defining other account attributes, organizations consider system-related requirements (e.g., system upgrades scheduled maintenance,) and mission or business requirements, (e.g., time zone differences, customer requirements, remote access to support travel requirements).
	=== FURTHER DISCUSSION ===		=== FURTHER DISCUSSION ===
	Limit users to only the information systems, roles, or applications they are permitted to use and are needed for their roles and responsibilities. Limit access to applications and data based on the authorized users’ roles and responsibilities. Common types of functions a user can be assigned are create, read, update, and delete.		Limit users to only the information systems, roles, or applications they are permitted to use and are needed for their roles and responsibilities. Limit access to applications and data based on the authorized users’ roles and responsibilities. Common types of functions a user can be assigned are create, read, update, and delete.

Wikiadmin at 18:50, 23 February 2022

2022-02-23T18:50:31Z

← Older revision		Revision as of 18:50, 23 February 2022
Line 3:		Line 3:
	For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

	== AC.L1-3.1.1 – ~~AUTHORIZED ACCESS~~ CONTROL ==		== AC.L1-3.1.2 – TRANSACTION & FUNCTION CONTROL ==
	=== SECURITY REQUIREMENT ===		=== SECURITY REQUIREMENT ===
	Limit information system access to ~~authorized users, processes acting on behalf~~ of authorized users~~, or devices (including other information systems)~~.		Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
	=== ASSESSMENT OBJECTIVES ~~[NIST SP 800-171A]~~ ===		=== ASSESSMENT OBJECTIVES ===
	Determine if:		Determine if:
	: [a] ~~authorized users are identified;~~		: [a] the types of transactions and functions that authorized users are permitted to execute are defined; and
	~~: [b] processes acting on behalf~~ of authorized users are ~~identified;~~		: [b] system access is limited to the defined types of transactions and functions for authorized users.
	~~: [c] devices (and other systems) authorized~~ to ~~connect to the system~~ are ~~identified~~;		=== POTENTIAL ASSESSMENT METHODS AND OBJECTS ===
	: [d] system access is limited to ~~authorized users;~~
	~~: [e] system access is limited to processes acting on behalf~~ of authorized users~~; and~~
	~~: [f] system access is limited to authorized devices (including other systems)~~.
	=== POTENTIAL ASSESSMENT METHODS AND OBJECTS ~~[NIST SP 800-171A]~~ ===
	'''Examine'''		'''Examine'''

	[SELECT FROM: Access control policy; procedures addressing ~~account management~~; system security plan; system design documentation; system configuration settings and associated documentation; list of active system accounts and the name of the individual associated with each account; notifications or records of recently transferred, separated, or terminated employees; list of ~~conditions for group and role membership; list of recently disabled system accounts along with the name of the individual associated with each account;~~ access ~~authorization records; account management compliance reviews; system monitoring records~~; system audit logs and records; ~~list of devices~~ and ~~systems authorized to connect to organizational systems~~; other relevant documents or records].		[SELECT FROM: Access control policy; procedures addressing access enforcement; system security plan;system design documentation;list of approved authorizations including remote access authorizations; system audit logs and records; system configuration settings and associated documentation; other relevant documents or records].

	'''Interview'''		'''Interview'''

	[SELECT FROM: Personnel with ~~account management~~ responsibilities; system or network administrators; personnel with information security responsibilities].		[SELECT FROM: Personnel with access enforcement responsibilities; system or network administrators; personnel with information security responsibilities; system developers].

	'''Test'''		'''Test'''

	[SELECT FROM: ~~Organizational processes for managing system accounts; mechanisms for~~ implementing ~~account management~~].		[SELECT FROM: Mechanisms implementing access control policy].
	=== DISCUSSION ~~[NIST SP 800-171 R2]~~ ===		=== DISCUSSION ===
	~~Access control policies (e.g., identity-~~ or ~~role-based policies~~, ~~control matrices~~, ~~and cryptography) control access between active entities~~ or ~~subjects (i.e~~., ~~users or processes acting on behalf of users) and passive entities or objects (e.g.~~, ~~devices~~, ~~files~~, ~~records~~, and ~~domains) in systems. Access enforcement mechanisms can be employed at the application and service level to provide increased information security~~. Other ~~systems~~ include ~~systems internal and external to the organization. This requirement focuses~~ on ~~account management for systems and applications. The definition~~ of and ~~enforcement~~ of ~~access authorizations,~~ other ~~than those determined by~~ account ~~type~~ (e.g., ~~privileged verses [sic] non-privileged~~) ~~are addressed in requirement 3.1.2~~ (AC.~~L1-3~~.~~1.2~~).		Organizations may choose to define access privileges or other attributes by account, by type of account, or a combination of both. System account types include individual, shared, group, system, anonymous, guest, emergency, developer, manufacturer, vendor, and temporary.Other attributes required for authorizing access include restrictions on time-of-day, day-of- week, and point-of-origin.In defining other account attributes, organizations consider system-related requirements (e.g., system upgrades scheduled maintenance,) and mission or business requirements, (e.g., time zone differences, customer requirements, remote access to support travel requirements).
	=== FURTHER DISCUSSION ===		=== FURTHER DISCUSSION ===
	~~Identify~~ users, ~~processes~~, ~~and devices that~~ are ~~allowed~~ to use ~~company computers~~ and ~~can log on~~ to ~~the company network. Automated updates~~ and ~~other automatic processes should be associated with~~ the ~~user who initiated (~~authorized~~) the process~~. ~~Limit the devices (e.g., printers) that~~ can be ~~accessed by company computers. Set up your system so that only authorized users~~, ~~processes~~, and ~~devices can access the company network~~.		Limit users to only the information systems, roles, or applications they are permitted to use and are needed for their roles and responsibilities. Limit access to applications and data based on the authorized users’ roles and responsibilities. Common types of functions a user can be assigned are create, read, update, and delete.

	~~This practice, AC.L1-3.1.1, controls system access based on user, process, or device identity. AC.L1-3.1.1 leverages IA.L1-3.5.1 which provides a vetted and trusted identity for access control.~~		'''Example'''

	~~'''Example 1'''~~		You supervise the team that manages DoD contracts for your company. Members of your team need to access the contract information to perform their work properly. Because some of that data contains FCI, you work with IT to set up your group’s systems so that users can be assigned access based on their specific roles [a]. Each role limits whether an employee has read-access or create/read/delete/update -access [b]. Implementing this access control restricts access to FCI information unless specifically authorized.

	~~Your~~ company ~~maintains a list~~ of ~~all personnel authorized~~ to ~~use company~~ information ~~systems [a]~~. ~~This list is used to support identification and authentication activities conducted by~~ IT ~~when authorizing access~~ to systems [a,d].

	~~'''Example 2'''~~

	~~A coworker wants to buy a new multi~~-~~function printer~~/~~scanner~~/~~fax device and make it available on the company network. You explain that the company controls system and device access to the network and will prevent network~~ access ~~by unauthorized systems and devices~~ [c]. ~~You help the coworker submit a ticket that asks for the printer to be granted~~ access to ~~the network, and appropriate leadership approves the device [f]~~.

	'''Potential Assessment Considerations'''		'''Potential Assessment Considerations'''
			* Are access control lists used to limit access to applications and data based on role and/or identity [a]?
	* ~~Is a list of authorized users maintained that defines their identities~~ and ~~roles~~ [a]?		* Is access for authorized users restricted to those parts of the system they are explicitly permitted to use (e.g., a person who only performs word-processing cannot access developer tools) [b]?
	* ~~Are account requests~~ authorized ~~before~~ system access ~~is granted~~ [~~d,e,f~~]?		=== KEY REFERENCES ===
	===KEY REFERENCES===		* FAR Clause 52.204-21 b.1.ii
	* FAR Clause 52.204-21 b.1.i		* NIST SP 800-171 Rev 2 3.1.2
	* NIST SP 800-171 Rev 2 3.1.1

Wikiadmin at 18:49, 23 February 2022

2022-02-23T18:49:15Z

← Older revision		Revision as of 18:49, 23 February 2022
Line 3:		Line 3:
	For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

	== AC.L1-3.1.2 – ~~TRANSACTION & FUNCTION~~ CONTROL ==		== AC.L1-3.1.1 – AUTHORIZED ACCESS CONTROL ==
	=== SECURITY REQUIREMENT ===		=== SECURITY REQUIREMENT ===
	Limit information system access to ~~the types~~ of ~~transactions and functions that~~ authorized users ~~are permitted to execute~~.		Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
	=== ASSESSMENT OBJECTIVES ===		=== ASSESSMENT OBJECTIVES [NIST SP 800-171A] ===
	Determine if:		Determine if:
	: [a] ~~the types~~ of ~~transactions and functions that~~ authorized users are ~~permitted~~ to ~~execute~~ are ~~defined~~; ~~and~~		: [a] authorized users are identified;
	: [b] system access is limited to ~~the defined types~~ of ~~transactions~~ and ~~functions for~~ authorized ~~users~~.		: [b] processes acting on behalf of authorized users are identified;
	=== POTENTIAL ASSESSMENT METHODS AND OBJECTS ===		: [c] devices (and other systems) authorized to connect to the system are identified;
			: [d] system access is limited to authorized users;
			: [e] system access is limited to processes acting on behalf of authorized users; and
			: [f] system access is limited to authorized devices (including other systems).
			=== POTENTIAL ASSESSMENT METHODS AND OBJECTS [NIST SP 800-171A] ===
	'''Examine'''		'''Examine'''
	[SELECT FROM: Access control policy; procedures addressing access enforcement; system security plan;system design documentation;list of approved authorizations including remote access authorizations; system audit logs and records; system configuration settings and associated documentation; other relevant documents or records].

			[SELECT FROM: Access control policy; procedures addressing account management; system security plan; system design documentation; system configuration settings and associated documentation; list of active system accounts and the name of the individual associated with each account; notifications or records of recently transferred, separated, or terminated employees; list of conditions for group and role membership; list of recently disabled system accounts along with the name of the individual associated with each account; access authorization records; account management compliance reviews; system monitoring records; system audit logs and records; list of devices and systems authorized to connect to organizational systems; other relevant documents or records].

	'''Interview'''		'''Interview'''
	[SELECT FROM: Personnel with ~~access enforcement~~ responsibilities; system or network administrators; personnel with information security responsibilities~~; system developers~~].
			[SELECT FROM: Personnel with account management responsibilities; system or network administrators; personnel with information security responsibilities].

	'''Test'''		'''Test'''
	[SELECT FROM: ~~Mechanisms~~ implementing ~~access control policy~~].
	=== DISCUSSION ===		[SELECT FROM: Organizational processes for managing system accounts; mechanisms for implementing account management].
	~~Organizations may choose to define~~ access ~~privileges~~ or ~~other attributes by account~~, ~~by type~~ of ~~account,~~ or ~~a combination of both~~. ~~System account types include individual~~, ~~shared~~, ~~group~~, ~~system, anonymous, guest, emergency, developer, manufacturer, vendor~~, and ~~temporary~~.Other ~~attributes required for authorizing access~~ include ~~restrictions~~ on ~~time-~~of~~-day, day-~~of~~- week~~, ~~and point-of-origin.In defining~~ other account ~~attributes, organizations consider system-related requirements~~ (e.g., ~~system upgrades scheduled maintenance,~~) ~~and mission or business requirements,~~ (e.g.~~, time zone differences, customer requirements, remote access to support travel requirements~~).		=== DISCUSSION [NIST SP 800-171 R2] ===
			Access control policies (e.g., identity- or role-based policies, control matrices, and cryptography) control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (e.g., devices, files, records, and domains) in systems. Access enforcement mechanisms can be employed at the application and service level to provide increased information security. Other systems include systems internal and external to the organization. This requirement focuses on account management for systems and applications. The definition of and enforcement of access authorizations, other than those determined by account type (e.g., privileged verses [sic] non-privileged) are addressed in requirement 3.1.2 (AC.L1-3.1.2).
	=== FURTHER DISCUSSION ===		=== FURTHER DISCUSSION ===
	~~Limit~~ users ~~to only the information systems~~, ~~roles~~, ~~or applications they~~ are ~~permitted~~ to use and ~~are needed for their roles~~ and ~~responsibilities~~. Limit ~~access to applications and data based on~~ the authorized ~~users’ roles~~ and ~~responsibilities~~. ~~Common types of functions a~~ user ~~can be assigned are create~~, ~~read, update~~, and ~~delete~~.		Identify users, processes, and devices that are allowed to use company computers and can log on to the company network. Automated updates and other automatic processes should be associated with the user who initiated (authorized) the process. Limit the devices (e.g., printers) that can be accessed by company computers. Set up your system so that only authorized users, processes, and devices can access the company network.

			This practice, AC.L1-3.1.1, controls system access based on user, process, or device identity. AC.L1-3.1.1 leverages IA.L1-3.5.1 which provides a vetted and trusted identity for access control.

			'''Example 1'''

	~~'''Example'''~~		Your company maintains a list of all personnel authorized to use company information systems [a]. This list is used to support identification and authentication activities conducted by IT when authorizing access to systems [a,d].

	You ~~supervise~~ the ~~team that manages DoD contracts for your~~ company~~. Members of your team need~~ to access the ~~contract information to perform their work properly. Because some of~~ that ~~data contains FCI, you work with IT~~ to ~~set up your group’s systems so that users can~~ be ~~assigned access based on their specific roles [a]. Each role limits whether an employee has read-access or create/read/delete/update -~~access [b]~~. Implementing this access control restricts access to FCI information unless specifically authorized~~.		'''Example 2'''

			A coworker wants to buy a new multi-function printer/scanner/fax device and make it available on the company network. You explain that the company controls system and device access to the network and will prevent network access by unauthorized systems and devices [c]. You help the coworker submit a ticket that asks for the printer to be granted access to the network, and appropriate leadership approves the device [f].

	'''Potential Assessment Considerations'''		'''Potential Assessment Considerations'''
	* ~~Are access control lists used to limit access to applications and data based on role~~ and~~/or identity~~ [a]?
	* ~~Is access for~~ authorized ~~users restricted to those parts of the~~ system ~~they are explicitly permitted to use (~~e~~.g.~~, ~~a person who only performs word-processing cannot access developer tools) [b~~]?		* Is a list of authorized users maintained that defines their identities and roles [a]?
	=== KEY REFERENCES ===		* Are account requests authorized before system access is granted [d,e,f]?
	* FAR Clause 52.204-21 b.1.ii		===KEY REFERENCES===
	* NIST SP 800-171 Rev 2 3.1.2		* FAR Clause 52.204-21 b.1.i
			* NIST SP 800-171 Rev 2 3.1.1

Wikiadmin at 18:47, 23 February 2022

2022-02-23T18:47:07Z

← Older revision		Revision as of 18:47, 23 February 2022
Line 25:		Line 25:

	'''Example'''		'''Example'''

	You supervise the team that manages DoD contracts for your company. Members of your team need to access the contract information to perform their work properly. Because some of that data contains FCI, you work with IT to set up your group’s systems so that users can be assigned access based on their specific roles [a]. Each role limits whether an employee has read-access or create/read/delete/update -access [b]. Implementing this access control restricts access to FCI information unless specifically authorized.		You supervise the team that manages DoD contracts for your company. Members of your team need to access the contract information to perform their work properly. Because some of that data contains FCI, you work with IT to set up your group’s systems so that users can be assigned access based on their specific roles [a]. Each role limits whether an employee has read-access or create/read/delete/update -access [b]. Implementing this access control restricts access to FCI information unless specifically authorized.

Wikiadmin at 18:16, 23 February 2022

2022-02-23T18:16:15Z

← Older revision		Revision as of 18:16, 23 February 2022
Line 1:		Line 1:
			'''Source of Reference: The official [https://www.acq.osd.mil/cmmc/documentation.html CMMC Level 1 Self-Assessment Guide] from the Office of the Under Secretary of Defense Acquisition & Sustainment.'''

			For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

	== AC.L1-3.1.2 – TRANSACTION & FUNCTION CONTROL ==		== AC.L1-3.1.2 – TRANSACTION & FUNCTION CONTROL ==
	=== SECURITY REQUIREMENT ===		=== SECURITY REQUIREMENT ===

Wikiadmin: Created page with "== AC.L1-3.1.2 – TRANSACTION & FUNCTION CONTROL == === SECURITY REQUIREMENT === Limit information system access to the types of transactions and functions that authorized users are permitted to execute. === ASSESSMENT OBJECTIVES === Determine if: : [a] the types of transactions and functions that authorized users are permitted to execute are defined; and : [b] system access is limited to the defined types of transactions and functions for authorized users. === POTENTI..."

2022-02-23T17:54:53Z

Created page with "== AC.L1-3.1.2 – TRANSACTION & FUNCTION CONTROL == === SECURITY REQUIREMENT === Limit information system access to the types of transactions and functions that authorized users are permitted to execute. === ASSESSMENT OBJECTIVES === Determine if: : [a] the types of transactions and functions that authorized users are permitted to execute are defined; and : [b] system access is limited to the defined types of transactions and functions for authorized users. === POTENTI..."

New page

== AC.L1-3.1.2 – TRANSACTION & FUNCTION CONTROL ==
=== SECURITY REQUIREMENT ===
Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
=== ASSESSMENT OBJECTIVES ===
Determine if:
: [a] the types of transactions and functions that authorized users are permitted to execute are defined; and
: [b] system access is limited to the defined types of transactions and functions for authorized users.
=== POTENTIAL ASSESSMENT METHODS AND OBJECTS ===
'''Examine'''
[SELECT FROM: Access control policy; procedures addressing access enforcement; system security plan;system design documentation;list of approved authorizations including remote access authorizations; system audit logs and records; system configuration settings and associated documentation; other relevant documents or records].

'''Interview'''
[SELECT FROM: Personnel with access enforcement responsibilities; system or network administrators; personnel with information security responsibilities; system developers].

'''Test'''
[SELECT FROM: Mechanisms implementing access control policy].
=== DISCUSSION ===
Organizations may choose to define access privileges or other attributes by account, by type of account, or a combination of both. System account types include individual, shared, group, system, anonymous, guest, emergency, developer, manufacturer, vendor, and temporary.Other attributes required for authorizing access include restrictions on time-of-day, day-of- week, and point-of-origin.In defining other account attributes, organizations consider system-related requirements (e.g., system upgrades scheduled maintenance,) and mission or business requirements, (e.g., time zone differences, customer requirements, remote access to support travel requirements).
=== FURTHER DISCUSSION ===
Limit users to only the information systems, roles, or applications they are permitted to use and are needed for their roles and responsibilities. Limit access to applications and data based on the authorized users’ roles and responsibilities. Common types of functions a user can be assigned are create, read, update, and delete.

'''Example'''
You supervise the team that manages DoD contracts for your company. Members of your team need to access the contract information to perform their work properly. Because some of that data contains FCI, you work with IT to set up your group’s systems so that users can be assigned access based on their specific roles [a]. Each role limits whether an employee has read-access or create/read/delete/update -access [b]. Implementing this access control restricts access to FCI information unless specifically authorized.

'''Potential Assessment Considerations'''
* Are access control lists used to limit access to applications and data based on role and/or identity [a]?
* Is access for authorized users restricted to those parts of the system they are explicitly permitted to use (e.g., a person who only performs word-processing cannot access developer tools) [b]?
=== KEY REFERENCES ===
* FAR Clause 52.204-21 b.1.ii
* NIST SP 800-171 Rev 2 3.1.2