Practice AC.L1-3.1.2 Details: Difference between revisions

From CMMC Toolkit Wiki
Jump to navigation Jump to search
No edit summary
No edit summary
Line 3: Line 3:
For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.
For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.


== AC.L1-3.1.2 – TRANSACTION & FUNCTION CONTROL ==
== AC.L1-3.1.1 – AUTHORIZED ACCESS CONTROL ==
=== SECURITY REQUIREMENT ===
=== SECURITY REQUIREMENT ===
Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
=== ASSESSMENT OBJECTIVES ===
=== ASSESSMENT OBJECTIVES [NIST SP 800-171A] ===
Determine if:  
Determine if:
: [a] the types of transactions and functions that authorized users are permitted to execute are defined; and
: [a] authorized users are identified;
: [b] system access is limited to the defined types of transactions and functions for authorized users.
: [b] processes acting on behalf of authorized users are identified;
=== POTENTIAL ASSESSMENT METHODS AND OBJECTS ===
: [c] devices (and other systems) authorized to connect to the system are identified;
: [d] system access is limited to authorized users;
: [e] system access is limited to processes acting on behalf of authorized users; and
: [f] system access is limited to authorized devices (including other systems).
=== POTENTIAL ASSESSMENT METHODS AND OBJECTS [NIST SP 800-171A] ===
'''Examine'''
'''Examine'''
[SELECT FROM: Access control policy; procedures addressing access enforcement; system security plan;system design documentation;list of approved authorizations including remote access authorizations; system audit logs and records; system configuration settings and associated documentation; other relevant documents or records].


[SELECT FROM: Access control policy; procedures addressing account management; system security plan; system design documentation; system configuration settings and associated documentation; list of active system accounts and the name of the individual associated with each account; notifications or records of recently transferred, separated, or terminated employees; list of conditions for group and role membership; list of recently disabled system accounts along with the name of the individual associated with each account; access authorization records; account management compliance reviews; system monitoring records; system audit logs and records; list of devices and systems authorized to connect to organizational systems; other relevant documents or records].
'''Interview'''
'''Interview'''
[SELECT FROM: Personnel with access enforcement responsibilities; system or network administrators; personnel with information security responsibilities; system developers].
 
[SELECT FROM: Personnel with account management responsibilities; system or network administrators; personnel with information security responsibilities].


'''Test'''
'''Test'''
[SELECT FROM: Mechanisms implementing access control policy].
 
=== DISCUSSION ===
[SELECT FROM: Organizational processes for managing system accounts; mechanisms for implementing account management].  
Organizations may choose to define access privileges or other attributes by account, by type of account, or a combination of both. System account types include individual, shared, group, system, anonymous, guest, emergency, developer, manufacturer, vendor, and temporary.Other attributes required for authorizing access include restrictions on time-of-day, day-of- week, and point-of-origin.In defining other account attributes, organizations consider system-related requirements (e.g., system upgrades scheduled maintenance,) and mission or business requirements, (e.g., time zone differences, customer requirements, remote access to support travel requirements).
=== DISCUSSION [NIST SP 800-171 R2] ===
Access control policies (e.g., identity- or role-based policies, control matrices, and cryptography) control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (e.g., devices, files, records, and domains) in systems. Access enforcement mechanisms can be employed at the application and service level to provide increased information security. Other systems include systems internal and external to the organization. This requirement focuses on account management for systems and applications. The definition of and enforcement of access authorizations, other than those determined by account type (e.g., privileged verses [sic] non-privileged) are addressed in requirement 3.1.2 (AC.L1-3.1.2).  
=== FURTHER DISCUSSION ===
=== FURTHER DISCUSSION ===
Limit users to only the information systems, roles, or applications they are permitted to use and are needed for their roles and responsibilities. Limit access to applications and data based on the authorized users’ roles and responsibilities. Common types of functions a user can be assigned are create, read, update, and delete.
Identify users, processes, and devices that are allowed to use company computers and can log on to the company network. Automated updates and other automatic processes should be associated with the user who initiated (authorized) the process. Limit the devices (e.g., printers) that can be accessed by company computers. Set up your system so that only authorized users, processes, and devices can access the company network.
 
This practice, AC.L1-3.1.1, controls system access based on user, process, or device identity. AC.L1-3.1.1 leverages IA.L1-3.5.1 which provides a vetted and trusted identity for access control.
 
'''Example 1'''


'''Example'''
Your company maintains a list of all personnel authorized to use company information systems [a]. This list is used to support identification and authentication activities conducted by IT when authorizing access to systems [a,d].


You supervise the team that manages DoD contracts for your company. Members of your team need to access the contract information to perform their work properly. Because some of that data contains FCI, you work with IT to set up your group’s systems so that users can be assigned access based on their specific roles [a]. Each role limits whether an employee has read-access or create/read/delete/update -access [b]. Implementing this access control restricts access to FCI information unless specifically authorized.
'''Example 2'''
 
A coworker wants to buy a new multi-function printer/scanner/fax device and make it available on the company network. You explain that the company controls system and device access to the network and will prevent network access by unauthorized systems and devices [c]. You help the coworker submit a ticket that asks for the printer to be granted access to the network, and appropriate leadership approves the device [f].


'''Potential Assessment Considerations'''
'''Potential Assessment Considerations'''
* Are access control lists used to limit access to applications and data based on role and/or identity [a]?  
 
* Is access for authorized users restricted to those parts of the system they are explicitly permitted to use (e.g., a person who only performs word-processing cannot access developer tools) [b]?
* Is a list of authorized users maintained that defines their identities and roles [a]?
=== KEY REFERENCES ===
* Are account requests authorized before system access is granted [d,e,f]?
* FAR Clause 52.204-21 b.1.ii
===KEY REFERENCES===
* NIST SP 800-171 Rev 2 3.1.2
* FAR Clause 52.204-21 b.1.i
* NIST SP 800-171 Rev 2 3.1.1

Revision as of 18:49, 23 February 2022

Source of Reference: The official CMMC Level 1 Self-Assessment Guide from the Office of the Under Secretary of Defense Acquisition & Sustainment.

For inquiries and reporting errors on this wiki, please contact us. Thank you.

AC.L1-3.1.1 – AUTHORIZED ACCESS CONTROL

SECURITY REQUIREMENT

Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

ASSESSMENT OBJECTIVES [NIST SP 800-171A]

Determine if:

[a] authorized users are identified;
[b] processes acting on behalf of authorized users are identified;
[c] devices (and other systems) authorized to connect to the system are identified;
[d] system access is limited to authorized users;
[e] system access is limited to processes acting on behalf of authorized users; and
[f] system access is limited to authorized devices (including other systems).

POTENTIAL ASSESSMENT METHODS AND OBJECTS [NIST SP 800-171A]

Examine

[SELECT FROM: Access control policy; procedures addressing account management; system security plan; system design documentation; system configuration settings and associated documentation; list of active system accounts and the name of the individual associated with each account; notifications or records of recently transferred, separated, or terminated employees; list of conditions for group and role membership; list of recently disabled system accounts along with the name of the individual associated with each account; access authorization records; account management compliance reviews; system monitoring records; system audit logs and records; list of devices and systems authorized to connect to organizational systems; other relevant documents or records].

Interview

[SELECT FROM: Personnel with account management responsibilities; system or network administrators; personnel with information security responsibilities].

Test

[SELECT FROM: Organizational processes for managing system accounts; mechanisms for implementing account management].

DISCUSSION [NIST SP 800-171 R2]

Access control policies (e.g., identity- or role-based policies, control matrices, and cryptography) control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (e.g., devices, files, records, and domains) in systems. Access enforcement mechanisms can be employed at the application and service level to provide increased information security. Other systems include systems internal and external to the organization. This requirement focuses on account management for systems and applications. The definition of and enforcement of access authorizations, other than those determined by account type (e.g., privileged verses [sic] non-privileged) are addressed in requirement 3.1.2 (AC.L1-3.1.2).

FURTHER DISCUSSION

Identify users, processes, and devices that are allowed to use company computers and can log on to the company network. Automated updates and other automatic processes should be associated with the user who initiated (authorized) the process. Limit the devices (e.g., printers) that can be accessed by company computers. Set up your system so that only authorized users, processes, and devices can access the company network.

This practice, AC.L1-3.1.1, controls system access based on user, process, or device identity. AC.L1-3.1.1 leverages IA.L1-3.5.1 which provides a vetted and trusted identity for access control.

Example 1

Your company maintains a list of all personnel authorized to use company information systems [a]. This list is used to support identification and authentication activities conducted by IT when authorizing access to systems [a,d].

Example 2

A coworker wants to buy a new multi-function printer/scanner/fax device and make it available on the company network. You explain that the company controls system and device access to the network and will prevent network access by unauthorized systems and devices [c]. You help the coworker submit a ticket that asks for the printer to be granted access to the network, and appropriate leadership approves the device [f].

Potential Assessment Considerations

  • Is a list of authorized users maintained that defines their identities and roles [a]?
  • Are account requests authorized before system access is granted [d,e,f]?

KEY REFERENCES

  • FAR Clause 52.204-21 b.1.i
  • NIST SP 800-171 Rev 2 3.1.1
Retrieved from "https://cmmcwiki.org/index.php?title=Practice_AC.L1-3.1.2_Details&oldid=94"