Practice AC.L1-3.1.2 Details: Difference between revisions

From CMMC Toolkit Wiki
Jump to navigation Jump to search
No edit summary
No edit summary
 
Line 3: Line 3:
For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.
For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.


== AC.L1-3.1.1 – AUTHORIZED ACCESS CONTROL ==
== AC.L1-3.1.2 – TRANSACTION & FUNCTION CONTROL ==
=== SECURITY REQUIREMENT ===
=== SECURITY REQUIREMENT ===
Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
=== ASSESSMENT OBJECTIVES [NIST SP 800-171A] ===
=== ASSESSMENT OBJECTIVES ===
Determine if:
Determine if:  
: [a] authorized users are identified;
: [a] the types of transactions and functions that authorized users are permitted to execute are defined; and
: [b] processes acting on behalf of authorized users are identified;
: [b] system access is limited to the defined types of transactions and functions for authorized users.
: [c] devices (and other systems) authorized to connect to the system are identified;
=== POTENTIAL ASSESSMENT METHODS AND OBJECTS ===
: [d] system access is limited to authorized users;
: [e] system access is limited to processes acting on behalf of authorized users; and
: [f] system access is limited to authorized devices (including other systems).
=== POTENTIAL ASSESSMENT METHODS AND OBJECTS [NIST SP 800-171A] ===
'''Examine'''
'''Examine'''


[SELECT FROM: Access control policy; procedures addressing account management; system security plan; system design documentation; system configuration settings and associated documentation; list of active system accounts and the name of the individual associated with each account; notifications or records of recently transferred, separated, or terminated employees; list of conditions for group and role membership; list of recently disabled system accounts along with the name of the individual associated with each account; access authorization records; account management compliance reviews; system monitoring records; system audit logs and records; list of devices and systems authorized to connect to organizational systems; other relevant documents or records].
[SELECT FROM: Access control policy; procedures addressing access enforcement; system security plan;system design documentation;list of approved authorizations including remote access authorizations; system audit logs and records; system configuration settings and associated documentation; other relevant documents or records].
 
'''Interview'''
'''Interview'''


[SELECT FROM: Personnel with account management responsibilities; system or network administrators; personnel with information security responsibilities].
[SELECT FROM: Personnel with access enforcement responsibilities; system or network administrators; personnel with information security responsibilities; system developers].


'''Test'''
'''Test'''


[SELECT FROM: Organizational processes for managing system accounts; mechanisms for implementing account management].  
[SELECT FROM: Mechanisms implementing access control policy].
=== DISCUSSION [NIST SP 800-171 R2] ===
=== DISCUSSION ===
Access control policies (e.g., identity- or role-based policies, control matrices, and cryptography) control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (e.g., devices, files, records, and domains) in systems. Access enforcement mechanisms can be employed at the application and service level to provide increased information security. Other systems include systems internal and external to the organization. This requirement focuses on account management for systems and applications. The definition of and enforcement of access authorizations, other than those determined by account type (e.g., privileged verses [sic] non-privileged) are addressed in requirement 3.1.2 (AC.L1-3.1.2).  
Organizations may choose to define access privileges or other attributes by account, by type of account, or a combination of both. System account types include individual, shared, group, system, anonymous, guest, emergency, developer, manufacturer, vendor, and temporary.Other attributes required for authorizing access include restrictions on time-of-day, day-of- week, and point-of-origin.In defining other account attributes, organizations consider system-related requirements (e.g., system upgrades scheduled maintenance,) and mission or business requirements, (e.g., time zone differences, customer requirements, remote access to support travel requirements).
=== FURTHER DISCUSSION ===
=== FURTHER DISCUSSION ===
Identify users, processes, and devices that are allowed to use company computers and can log on to the company network. Automated updates and other automatic processes should be associated with the user who initiated (authorized) the process. Limit the devices (e.g., printers) that can be accessed by company computers. Set up your system so that only authorized users, processes, and devices can access the company network.
Limit users to only the information systems, roles, or applications they are permitted to use and are needed for their roles and responsibilities. Limit access to applications and data based on the authorized users’ roles and responsibilities. Common types of functions a user can be assigned are create, read, update, and delete.


This practice, AC.L1-3.1.1, controls system access based on user, process, or device identity. AC.L1-3.1.1 leverages IA.L1-3.5.1 which provides a vetted and trusted identity for access control.
'''Example'''


'''Example 1'''
You supervise the team that manages DoD contracts for your company. Members of your team need to access the contract information to perform their work properly. Because some of that data contains FCI, you work with IT to set up your group’s systems so that users can be assigned access based on their specific roles [a]. Each role limits whether an employee has read-access or create/read/delete/update -access [b]. Implementing this access control restricts access to FCI information unless specifically authorized.
 
Your company maintains a list of all personnel authorized to use company information systems [a]. This list is used to support identification and authentication activities conducted by IT when authorizing access to systems [a,d].
 
'''Example 2'''
 
A coworker wants to buy a new multi-function printer/scanner/fax device and make it available on the company network. You explain that the company controls system and device access to the network and will prevent network access by unauthorized systems and devices [c]. You help the coworker submit a ticket that asks for the printer to be granted access to the network, and appropriate leadership approves the device [f].


'''Potential Assessment Considerations'''
'''Potential Assessment Considerations'''
 
* Are access control lists used to limit access to applications and data based on role and/or identity [a]?  
* Is a list of authorized users maintained that defines their identities and roles [a]?
* Is access for authorized users restricted to those parts of the system they are explicitly permitted to use (e.g., a person who only performs word-processing cannot access developer tools) [b]?
* Are account requests authorized before system access is granted [d,e,f]?
=== KEY REFERENCES ===
===KEY REFERENCES===
* FAR Clause 52.204-21 b.1.ii
* FAR Clause 52.204-21 b.1.i
* NIST SP 800-171 Rev 2 3.1.2
* NIST SP 800-171 Rev 2 3.1.1

Latest revision as of 18:50, 23 February 2022

Source of Reference: The official CMMC Level 1 Self-Assessment Guide from the Office of the Under Secretary of Defense Acquisition & Sustainment.

For inquiries and reporting errors on this wiki, please contact us. Thank you.

AC.L1-3.1.2 – TRANSACTION & FUNCTION CONTROL

SECURITY REQUIREMENT

Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

ASSESSMENT OBJECTIVES

Determine if:

[a] the types of transactions and functions that authorized users are permitted to execute are defined; and
[b] system access is limited to the defined types of transactions and functions for authorized users.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine

[SELECT FROM: Access control policy; procedures addressing access enforcement; system security plan;system design documentation;list of approved authorizations including remote access authorizations; system audit logs and records; system configuration settings and associated documentation; other relevant documents or records].

Interview

[SELECT FROM: Personnel with access enforcement responsibilities; system or network administrators; personnel with information security responsibilities; system developers].

Test

[SELECT FROM: Mechanisms implementing access control policy].

DISCUSSION

Organizations may choose to define access privileges or other attributes by account, by type of account, or a combination of both. System account types include individual, shared, group, system, anonymous, guest, emergency, developer, manufacturer, vendor, and temporary.Other attributes required for authorizing access include restrictions on time-of-day, day-of- week, and point-of-origin.In defining other account attributes, organizations consider system-related requirements (e.g., system upgrades scheduled maintenance,) and mission or business requirements, (e.g., time zone differences, customer requirements, remote access to support travel requirements).

FURTHER DISCUSSION

Limit users to only the information systems, roles, or applications they are permitted to use and are needed for their roles and responsibilities. Limit access to applications and data based on the authorized users’ roles and responsibilities. Common types of functions a user can be assigned are create, read, update, and delete.

Example

You supervise the team that manages DoD contracts for your company. Members of your team need to access the contract information to perform their work properly. Because some of that data contains FCI, you work with IT to set up your group’s systems so that users can be assigned access based on their specific roles [a]. Each role limits whether an employee has read-access or create/read/delete/update -access [b]. Implementing this access control restricts access to FCI information unless specifically authorized.

Potential Assessment Considerations

  • Are access control lists used to limit access to applications and data based on role and/or identity [a]?
  • Is access for authorized users restricted to those parts of the system they are explicitly permitted to use (e.g., a person who only performs word-processing cannot access developer tools) [b]?

KEY REFERENCES

  • FAR Clause 52.204-21 b.1.ii
  • NIST SP 800-171 Rev 2 3.1.2
Retrieved from "https://cmmcwiki.org/index.php?title=Practice_AC.L1-3.1.2_Details&oldid=96"