Att_J-3_AITS_Security_Controls.pdf

Exported On: 1/10/2019

Control Number Family Control Title Control Text Confidentiality Integrity Availability Supplemental Guidance Criticality

AC-1 AC ACCESS

CONTROL

POLICY AND

PROCEDURES

The organization:a. Develops, documents, and disseminates to [Assignment:

organization-defined personnel or roles]: 1.

An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and 2. Procedures to facilitate the implementation of the access control policy and associated access controls; andb.

Reviews and updates the current: 1.

Access control policy [Assignment:

organization-defined frequency]; and 2.

Access control procedures [Assignment:

organization-defined frequency].

High Moderate Low

High Moderate Low

High Moderate Low

Supplemental Guidance: This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AC family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures. Related control: PM-9.

White

AC-2 AC ACCOUNT

MANAGEMENT

The organization:a. Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment:

organization-defined information system account types];b. Assigns account managers for information system accounts;c.

Establishes conditions for group and role membership;d. Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;e. Requires approvals by [Assignment: organization-defined personnel or roles] for requests to create information system accounts;f. Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions];g. Monitors the use of information system accounts;h.

Notifies account managers: 1. When accounts are no longer required; 2. When users are terminated or transferred; and 3.

When individual information system usage or need-to-know changes;i. Authorizes access to the information system based on:

1. A valid access authorization; 2.

Intended system usage; and 3. Other

High Moderate Low

High Moderate Low

Supplemental Guidance: Information system account types include, for example, individual, shared, group, system, guest/anonymous, emergency, developer/manufacturer/vendor, temporary, and service.

Some of the account management requirements listed above can be implemented by organizational information systems. The identification of authorized users of the information system and the specification of access privileges reflects the requirements in other security controls in the security plan. Users requiring administrative privileges on information system accounts receive additional scrutiny by appropriate organizational personnel (e.g., system owner, mission/business owner, or chief information security officer) responsible for approving such accounts and privileged access. Organizations may choose to define access privileges or other attributes by account, by type of account, or a combination of both. Other attributes required for authorizing access include, for example, restrictions on time-of-day, day-of-week, and point-of-origin. In defining other account attributes, organizations consider system-related requirements (e.g., scheduled maintenance, system upgrades) and mission/business requirements, (e.g., time zone differences, customer requirements, remote access to support travel requirements). Failure to consider these factors could affect information system availability. Temporary and emergency accounts are accounts intended for short-term use. Organizations establish temporary accounts as a part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. Organizations establish emergency accounts in response to crisis situations and with the need for rapid account activation.

Therefore, emergency account activation may bypass normal account authorization processes. Emergency and temporary accounts are not to be confused with infrequently used accounts (e.g., local logon accounts

Yellow

AC-2 (1) AC ACCOUNT

MANAGEMENT

| AUTOMATED

SYSTEM

ACCOUNT

MANAGEMENT

The organization employs automated mechanisms to support the management of information system accounts.

High Moderate

High Moderate

Supplemental Guidance: The use of automated mechanisms can include, for example: using email or text messaging to automatically notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using telephonic notification to report atypical system account usage.

White

AC-2 (2) AC ACCOUNT

MANAGEMENT

| REMOVAL OF

TEMPORARY /

EMERGENCY

ACCOUNTS

The information system automatically [Selection: removes; disables] temporary and emergency accounts after [Assignment:

organization-defined time period for each type of account].

High Moderate

High Moderate

Supplemental Guidance: This control enhancement requires the removal of both temporary and emergency accounts automatically after a predefined period of time has elapsed, rather than at the convenience of the systems administrator.

White

AC-2 (3) AC ACCOUNT

MANAGEMENT

| DISABLE

INACTIVE

ACCOUNTS

The information system automatically disables inactive accounts after [Assignment: organization-defined time period].

High Moderate

High Moderate

White

AC-2 (4) AC ACCOUNT

MANAGEMENT

| AUTOMATED

AUDIT

ACTIONS

The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles].

High Moderate Low

High Moderate Low

Supplemental Guidance: Related controls: AU-2, AU-12. White

AC-2 (5) AC ACCOUNT

MANAGEMENT

| INACTIVITY

LOGOUT

The organization requires that users log out when [Assignment: organization-defined time-period of expected inactivity or description of when to log out].

High Moderate Low

High Moderate Low

High Moderate Low

Supplemental Guidance: Related control: SC-23. White

AC-2 (7) AC ACCOUNT

MANAGEMENT

| ROLE-BASED

SCHEMES

The organization:(a) Establishes and administers privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles;(b) Monitors privileged role assignments; and(c) Takes [Assignment: organization-defined actions] when privileged role assignments are no longer appropriate.

High Moderate Low

High Moderate Low

Supplemental Guidance: Privileged roles are organization-defined roles assigned to individuals that allow those individuals to perform certain security-relevant functions that ordinary users are not authorized to perform. These privileged roles include, for example, key management, account management, network and system administration, database administration, and web administration.

White

AC-2 (9) AC ACCOUNT

MANAGEMENT

RESTRICTIONS

ON USE OF

SHARED

GROUPS /

ACCOUNTS

The organization only permits the use of shared/group accounts that meet [Assignment: organization-defined conditions for establishing shared/group accounts].

High Moderate Low

High Moderate Low

White

AC-2 (10) AC ACCOUNT

MANAGEMENT

| SHARED /

GROUP

ACCOUNT

CREDENTIAL

TERMINATION

The information system terminates shared/group account credentials when members leave the group.

High Moderate Low

High Moderate Low

Yellow

AC-2 (12) AC ACCOUNT

MANAGEMENT

| ACCOUNT

MONITORING /

ATYPICAL

USAGE

The organization:(a) Monitors information system accounts for [Assignment:

organization-defined atypical use]; and(b) Reports atypical usage of information system accounts to [Assignment:

organization-defined personnel or roles].

High Moderate Low

High Moderate Low

Supplemental Guidance: Atypical usage includes, for example, accessing information systems at certain times of the day and from locations that are not consistent with the normal usage patterns of individuals working in organizations. Related control: CA-7.

White

CNSS 1253 Security Controls Confidentiality: Moderate; Integrity: Moderate; Availability: Moderate

Overlays Applied: None

AC-2 (13) AC ACCOUNT

MANAGEMENT

| DISABLE

ACCOUNTS

FOR HIGH-

RISK

INDIVIDUALS

The organization disables accounts of users posing a significant risk within [Assignment:

organization-defined time period] of discovery of the risk.

High Moderate Low

High Moderate Low

Supplemental Guidance: Users posing a significant risk to organizations include individuals for whom reliable evidence or intelligence indicates either the intention to use authorized access to information systems to cause harm or through whom adversaries will cause harm. Harm includes potential adverse impacts to organizational operations and assets, individuals, other organizations, or the Nation. Close coordination between authorizing officials, information system administrators, and human resource managers is essential in order for timely execution of this control enhancement. Related control: PS-4.

Yellow

AC-3 AC ACCESS

ENFORCEMEN

T

The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

High Moderate Low

High Moderate Low

Supplemental Guidance: Access control policies (e.g., identity-based policies, role-based policies, attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (e.g., devices, files, records, domains) in information systems. In addition to enforcing authorized access at the information system level and recognizing that information systems can host many applications and services in support of organizational missions and business operations, access enforcement mechanisms can also be employed at the application and service level to provide increased information security. Related controls: AC-2, AC-4, AC-5, AC-6, AC-16, AC-17, AC-18, AC-19, AC-20, AC-21, AC-22, AU-9, CM-5, CM-6, CM-

11, MA-3, MA-4, MA-5, PE-3.

Yellow

AC-3 (4) AC ACCESS

ENFORCEMEN

T |

DISCRETIONA

RY ACCESS

CONTROL

The information system enforces [Assignment: organization-defined discretionary access control policies] over defined subjects and objects where the policy specifies that a subject that has been granted access to information can do one or more of the following:(a) Pass the information to any other subjects or objects;(b) Grant its privileges to other subjects;(c) Change security attributes on subjects, objects, the information system, or the information system’s components;(d) Choose the security attributes to be associated with newly created or revised objects; or(e) Change the rules governing access control.

High Moderate Low

High Moderate Low

Supplemental Guidance: When discretionary access control policies are implemented, subjects are not constrained with regard to what actions they can take with information for which they have already been granted access. Thus, subjects that have been granted access to information are not prevented from passing (i.e., the subjects have the discretion to pass) the information to other subjects or objects. This control enhancement can operate in conjunction with AC-3 (3). A subject that is constrained in its operation by policies governed by AC-3 (3) is still able to operate under the less rigorous constraints of this control enhancement. Thus, while AC-3 (3) imposes constraints preventing a subject from passing information to another subject operating at a different sensitivity level, AC-3 (4) permits the subject to pass the information to any subject at the same sensitivity level. The policy is bounded by the information system boundary. Once the information is passed outside of the control of the information system, additional means may be required to ensure that the constraints remain in effect.

While the older, more traditional definitions of discretionary access control require identity-based access control, that limitation is not required for this use of discretionary access control.

White

AC-4 AC INFORMATION

FLOW

ENFORCEMEN

T

The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on [Assignment: organization-defined information flow control policies].

High Moderate

High Moderate

Supplemental Guidance: Information flow control regulates where information is allowed to travel within an information system and between information systems (as opposed to who is allowed to access the information) and without explicit regard to subsequent accesses to that information. Flow control restrictions include, for example, keeping export-controlled information from being transmitted in the clear to the Internet, blocking outside traffic that claims to be from within the organization, restricting web requests to the Internet that are not from the internal web proxy server, and limiting information transfers between organizations based on data structures and content. Transferring information between information systems representing different security domains with different security policies introduces risk that such transfers violate one or more domain security policies. In such situations, information owners/stewards provide guidance at designated policy enforcement points between interconnected systems. Organizations consider mandating specific architectural solutions when required to enforce specific security policies. Enforcement includes, for example: (i) prohibiting information transfers between interconnected systems (i.e., allowing access only); (ii) employing hardware mechanisms to enforce one-way information flows; and (iii) implementing trustworthy regrading mechanisms to reassign security attributes and security labels.Organizations commonly employ information flow control policies and enforcement mechanisms to control the flow of information between designated sources and destinations (e.g., networks, individuals, and devices) within information systems and between interconnected systems. Flow control is based on the characteristics of the information and/or the information path. Enforcement occurs, for example, in boundary protection devices (e.g., gateways, routers, guards, encrypted tunnels, firewalls) that employ rule sets or establish configuration settings

Yellow

AC-5 AC SEPARATION

OF DUTIES

The organization:a. Separates [Assignment:

organization-defined duties of individuals];b.

Documents separation of duties of individuals; andc. Defines information system access authorizations to support separation of duties.

High Moderate Low

High Moderate Low

Supplemental Guidance: Separation of duties addresses the potential for abuse of authorized privileges and helps to reduce the risk of malevolent activity without collusion. Separation of duties includes, for example: (i) dividing mission functions and information system support functions among different individuals and/or roles; (ii) conducting information system support functions with different individuals (e.g., system management, programming, configuration management, quality assurance and testing, and network security); and (iii) ensuring security personnel administering access control functions do not also administer audit functions. Related controls: AC-3, AC-6, PE-3, PE-4, PS-2.

White

AC-6 AC LEAST

PRIVILEGE

The organization employs the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.

High Moderate Low

High Moderate Low

Supplemental Guidance: Organizations employ least privilege for specific duties and information systems. The principle of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions/business functions.

Organizations consider the creation of additional processes, roles, and information system accounts as necessary, to achieve least privilege.

Organizations also apply least privilege to the development, implementation, and operation of organizational information systems.

Related controls: AC-2, AC-3, AC-5, CM-6, CM-7, PL-2.

White

AC-6 (1) AC LEAST

PRIVILEGE |

AUTHORIZE

ACCESS TO

SECURITY

FUNCTIONS

The organization explicitly authorizes access to [Assignment: organization-defined security functions (deployed in hardware, software, and firmware) and security-relevant information].

High Moderate Low

High Moderate Low

Supplemental Guidance: Security functions include, for example, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Security-relevant information includes, for example, filtering rules for routers/firewalls, cryptographic key management information, configuration parameters for security services, and access control lists. Explicitly authorized personnel include, for example, security administrators, system and network administrators, system security officers, system maintenance personnel, system programmers, and other privileged users. Related controls: AC-17, AC-

18, AC-19.

Yellow

AC-6 (2) AC LEAST

PRIVILEGE |

NON-

PRIVILEGED

ACCESS FOR

NONSECURITY

FUNCTIONS

The organization requires that users of information system accounts, or roles, with access to [Assignment: organization-defined security functions or security-relevant information], use non-privileged accounts or roles, when accessing nonsecurity functions.

High Moderate Low

High Moderate Low

Supplemental Guidance: This control enhancement limits exposure when operating from within privileged accounts or roles. The inclusion of roles addresses situations where organizations implement access control policies such as role-based access control and where a change of role provides the same degree of assurance in the change of access authorizations for both the user and all processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account. Related control: PL-4.

Yellow

AC-6 (5) AC LEAST

PRIVILEGE |

PRIVILEGED

ACCOUNTS

The organization restricts privileged accounts on the information system to [Assignment: organization-defined personnel or roles].

High Moderate Low

High Moderate Low

Supplemental Guidance: Privileged accounts, including super user accounts, are typically described as system administrator for various types of commercial off-the-shelf operating systems. Restricting privileged accounts to specific personnel or roles prevents day-to-day users from having access to privileged information/functions.

Organizations may differentiate in the application of this control enhancement between allowed privileges for local accounts and for domain accounts provided organizations retain the ability to control information system configurations for key security parameters and as otherwise necessary to sufficiently mitigate risk. Related control: CM-6.

Yellow

AC-6 (7) AC LEAST

PRIVILEGE |

REVIEW OF

USER

PRIVILEGES

The organization:(a) Reviews [Assignment:

organization-defined frequency] the privileges assigned to [Assignment:

organization-defined roles or classes of users] to validate the need for such privileges; and(b) Reassigns or removes privileges, if necessary, to correctly reflect organizational mission/business needs.

High Moderate Low

High Moderate Low

Supplemental Guidance: The need for certain assigned user privileges may change over time reflecting changes in organizational missions/business function, environments of operation, technologies, or threat. Periodic review of assigned user privileges is necessary to determine if the rationale for assigning such privileges remains valid. If the need cannot be revalidated, organizations take appropriate corrective actions. Related control: CA-7.

Yellow

AC-6 (8) AC LEAST

PRIVILEGE |

PRIVILEGE

LEVELS FOR

CODE

EXECUTION

The information system prevents [Assignment: organization-defined software] from executing at higher privilege levels than users executing the software.

High Moderate Low

High Moderate Low

Supplemental Guidance: In certain situations, software applications/programs need to execute with elevated privileges to perform required functions. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking such applications/programs, those users are indirectly provided with greater privileges than assigned by organizations.

Yellow

AC-6 (9) AC LEAST

PRIVILEGE |

AUDITING USE

OF

PRIVILEGED

FUNCTIONS

The information system audits the execution of privileged functions.

High Moderate Low

High Moderate Low

Supplemental Guidance: Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse, and in doing so, help mitigate the risk from insider threats and the advanced persistent threat (APT). Related control: AU-2.

White

AC-6 (10) AC LEAST

PRIVILEGE |

PROHIBIT NON-

PRIVILEGED

USERS FROM

EXECUTING

PRIVILEGED

FUNCTIONS

The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

High Moderate Low

High Moderate Low

Supplemental Guidance: Privileged functions include, for example, establishing information system accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.

Yellow

AC-7 AC UNSUCCESSF

UL LOGIN

ATTEMPTS

The information system:a. Enforces a limit of [Assignment: organization-defined number] consecutive invalid logon attempts by a user during a [Assignment: organization-defined time period]; andb. Automatically [Selection: locks the account/node for an [Assignment: organization-defined time period]; locks the account/node until released by an administrator; delays next logon prompt according to [Assignment:

organization-defined delay algorithm]] when the maximum number of unsuccessful attempts is exceeded.

High Moderate Low

High Moderate Low

High Moderate Low

Supplemental Guidance: This control applies regardless of whether the logon occurs via a local or network connection. Due to the potential for denial of service, automatic lockouts initiated by information systems are usually temporary and automatically release after a predetermined time period established by organizations. If a delay algorithm is selected, organizations may choose to employ different algorithms for different information system components based on the capabilities of those components. Responses to unsuccessful logon attempts may be implemented at both the operating system and the application levels.

Related controls: AC-2, AC-9, AC-14, IA-5.

Yellow

AC-8 AC SYSTEM USE

NOTIFICATION

The information system:a. Displays to users [Assignment: organization-defined system use notification message or banner] before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that: 1. Users are accessing a U.S. Government information system; 2. Information system usage may be monitored, recorded, and subject to audit;

3. Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and 4. Use of the information system indicates consent to monitoring and recording;b. Retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system;

andc. For publicly accessible systems: 1.

Displays system use information [Assignment: organization-defined conditions], before granting further access;

2. Displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and

3. Includes a description of the authorized

High Moderate Low

High Moderate Low

Supplemental Guidance: System use notifications can be implemented using messages or warning banners displayed before individuals log in to information systems. System use notifications are used only for access via logon interfaces with human users and are not required when such human interfaces do not exist. Organizations consider system use notification messages/banners displayed in multiple languages based on specific organizational needs and the demographics of information system users. Organizations also consult with the Office of the General Counsel for legal review and approval of warning banner content.

White

AC-10 AC CONCURRENT

SESSION

CONTROL

The information system limits the number of concurrent sessions for each [Assignment:

organization-defined account and/or account type] to [Assignment: organization-defined number].

High Moderate

High Moderate

High Moderate

Supplemental Guidance: Organizations may define the maximum number of concurrent sessions for information system accounts globally, by account type (e.g., privileged user, non-privileged user, domain, specific application), by account, or a combination. For example, organizations may limit the number of concurrent sessions for system administrators or individuals working in particularly sensitive domains or mission-critical applications. This control addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts.

White

AC-11 AC SESSION LOCK The information system:a. Prevents further access to the system by initiating a session lock after [Assignment: organization-defined time period] of inactivity or upon receiving a request from a user; andb. Retains the session lock until the user reestablishes access using established identification and authentication procedures.

High Moderate Low

High Moderate Low

Supplemental Guidance: Session locks are temporary actions taken when users stop work and move away from the immediate vicinity of information systems but do not want to log out because of the temporary nature of their absences. Session locks are implemented where session activities can be determined. This is typically at the operating system level, but can also be at the application level. Session locks are not an acceptable substitute for logging out of information systems, for example, if organizations require users to log out at the end of workdays.

Related control: AC-7.

White

AC-11 (1) AC SESSION LOCK

| PATTERN-

HIDING

DISPLAYS

The information system conceals, via the session lock, information previously visible on the display with a publicly viewable image.

High Moderate Low

Supplemental Guidance: Publicly viewable images can include static or dynamic images, for example, patterns used with screen savers, photographic images, solid colors, clock, battery life indicator, or a blank screen, with the additional caveat that none of the images convey sensitive information.

White

AC-12 AC SESSION

TERMINATION

The information system automatically terminates a user session after [Assignment:

organization-defined conditions or trigger events requiring session disconnect].

High Moderate

High Moderate

Supplemental Guidance: This control addresses the termination of user-initiated logical sessions in contrast to SC-10 which addresses the termination of network connections that are associated with communications sessions (i.e., network disconnect). A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user) accesses an organizational information system. Such user sessions can be terminated (and thus terminate user access) without terminating network sessions. Session termination terminates all processes associated with a user’s logical session except those processes that are specifically created by the user (i.e., session owner) to continue after the session is terminated.

Conditions or trigger events requiring automatic session termination can include, for example, organization-defined periods of user inactivity, targeted responses to certain types of incidents, time-of-day restrictions on information system use. Related controls: SC-10, SC-23.

Yellow

AC-12 (1) AC SESSION

TERMINATION |

USER-

INITIATED

LOGOUTS/

MESSAGE

DISPLAYS

The information system:(a) Provides a logout capability for user-initiated communications sessions whenever authentication is used to gain access to [Assignment: organization-defined information resources]; and(b) Displays an explicit logout message to users indicating the reliable termination of authenticated communications sessions.

High Moderate

High Moderate

Supplemental Guidance: Information resources to which users gain access via authentication include, for example, local workstations, databases, and password-protected websites/web-based services.

Logout messages for web page access, for example, can be displayed after authenticated sessions have been terminated. However, for some types of interactive sessions including, for example, file transfer protocol (FTP) sessions, information systems typically send logout messages as final messages prior to terminating sessions.

Yellow

AC-14 AC PERMITTED

ACTIONS

WITHOUT

IDENTIFICATIO

N OR

AUTHENTICATI

ON

The organization:a. Identifies [Assignment:

organization-defined user actions] that can be performed on the information system without identification or authentication consistent with organizational missions/business functions; andb.

Documents and provides supporting rationale in the security plan for the information system, user actions not requiring identification or authentication.

High Moderate Low

High Moderate Low

Supplemental Guidance: This control addresses situations in which organizations determine that no identification or authentication is required in organizational information systems. Organizations may allow a limited number of user actions without identification or authentication including, for example, when individuals access public websites or other publicly accessible federal information systems, when individuals use mobile phones to receive calls, or when facsimiles are received.

Organizations also identify actions that normally require identification or authentication but may under certain circumstances (e.g., emergencies), allow identification or authentication mechanisms to be bypassed. Such bypasses may occur, for example, via a software-readable physical switch that commands bypass of the logon functionality and is protected from accidental or unmonitored use. This control does not apply to situations where identification and authentication have already occurred and are not repeated, but rather to situations where identification and authentication have not yet occurred. Organizations may decide that there are no user actions that can be performed on organizational information systems without identification and authentication and thus, the values for assignment statements can be none. Related controls: CP-

2, IA-2.

White

AC-16 AC SECURITY

ATTRIBUTES

The organization:a. Provides the means to associate [Assignment: organization-defined types of security attributes] having [Assignment: organization-defined security attribute values] with information in storage, in process, and/or in transmission;b. Ensures that the security attribute associations are made and retained with the information;c.

Establishes the permitted [Assignment:

organization-defined security attributes] for [Assignment: organization-defined information systems]; andd. Determines the permitted [Assignment: organization-defined values or ranges] for each of the established security attributes.

High Moderate

High Moderate

Supplemental Guidance: Information is represented internally within information systems using abstractions known as data structures.

Internal data structures can represent different types of entities, both active and passive. Active entities, also known as subjects, are typically associated with individuals, devices, or processes acting on behalf of individuals. Passive entities, also known as objects, are typically associated with data structures such as records, buffers, tables, files, inter-process pipes, and communications ports. Security attributes, a form of metadata, are abstractions representing the basic properties or characteristics of active and passive entities with respect to safeguarding information. These attributes may be associated with active entities (i.e., subjects) that have the potential to send or receive information, to cause information to flow among objects, or to change the information system state. These attributes may also be associated with passive entities (i.e., objects) that contain or receive information. The association of security attributes to subjects and objects is referred to as binding and is typically inclusive of setting the attribute value and the attribute type. Security attributes when bound to data/information, enables the enforcement of information security policies for access control and information flow control, either through organizational processes or information system functions or mechanisms. The content or assigned values of security attributes can directly affect the ability of individuals to access organizational information.Organizations can define the types of attributes needed for selected information systems to support missions/business functions. There is potentially a wide range of values that can be assigned to any given security attribute. Release markings could include, for example, US only, NATO, or NOFORN (not releasable to foreign nationals). By specifying permitted attribute ranges and values, organizations can ensure that the security attribute values are

White

AC-16 (6) AC SECURITY

ATTRIBUTES |

MAINTENANCE

OF ATTRIBUTE

ASSOCIATION

BY

ORGANIZATIO

N

The organization allows personnel to associate, and maintain the association of [Assignment: organization-defined security attributes] with [Assignment: organization-defined subjects and objects] in accordance with [Assignment: organization-defined security policies].

High Moderate

High Moderate

Supplemental Guidance: This control enhancement requires individual users (as opposed to the information system) to maintain associations of security attributes with subjects and objects.

AC-17 AC REMOTE

ACCESS

The organization:a. Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; andb. Authorizes remote access to the information system prior to allowing such connections.

High Moderate Low

High Moderate Low

Supplemental Guidance: Remote access is access to organizational information systems by users (or processes acting on behalf of users) communicating through external networks (e.g., the Internet). Remote access methods include, for example, dial-up, broadband, and wireless.

Organizations often employ encrypted virtual private networks (VPNs) to enhance confidentiality and integrity over remote connections. The use of encrypted VPNs does not make the access non-remote; however, the use of VPNs, when adequately provisioned with appropriate security controls (e.g., employing appropriate encryption techniques for confidentiality and integrity protection) may provide sufficient assurance to the organization that it can effectively treat such connections as internal networks. Still, VPN connections traverse external networks, and the encrypted VPN does not enhance the availability of remote connections. Also, VPNs with encrypted tunnels can affect the organizational capability to adequately monitor network communications traffic for malicious code. Remote access controls apply to information systems other than public web servers or systems designed for public access. This control addresses authorization prior to allowing remote access without specifying the formats for such authorization. While organizations may use interconnection security agreements to authorize remote access connections, such agreements are not required by this control. Enforcing access restrictions for remote connections is addressed in AC-3. Related controls: AC-2, AC-3, AC-18, AC-19, AC-20, CA-3, CA-7, CM-8, IA-2, IA-3, IA-8, MA-4, PE-17, PL-4, SC-10, SI-4.

White

AC-17 (1) AC REMOTE

ACCESS |

AUTOMATED

MONITORING /

CONTROL

The information system monitors and controls remote access methods.

High Moderate Low

High Moderate Low

Supplemental Guidance: Automated monitoring and control of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote users on a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets). Related controls: AU-2, AU-12.

Yellow

AC-17 (2) AC REMOTE

ACCESS |

PROTECTION

OF

CONFIDENTIAL

ITY /

INTEGRITY

USING

ENCRYPTION

The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.

High Moderate Low

High Moderate Low

Supplemental Guidance: The encryption strength of mechanism is selected based on the security categorization of the information. Related controls: SC-8, SC-12, SC-13.

Yellow

AC-17 (3) AC REMOTE

ACCESS |

MANAGED

ACCESS

CONTROL

POINTS

The information system routes all remote accesses through [Assignment: organization-defined number] managed network access control points.

High Moderate Low

High Moderate Low

Supplemental Guidance: Limiting the number of access control points for remote accesses reduces the attack surface for organizations.

Organizations consider the Trusted Internet Connections (TIC) initiative requirements for external network connections. Related control: SC-7.

Yellow

AC-17 (4) AC REMOTE

ACCESS |

PRIVILEGED

COMMANDS/

ACCESS

The organization:(a) Authorizes the execution of privileged commands and access to security-relevant information via remote access only for [Assignment:

organization-defined needs]; and(b) Documents the rationale for such access in the security plan for the information system.

High Moderate Low

High Moderate Low

Supplemental Guidance: Related control: AC-6. Yellow

AC-17 (6) AC REMOTE

ACCESS |

PROTECTION

OF

INFORMATION

The organization ensures that users protect information about remote access mechanisms from unauthorized use and disclosure.

High Moderate Low

Supplemental Guidance: Related controls: AT-2, AT-3, PS-6. Yellow

AC-17 (9) AC REMOTE

ACCESS |

DISCONNECT/

DISABLE

ACCESS

The organization provides the capability to expeditiously disconnect or disable remote access to the information system within [Assignment: organization-defined time period].

High Moderate Low

High Moderate Low

Supplemental Guidance: This control enhancement requires organizations to have the capability to rapidly disconnect current users remotely accessing the information system and/or disable further remote access. The speed of disconnect or disablement varies based on the criticality of missions/business functions and the need to eliminate immediate or future remote access to organizational information systems.

White

AC-18 AC WIRELESS

ACCESS

The organization:a. Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; andb. Authorizes wireless access to the information system prior to allowing such connections.

High Moderate Low

High Moderate Low

Supplemental Guidance: Wireless technologies include, for example, microwave, packet radio (UHF/VHF), 802.11x, and Bluetooth. Wireless networks use authentication protocols (e.g., EAP/TLS, PEAP), which provide credential protection and mutual authentication. Related controls: AC-2, AC-3, AC-17, AC-19, CA-3, CA-7, CM-8, IA-2, IA-3, IA-8, PL-4, SI-4.

White

AC-18 (1) AC WIRELESS

ACCESS |

AUTHENTICATI

ON AND

ENCRYPTION

The information system protects wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption.

High Moderate Low

High Moderate Low

Supplemental Guidance: Related controls: SC-8, SC-13. Yellow

AC-18 (3) AC WIRELESS

ACCESS |

DISABLE

WIRELESS

NETWORKING

The organization disables, when not intended for use, wireless networking capabilities internally embedded within information system components prior to issuance and deployment.

High Moderate Low

High Moderate Low

Supplemental Guidance: Related control: AC-19. Yellow

AC-18 (4) AC WIRELESS

ACCESS |

RESTRICT

CONFIGURATI

ONS BY USERS

The organization identifies and explicitly authorizes users allowed to independently configure wireless networking capabilities.

High Moderate Low

High Moderate Low

Supplemental Guidance: Organizational authorizations to allow selected users to configure wireless networking capability are enforced in part, by the access enforcement mechanisms employed within organizational information systems. Related controls: AC-3, SC-15.

Yellow

AC-19 AC ACCESS

CONTROL FOR

MOBILE

DEVICES

The organization:a. Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; andb. Authorizes the connection of mobile devices to organizational information systems.

High Moderate Low

High Moderate Low

Supplemental Guidance: A mobile device is a computing device that: (i) has a small form factor such that it can easily be carried by a single individual; (ii) is designed to operate without a physical connection (e.g., wirelessly transmit or receive information); (iii) possesses local, non-removable or removable data storage; and (iv) includes a self-contained power source. Mobile devices may also include voice communication capabilities, on-board sensors that allow the device to capture information, and/or built-in features for synchronizing local data with remote locations. Examples include smart phones, E-readers, and tablets. Mobile devices are typically associated with a single individual and the device is usually in close proximity to the individual; however, the degree of proximity can vary depending upon on the form factor and size of the device. The processing, storage, and transmission capability of the mobile device may be comparable to or merely a subset of desktop systems, depending upon the nature and intended purpose of the device. Due to the large variety of mobile devices with different technical characteristics and capabilities, organizational restrictions may vary for the different classes/types of such devices. Usage restrictions and specific implementation guidance for mobile devices include, for example, configuration management, device identification and authentication, implementation of mandatory protective software (e.g., malicious code detection, firewall), scanning devices for malicious code, updating virus protection software, scanning for critical software updates and patches, conducting primary operating system (and possibly other resident software) integrity checks, and disabling unnecessary hardware (e.g., wireless, infrared). Organizations are cautioned that the need to provide adequate security for mobile devices goes beyond the requirements in this control. Many safeguards and countermeasures for mobile devices are reflected in other security controls in the catalog

Yellow

AC-19 (5) AC ACCESS

CONTROL FOR

MOBILE

DEVICES |

FULL DEVICE/

CONTAINER-

BASED

ENCRYPTION

The organization employs [Selection: full-device encryption; container encryption] to protect the confidentiality and integrity of information on [Assignment: organization-defined mobile devices].

High Moderate

High Moderate

Supplemental Guidance: Container-based encryption provides a more fine-grained approach to the encryption of data/information on mobile devices, including for example, encrypting selected data structures such as files, records, or fields. Related controls: MP-5, SC-13, SC-28.

Yellow

AC-20 AC USE OF

EXTERNAL

INFORMATION

SYSTEMS

The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to:a. Access the information system from external information systems; andb. Process, store, or transmit organization-controlled information using external information systems.

High Moderate Low

High Moderate Low

Supplemental Guidance: External information systems are information systems or components of information systems that are outside of the authorization boundary established by organizations and for which organizations typically have no direct supervision and authority over the application of required security controls or the assessment of control effectiveness. External information systems include, for example: (i) personally owned information systems/devices (e.g., notebook computers, smart phones, tablets, personal digital assistants); (ii) privately owned computing and communications devices resident in commercial or public facilities (e.g., hotels, train stations, convention centers, shopping malls, or airports); (iii) information systems owned or controlled by nonfederal governmental organizations; and (iv) federal information systems that are not owned by, operated by, or under the direct supervision and authority of organizations. This control also addresses the use of external information systems for the processing, storage, or transmission of organizational information, including, for example, accessing cloud services (e.g., infrastructure as a service, platform as a service, or software as a service) from organizational information systems.For some external information systems (i.e., information systems operated by other federal agencies, including organizations subordinate to those agencies), the trust relationships that have been established between those organizations and the originating organization may be such, that no explicit terms and conditions are required. Information systems within these organizations would not be considered external. These situations occur when, for example, there are pre-existing sharing/trust agreements (either implicit or explicit) established between federal agencies or organizations subordinate to those agencies, or when such trust agreements are specified by applicable laws, Executive Orders, directives, or policies. Authorized

White

AC-20 (1) AC USE OF

EXTERNAL

INFORMATION

SYSTEMS |

LIMITS ON

AUTHORIZED

USE

The organization permits authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only when the organization:(a) Verifies the implementation of required security controls on the external system as specified in the organization’s information security policy and security plan;

or(b) Retains approved information system connection or processing agreements with the organizational entity hosting the external information system.

High Moderate Low

High Moderate Low

Supplemental Guidance: This control enhancement recognizes that there are circumstances where individuals using external information systems (e.g., contractors, coalition partners) need to access organizational information systems. In those situations, organizations need confidence that the external information systems contain the necessary security safeguards (i.e., security controls), so as not to compromise, damage, or otherwise harm organizational information systems. Verification that the required security controls have been implemented can be achieved, for example, by third-party, independent assessments, attestations, or other means, depending on the confidence level required by organizations.

Related control: CA-2.

White

AC-20 (2) AC USE OF

EXTERNAL

INFORMATION

SYSTEMS |

PORTABLE

STORAGE

DEVICES

The organization [Selection: restricts;

prohibits] the use of organization-controlled portable storage devices by authorized individuals on external information systems.

High Moderate Low

Supplemental Guidance: Limits on the use of organization-controlled portable storage devices in external information systems include, for example, complete prohibition of the use of such devices or restrictions on how the devices may be used and under what conditions the devices may be used.

White

AC-20 (3) AC USE OF

EXTERNAL

INFORMATION

SYSTEMS |

NON-

ORGANIZATIO

NALLY OWNED

SYSTEMS /

COMPONENTS

/ DEVICES

The organization [Selection: restricts;

prohibits] the use of non-organizationally owned information systems, system components, or devices to process, store, or transmit organizational information.

High Moderate Low

High Moderate Low

Supplemental Guidance:…