Lexim011/Compliance huggingface dataset:
CCI-000002 (policy): Disseminate the organization-level; mission/business process-level; and/or system-level access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): AC-1 a NIST: NIST SP 800-53 Revision 4 (v4): AC-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): AC-1 a 1 (a) NIST: NIST SP 800-53A (v1): AC-1.1 (iii)
CCI-000005 (policy): Disseminate procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level access control policy and associated access controls to the organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): AC-1 b NIST: NIST SP 800-53 Revision 4 (v4): AC-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): AC-1 a 2 NIST: NIST SP 800-53A (v1): AC-1.1 (vi)
CCI-002107 (policy): Defines the personnel or roles to be recipients of the organization-level; mission/business process-level; and/or system-level access control policy necessary to facilitate the implementation of the access control policy and associated access controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): AC-1 a 1 (a)
CCI-002108 (policy): Defines the personnel or roles to be recipients of the procedures necessary to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level access control policy and associated access controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): AC-1 a 2
CCI-003601 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level access control policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-1 a 1 (b)
CCI-003602 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-1 a 1 (a)
CCI-003603 (policy): Disseminate the organization-level; mission/business process-level; and/or system-level access control policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-1 a 1 (b)
CCI-003604 (policy): Develop and document procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level access control policy and the associated access control.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-1 a 2
CCI-003605 (policy): Designate an organization-defined official to manage the development and documentation of the access control policy and procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-1 b
CCI-003606 (policy): Designate an organization-defined official to manage the dissemination of the access control policy and procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-1 b
CCI-003607 (policy): Defines the official designated to manage the development, documentation, and dissemination of the access control policy and procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-1 b
CCI-000003 (policy): Review and update the current access control policy for organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): AC-1 a NIST: NIST SP 800-53 Revision 4 (v4): AC-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): AC-1 c 1 NIST: NIST SP 800-53A (v1): AC-1.2 (ii)
CCI-000006 (policy): Review and update the current access control procedures for organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): AC-1 b NIST: NIST SP 800-53 Revision 4 (v4): AC-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): AC-1 c 2 NIST: NIST SP 800-53A (v1): AC-1.2 (iv)
CCI-001545 (policy): Defines a frequency for reviewing and updating the access control policy.
References: NIST: NIST SP 800-53 (v3): AC-1 a NIST: NIST SP 800-53 Revision 4 (v4): AC-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): AC-1 c 1 NIST: NIST SP 800-53A (v1): AC-1.2 (i)
CCI-001546 (policy): Defines a frequency for reviewing and updating the access control procedures.
References: NIST: NIST SP 800-53 (v3): AC-1 b NIST: NIST SP 800-53 Revision 4 (v4): AC-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): AC-1 c 2 NIST: NIST SP 800-53A (v1): AC-1.2 (iii)
CCI-003608 (policy): Review and update the current access control policy following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-1 c 1
CCI-003609 (policy): Defines the events following reviewing and updating the current access control policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-1 c 1
CCI-003610 (policy): Review and update the current access control procedures following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-1 c 2
CCI-003611 (policy): Defines the events following reviewing and updating the current access control procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-1 c 2
CCI-003612 (policy): Define and document the types of accounts allowed and specifically prohibited for use within the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 a
CCI-002112 (policy): Assign account managers.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 b NIST: NIST SP 800-53 Revision 5 (v5): AC-2 b
CCI-003613 (policy): Require organization-defined prerequisites and criteria for group membership.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 c
CCI-003614 (policy): Require organization-defined prerequisites and criteria for role membership.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 c
CCI-003615 (policy): Defines the prerequisites and criteria for group and role membership.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 c
CCI-002115 (policy): Specify authorized users of the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 d NIST: NIST SP 800-53 Revision 5 (v5): AC-2 d 1
CCI-002116 (policy): Specify authorized users of the group.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 d NIST: NIST SP 800-53 Revision 5 (v5): AC-2 d 2
CCI-002117 (policy): Specify authorized users of the role membership.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 d NIST: NIST SP 800-53 Revision 5 (v5): AC-2 d 2
CCI-002118 (policy): Specify authorized access authorizations (i.e., privileges) for each account.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 d NIST: NIST SP 800-53 Revision 5 (v5): AC-2 d 3
CCI-002119 (policy): Specify organization-attributes (as required) for each account on the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 d NIST: NIST SP 800-53 Revision 5 (v5): AC-2 d 3
CCI-003616 (policy): Defines the attributes (as required) for each account.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 d 3
CCI-000010 (policy): Require approvals by organization-defined personnel or roles for requests to create accounts.
References: NIST: NIST SP 800-53 (v3): AC-2 d NIST: NIST SP 800-53 Revision 4 (v4): AC-2 e NIST: NIST SP 800-53 Revision 5 (v5): AC-2 e NIST: NIST SP 800-53A (v1): AC-2.1 (i)
CCI-002120 (policy): Defines the personnel or roles authorized to approve the creation of accounts.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 e NIST: NIST SP 800-53 Revision 5 (v5): AC-2 e
CCI-000011 (policy): Create, enable, modify, disable, and remove system accounts in accordance with organization-defined procedures.
References: NIST: NIST SP 800-53 (v3): AC-2 e NIST: NIST SP 800-53 Revision 4 (v4): AC-2 f NIST: NIST SP 800-53 Revision 5 (v5): AC-2 f NIST: NIST SP 800-53A (v1): AC-2.1 (i)
CCI-002121 (policy): Defines the procedures to be employed when creating, enabling, modifying, disabling, and removing information system accounts.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 f NIST: NIST SP 800-53 Revision 5 (v5): AC-2 f
CCI-003617 (policy): Create, enable, modify, disable, and remove system accounts in accordance with organization-defined policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 f
CCI-003618 (policy): Create, enable, modify, disable, and remove system accounts in accordance with organization-defined criteria.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 f
CCI-003619 (policy): Create, enable, modify, disable, and remove system accounts in accordance with organization-defined prerequisites.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 f
CCI-003620 (policy): Defines the policy to be employed when creating, enabling, modifying, disabling, and removing information system accounts.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 f
CCI-003621 (policy): Defines the prerequisites to be employed when creating, enabling, modifying, disabling, and removing information system accounts.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 f
CCI-003622 (policy): Defines the criteria to be employed when creating, enabling, modifying, disabling, and removing information system accounts.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 f
CCI-002122 (policy): Monitor the use of accounts.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 g NIST: NIST SP 800-53 Revision 5 (v5): AC-2 g
CCI-002123 (policy): Notify account managers and organization-defined personnel or roles within an organization-defined time-period when accounts are no longer required.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 h 1 NIST: NIST SP 800-53 Revision 5 (v5): AC-2 h 1
CCI-002124 (policy): Notify account managers and organization-defined personnel or roles within an organization-defined time-period when users are terminated or transferred.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 h 2 NIST: NIST SP 800-53 Revision 5 (v5): AC-2 h 2
CCI-002125 (policy): Notify account managers and organization-defined personnel or roles within an organization-defined time-period when system usage or need-to-know changes for an individual.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 h 3 NIST: NIST SP 800-53 Revision 5 (v5): AC-2 h 3
CCI-003623 (policy): Defines the personnel or roles of whom to notify when accounts are no longer required; when users are terminated or transferred; and when system usage or need-to-know changes for an individual.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 h
CCI-003624 (policy): Defines the time period of when to notify account managers for each situation.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 h
CCI-002126 (policy): Authorize access to the system based on a valid access authorization.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 i 1 NIST: NIST SP 800-53 Revision 5 (v5): AC-2 i 1
CCI-002127 (policy): Authorize access to the system based on intended system usage.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 i 2 NIST: NIST SP 800-53 Revision 5 (v5): AC-2 i 2
CCI-002128 (policy): Authorize access to the system based on organization-defined attributes (as required).
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 i 3 NIST: NIST SP 800-53 Revision 5 (v5): AC-2 i 3
CCI-003625 (policy): Defines the attributes (as required) for authorizing access to the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 i 3
CCI-000012 (policy): Review accounts for compliance with account management requirements per organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): AC-2 j NIST: NIST SP 800-53 Revision 4 (v4): AC-2 j NIST: NIST SP 800-53 Revision 5 (v5): AC-2 j NIST: NIST SP 800-53A (v1): AC-2.1 (i)
CCI-001547 (policy): Defines the frequency on which it will review information system accounts for compliance with account management requirements.
References: NIST: NIST SP 800-53 (v3): AC-2 j NIST: NIST SP 800-53 Revision 4 (v4): AC-2 j NIST: NIST SP 800-53 Revision 5 (v5): AC-2 j NIST: NIST SP 800-53A (v1): AC-2.1 (i)
CCI-002129 (policy): Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 k NIST: NIST SP 800-53 Revision 5 (v5): AC-2 k
CCI-003626 (policy): Align account management processes with personnel termination and transfer processes.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 l
CCI-000015 (technical): Support the management of system accounts using (organization-defined automated mechanisms).
References: NIST: NIST SP 800-53 (v3): AC-2 (1) NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (1) NIST: NIST SP 800-53A (v1): AC-2 (1).1
CCI-000016 (technical): Automatically remove or disable temporary and emergency accounts after an organization-defined time-period for each type of account.
References: NIST: NIST SP 800-53 (v3): AC-2 (2) NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (2) NIST: NIST SP 800-53A (v1): AC-2 (2).1 (ii)
CCI-001361 (policy): Defines a time period after which temporary accounts are automatically terminated.
References: NIST: NIST SP 800-53 (v3): AC-2 (2) NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (2) NIST: NIST SP 800-53A (v1): AC-2 (2).1 (i)
CCI-001365 (policy): Defines a time period after which emergency accounts are automatically terminated.
References: NIST: NIST SP 800-53 (v3): AC-2 (2) NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (2) NIST: NIST SP 800-53A (v1): AC-2 (2).1 (i)
CCI-001682 (technical): Automatically removes or disables emergency accounts after an organization-defined time period for each type of account.
References: NIST: NIST SP 800-53 (v3): AC-2 (2) NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (2) NIST: NIST SP 800-53A (v1): AC-2 (2).1 (ii)
CCI-000217 (policy): Defines a time period after which inactive accounts are automatically disabled.
References: NIST: NIST SP 800-53 (v3): AC-2 (3) NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (3) NIST: NIST SP 800-53A (v1): AC-2 (3).1 (i)
CCI-003627 (technical): Disable accounts when the accounts have expired.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (3) (a)
CCI-003628 (technical): Disable accounts when the accounts are no longer associated to a user.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (3) (b)
CCI-003629 (technical): Disable accounts when the accounts are in violation of organizational policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (3) (c)
CCI-000017 (technical): Disable accounts when the accounts have been inactive for the organization-defined time-period.
References: NIST: NIST SP 800-53 (v3): AC-2 (3) NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (3) (d) NIST: NIST SP 800-53A (v1): AC-2 (3).1 (ii)
CCI-000018 (technical): Automatically audit account creation actions.
References: NIST: NIST SP 800-53 (v3): AC-2 (4) NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (4) NIST: NIST SP 800-53A (v1): AC-2 (4).1 (i and ii)
CCI-001403 (technical): Automatically audit account modification actions.
References: NIST: NIST SP 800-53 (v3): AC-2 (4) NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (4) NIST: NIST SP 800-53A (v1): AC-2 (4).1 (i and ii)
CCI-001404 (technical): Automatically audit account disabling actions.
References: NIST: NIST SP 800-53 (v3): AC-2 (4) NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (4) NIST: NIST SP 800-53A (v1): AC-2 (4).1 (i and ii)
CCI-001405 (technical): Automatically audit account removal actions.
References: NIST: NIST SP 800-53 (v3): AC-2 (4) NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (4) NIST: NIST SP 800-53A (v1): AC-2 (4).1 (i and ii)
CCI-002130 (technical): Automatically audit account enabling actions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (4)
CCI-000019 (policy): Require that users log out in accordance with the organization-defined time-period of expected inactivity or description of when to log out.
References: NIST: NIST SP 800-53 (v3): AC-2 (5) (a) NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (5) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (5) NIST: NIST SP 800-53A (v1): AC-2 (5).1 (ii)
CCI-001406 (policy): Defines a time period of expected inactivity when users are required to log out.
References: NIST: NIST SP 800-53 (v3): AC-2 (5) (a) NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (5) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (5) NIST: NIST SP 800-53A (v1): AC-2 (5).1 (i)
CCI-002133 (policy): Defines other conditions when users are required to log out.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (5) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (5)
CCI-002134 (policy): Defines a list of dynamic privilege management capabilities to be implemented.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (6) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (6)
CCI-002135 (technical): Implement the organization-defined list of dynamic privilege management capabilities.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (6) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (6)
CCI-001358 (policy): Establish privileged user accounts in accordance with a role-based access scheme; or an attribute-based access scheme.
References: NIST: NIST SP 800-53 (v3): AC-2 (7) (a) NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (7) (a) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (7) (a) NIST: NIST SP 800-53A (v1): AC-2 (7).1 (i)
CCI-001407 (policy): Administer privileged user accounts in accordance with a role-based access scheme; or an attribute-based access scheme.
References: NIST: NIST SP 800-53 (v3): AC-2 (7) (a) NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (7) (a) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (7) (a) NIST: NIST SP 800-53A (v1): AC-2 (7).1 (i)
CCI-001360 (policy): Monitor privileged role assignments.
References: NIST: NIST SP 800-53 (v3): AC-2 (7) (b) NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (7) (b) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (7) (b) NIST: NIST SP 800-53A (v1): AC-2 (7).1 (ii)
CCI-003630 (policy): Monitor changes to roles or attributes.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (7) (c)
CCI-002137 (policy): Revoke access when privileged role or attribute assignments are no longer appropriate.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (7) (c) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (7) (d)
CCI-002138 (policy): Defines the system accounts that can be dynamically created.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (8) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (8)
CCI-002139 (technical): Create organization-defined system accounts dynamically.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (8) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (8)
CCI-003631 (technical): Defines the system accounts that can be dynamically activated.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (8)
CCI-003632 (technical): Activate organization-defined system accounts dynamically.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (8)
CCI-003633 (technical): Defines the system accounts that can be dynamically managed.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (8)
CCI-003634 (technical): Manage organization-defined system accounts dynamically.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (8)
CCI-003635 (technical): Defines the system accounts that can be dynamically deactivated.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (8)
CCI-003636 (technical): Deactivate organization-defined system accounts dynamically.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (8)
CCI-002140 (policy): Defines the conditions for establishing shared/group accounts.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (9) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (9)
CCI-002141 (policy): Only permit the use of shared and group accounts that meet organization-defined conditions for establishing shared and group accounts.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (9) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (9)
CCI-002143 (policy): Defines the circumstances and/or usage conditions that are to be enforced for organization-defined information system accounts.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (11) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (11)
CCI-002144 (policy): Defines the system accounts that are to be subject to the enforcement of organization-defined circumstances and/or usage conditions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (11) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (11)
CCI-002145 (technical): Enforce organization-defined circumstances and/or usage conditions for organization-defined system accounts.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (11) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (11)
CCI-002146 (policy): Defines atypical usage for which the system accounts are to be monitored.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (12) (a) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (12) (a)
CCI-002147 (policy): Monitor system accounts for organization-defined atypical usage.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (12) (a) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (12) (a)
CCI-002148 (policy): Defines the personnel or roles to whom atypical usage of system accounts are to be reported.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (12) (b) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (12) (b)
CCI-002149 (policy): Report atypical usage of system accounts to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (12) (b) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (12) (b)
CCI-002150 (policy): Defines the time period within which the accounts of users posing a significant risk are to be disabled after discovery of the risk.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (13) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (13)
CCI-002151 (policy): Disable accounts of individuals within an organization-defined time-period of discovery of organization-defined significant risk.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (13) NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (13)
CCI-003637 (policy): Defines the significant risks that may be discovered requiring disabled accounts of individuals.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (13)
CCI-000213 (technical): Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
References: NIST: NIST SP 800-53 (v3): AC-3 NIST: NIST SP 800-53 Revision 4 (v4): AC-3 NIST: NIST SP 800-53 Revision 5 (v5): AC-3 NIST: NIST SP 800-53A (v1): AC-3.1
CCI-000021 (technical): Enforce dual authorization for organization-defined privileged commands and/or other organization-defined actions.
References: NIST: NIST SP 800-53 (v3): AC-3 (2) NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (2) NIST: NIST SP 800-53A (v1): AC-3 (2).1 (ii)
CCI-001408 (policy): Defines privileged commands for which dual authorization is to be enforced.
References: NIST: NIST SP 800-53 (v3): AC-3 (2) NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (2) NIST: NIST SP 800-53A (v1): AC-3
CCI-002152 (policy): Defines other actions necessary for which dual authorization is to be enforced.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (2)
CCI-002153 (policy): Defines the mandatory access control policies that are to be enforced over all subjects and objects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3)
CCI-003014 (technical): Enforce organization-defined mandatory access control policies over all subjects and objects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3)
CCI-002154 (policy): The mandatory access control policy specifies that the policy is uniformly enforced across all subjects and objects within the boundary of the information system.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) (a)
CCI-002155 (policy): Enforce organization-defined mandatory access control policy over all subjects and objects where the policy specifies that a subject that has been granted access to information is constrained from passing the information to unauthorized subjects or objects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) (b) (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) (b) (1)
CCI-002156 (policy): Enforce organization-defined mandatory access control policy over all subjects and objects where the policy specifies that a subject that has been granted access to information is constrained from granting its privileges to other subjects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) (b) (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) (b) (2)
CCI-002157 (policy): Enforce organization-defined mandatory access control policy over all subjects and objects where the policy specifies that a subject that has been granted access to information is constrained from changing one or more security attributes on subjects, objects, the system, or system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) (b) (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) (b) (3)
CCI-002158 (policy): Enforce organization-defined mandatory access control policy over all subjects and objects where the policy specifies that a subject that has been granted access to information is constrained from choosing the security attributes to be associated with newly created or modified objects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) (b) (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) (b) (4)
CCI-002159 (policy): Enforce organization-defined mandatory access control policy over all subjects and objects where the policy specifies that a subject that has been granted access to information is constrained from choosing the attribute values to be associated with newly created or modified objects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) (b) (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) (b) (4)
CCI-002160 (policy): Enforce organization-defined mandatory access control policy over all subjects and objects where the policy specifies that a subject that has been granted access to information is constrained from changing the rules governing access control.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) (b) (5) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) (b) (5)
CCI-002161 (policy): Defines subjects which may explicitly be granted organization-defined privileges such that they are not limited by any of the mandatory access control constraints.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) (c) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) (c)
CCI-002162 (policy): Defines the privileges that may explicitly be granted to organization-defined subjects such that they are not limited by any of the mandatory access control constraints.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) (c) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) (c)
CCI-003015 (policy): Specifies that organization-defined subjects may explicitly be granted organization-defined privileges such that they are not limited by any defined subset (or all) of the above constraints.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) (c) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) (c)
CCI-002163 (policy): Defines the discretionary access control policies the information system is to enforce over subjects and objects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (4)
CCI-002164 (policy): Enforce organization-defined discretionary access control policy that over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following: pass the information to any other subjects or objects; grant its privileges to other subjects; change security attributes on subjects, objects, the information system, or the information system's components; choose the security attributes to be associated with newly created or revised objects; and/or change the rules governing access control.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (4)
CCI-002165 (technical): Enforce organization-defined discretionary access control policies over defined subjects and objects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (4)
CCI-003638 (technical): Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can pass the information to any other subjects or objects.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (4) (a)
CCI-003639 (technical): Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can grant its privileges to other subjects.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (4) (b)
CCI-003640 (technical): Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can change security attributes on subjects, objects, the system, or the system's components.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (4) (c)
CCI-003641 (technical): Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can choose the security attributes to be associated with newly created or revised objects.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (4) (d)
CCI-003642 (technical): Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can change the rules governing access control.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (4) (e)
CCI-000024 (technical): Prevent access to organization-defined security-relevant information except during secure, non-operable system states.
References: NIST: NIST SP 800-53 (v3): AC-3 (5) NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (5) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (5) NIST: NIST SP 800-53A (v1): AC-3 (5).1 (ii)
CCI-001411 (policy): Defines security-relevant information to which the information system prevents access except during secure, non-operable system states.
References: NIST: NIST SP 800-53 (v3): AC-3 (5) NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (5) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (5) NIST: NIST SP 800-53A (v1): AC-3 (5).1 (i)
CCI-002166 (policy): Defines the role-based access control policies to enforce over all subjects and objects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (7)
CCI-002169 (technical): Enforce a role-based access control policy over defined subjects and objects based upon organization-defined roles and users authorized to assume such roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (7)
CCI-002170 (policy): Control access based upon organization-defined roles and users authorized to assume such roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (7)
CCI-002173 (policy): Defines the roles authorized to control access based upon the role-based access control policy.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (7)
CCI-002174 (policy): Defines the users authorized to control access based upon the role-based access control policy.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (7)
CCI-002177 (policy): Defines the rules governing the timing of revocation of access authorizations.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (8) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (8)
CCI-002178 (technical): Enforce the revocation of access authorizations resulting from changes to the security attributes of subjects based on organization-defined rules governing the timing of revocations of access authorizations.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (8) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (8)
CCI-002179 (technical): Enforce the revocation of access authorizations resulting from changes to the security attributes of objects based on organization-defined rules governing the timing of revocations of access authorizations.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (8) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (8)
CCI-002180 (policy): Defines the controls the organization-defined system or system component is to provide to protect information released outside the established system boundary.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (9) (a) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (9) (a)
CCI-002181 (policy): Defines system or system components that are to provide organization-defined controls to protect information received outside the established system boundary.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (9) (a) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (9) (a)
CCI-002182 (policy): Release information outside of the established system boundary only if organization-defined system or system components provides organization-defined controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (9) (a) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (9) (a)
CCI-002183 (policy): Defines the controls to be used to validate the appropriateness of the information designated for release.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (9) (b) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (9) (b)
CCI-002184 (policy): Release information outside of the established system boundary only if organization-defined controls are used to validate the appropriateness of the information designated for release.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (9) (b) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (9) (b)
CCI-002185 (policy): Defines the conditions on which it will employ an audited override of automated access control mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (10) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (10)
CCI-002186 (technical): Employ an audited override of automated access control mechanisms under organization-defined conditions by organization-defined roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (10) NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (10)
CCI-003643 (policy): Defines the organization-defined roles for which it will employ an audited override of automated access control mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (10)
CCI-003644 (technical): Restrict direct access to data repositories containing organization-defined information types.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (11)
CCI-003645 (technical): Defines the information types of which to restrict direct access to data repositories.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (11)
CCI-003646 (technical): Require applications to assert, as part of the installation process, the access needed to the organization-defined system applications and functions.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (12) (a)
CCI-003647 (technical): Defines the organization-defined system applications and functions as required of the applications as part of the installation process.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (12) (a)
CCI-003648 (technical): Require applications to provide an enforcement mechanism to prevent other-than-asserted access.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (12) (b)
CCI-003649 (technical): Approve access changed after initial installations of the application.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (12) (c)
CCI-003650 (technical): Enforce attribute-based access control policy over defined subjects and objects based upon organization-defined attributes to assume access permissions.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (13)
CCI-003651 (technical): Defines the attributes to assume access permissions for enforcing attribute-based access control policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (13)
CCI-003652 (technical): Enforce attribute-based control access over defined subjects and objects based upon organization-defined attributes to assume access permissions.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (13)
CCI-003653 (technical): Defines the attributes to assume access permissions for enforcing attribute-based control access.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (13)
CCI-003654 (technical): Provide organization-defined mechanisms to enable individuals to have access to the following elements of their personally identifiable information: organization-defined elements.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (14)
CCI-003655 (technical): Defines the mechanisms to be provided for access to elements of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (14)
CCI-003656 (technical): Defines the elements of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (14)
CCI-003657 (technical): Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (15) (a)
CCI-003658 (technical): Defines the mandatory access control policies that are to be enforced over all subjects and objects.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (15) (a)
CCI-003659 (technical): Enforce organization-defined discretionary access control policy over the set of covered subjects and objects specified in the policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (15) (b)
CCI-003660 (technical): Defines the discretionary access control policies the system is to enforce over subjects and objects.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (15) (b)
CCI-001368 (technical): Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.
References: NIST: NIST SP 800-53 (v3): AC-4 NIST: NIST SP 800-53 Revision 4 (v4): AC-4 NIST: NIST SP 800-53 Revision 5 (v5): AC-4 NIST: NIST SP 800-53A (v1): AC-4.1 (iii)
CCI-001414 (technical): Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.
References: NIST: NIST SP 800-53 (v3): AC-4 NIST: NIST SP 800-53 Revision 4 (v4): AC-4 NIST: NIST SP 800-53 Revision 5 (v5): AC-4 NIST: NIST SP 800-53A (v1): AC-4.1 (iii)
CCI-001548 (policy): Defines the information flow control policies for controlling the flow of information within the system.
References: NIST: NIST SP 800-53 (v3): AC-4 NIST: NIST SP 800-53 Revision 4 (v4): AC-4 NIST: NIST SP 800-53 Revision 5 (v5): AC-4 NIST: NIST SP 800-53A (v1): AC-4.1 (i)
CCI-001549 (policy): Defines the information flow control policies for controlling the flow of information between interconnected systems.
References: NIST: NIST SP 800-53 (v3): AC-4 NIST: NIST SP 800-53 Revision 4 (v4): AC-4 NIST: NIST SP 800-53 Revision 5 (v5): AC-4 NIST: NIST SP 800-53A (v1): AC-4.1 (i)
CCI-002187 (policy): Defines the security attributes to be used to enforce organization-defined information flow control policies.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (1)
CCI-002188 (policy): Defines the information, source, and destination objects with which the organization-defined security attributes are to be associated.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (1)
CCI-002189 (policy): Defines the information flow control policies to be enforced for flow control decisions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (1)
CCI-002190 (technical): Use organization-defined security attributes associated with organization-defined information, source, and destination objects to enforce organization-defined information flow control policies as a basis for flow control decisions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (1)
CCI-003661 (technical): Defines the privacy attributes to be used to enforce organization-defined information flow control policies.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (1)
CCI-000026 (technical): Use protected processing domains to enforce organization-defined information flow control policies as a basis for flow control decisions.
References: NIST: NIST SP 800-53 (v3): AC-4 (2) NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (2) NIST: NIST SP 800-53A (v1): AC-4 (2).1
CCI-002191 (policy): Defines the information flow control policies to be enforced by the information system using protected processing domains.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (2)
CCI-000027 (technical): Enforce organization-defined information flow control policies.
References: NIST: NIST SP 800-53 (v3): AC-4 (3) NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (3) NIST: NIST SP 800-53A (v1): AC-4 (3).1 (ii)
CCI-002192 (policy): Defines the policies to enforce dynamic information flow control.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (3)
CCI-000028 (policy): Prevent encrypted information from bypassing organization-defined flow control mechanisms by employing organization-defined procedures or methods.
References: NIST: NIST SP 800-53 (v3): AC-4 (4) NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (4) NIST: NIST SP 800-53A (v1): AC-4 (4).1
CCI-002193 (policy): Defines procedures or methods to be employed to prevent encrypted information from bypassing flow control mechanisms, such as decrypting the information, blocking the flow of the encrypted information, and/or terminating communications sessions attempting to pass encrypted information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (4)
CCI-003662 (technical): Defines the information flow control mechanisms to prevent the bypassing of encrypted information.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (4)
CCI-000029 (technical): Enforce organization-defined limitations on embedding data types within other data types.
References: NIST: NIST SP 800-53 (v3): AC-4 (5) NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (5) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (5) NIST: NIST SP 800-53A (v1): AC-4 (5).1 (ii)
CCI-001415 (policy): Defines limitations for the embedding of data types within other data types.
References: NIST: NIST SP 800-53 (v3): AC-4 (5) NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (5) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (5) NIST: NIST SP 800-53A (v1): AC-4 (5).1 (i)
CCI-000030 (technical): Enforce information flow control based on organization-defined metadata.
References: NIST: NIST SP 800-53 (v3): AC-4 (6) NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (6) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (6) NIST: NIST SP 800-53A (v1): AC-4 (6).1
CCI-002194 (policy): Defines the metadata the information system uses to enforce information flow control.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (6) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (6)
CCI-000031 (technical): Enforce one-way information flows using hardware-based flow control mechanisms.
References: NIST: NIST SP 800-53 (v3): AC-4 (7) NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (7) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (7) NIST: NIST SP 800-53A (v1): AC-4 (7).1 (ii)
CCI-000032 (technical): Enforce information flow control using organization-defined security policy filters as a basis for flow control decisions for organization-defined information flows.
References: NIST: NIST SP 800-53 (v3): AC-4 (8) NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (8) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (8) (a) NIST: NIST SP 800-53A (v1): AC-4 (8).1 (ii)
CCI-001417 (policy): Defines security policy filters to be enforced and used as a basis for flow control decisions.
References: NIST: NIST SP 800-53 (v3): AC-4 (8) NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (8) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (8) (a) NIST: NIST SP 800-53A (v1): AC-4 (8).1 (i)
CCI-002195 (policy): Defines the information flows against which the organization-defined security or privacy policy filters are to be enforced.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (8) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (8) (a)
CCI-003663 (technical): Enforce information flow control using organization-defined privacy policy filters as a basis for flow control decisions for organization-defined information flows.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (8) (a)
CCI-003664 (technical): Enforce information flow control using block; strip; modify and/or quarantine data after a filter processing failure in accordance with organization-defined security or privacy policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (8) (b)
CCI-003665 (technical): Defines the security or privacy policy to be enforced using block; strip; modify and/or quarantine data after a filter processing failure.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (8) (b)
CCI-002196 (policy): Defines the information flows for which will enforce the use of human reviews under organization-defined conditions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (9) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (9)
CCI-002197 (policy): Defines the conditions which will require the use of human reviews of organization-defined information flows.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (9) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (9)
CCI-002198 (technical): Enforce the use of human reviews for organization-defined information flows under organization-defined conditions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (9) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (9)
CCI-000034 (technical): Provide the capability for privileged administrators to enable and disable organization-defined security or privacy filters under organization-defined conditions.
References: NIST: NIST SP 800-53 (v3): AC-4 (10) NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (10) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (10) NIST: NIST SP 800-53A (v1): AC-4 (1).1 (ii)
CCI-001553 (policy): Defines security or privacy policy filters that privileged administrators have the capability to enable and disable.
References: NIST: NIST SP 800-53 (v3): AC-4 (10) NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (10) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (10) NIST: NIST SP 800-53A (v1): AC-4 (10).1 (i)
CCI-002199 (policy): Defines the conditions that provides the capability for privileged administrators to enable and disable organization-defined security policy filters.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (10) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (10)