Doc:NIST SP 800-53Ar1 Appendix F/Enhanced/AC/Moderate

NIST SP 800-53Ar1 Assessment Procedure Catalog, with SP 800-53r3 Security Controls

ACCESS CONTROL

AC-1 ACCESS CONTROL POLICY AND PROCEDURES

---

FAMILY: ACCESS CONTROL

CLASS: TECHNICAL

Security Control Baseline:

AC-1

Access Control Policy and Procedures

P1

LOW AC-1

MOD AC-1

HIGH AC-1

SECURITY CONTROL

ASSESSMENT PROCEDURE
AC-1	ACCESS CONTROL POLICY AND PROCEDURES
AC-1.1	ASSESSMENT OBJECTIVE: Determine if: (i) the organization develops and formally documents access control policy; (ii) the organization access control policy addresses: purpose; scope; roles and responsibilities; management commitment; coordination among organizational entities; and compliance; (iii) the organization disseminates formal documented access control policy to elements within the organization having associated access control roles and responsibilities; (iv) the organization develops and formally documents access control procedures; (v) the organization access control procedures facilitate implementation of the access control policy and associated access controls; and (vi) the organization disseminates formal documented access control procedures to elements within the organization having associated access control roles and responsibilities. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy and procedures; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with access control responsibilities].
AC-1.2	ASSESSMENT OBJECTIVE: Determine if: (i) the organization defines the frequency of access control policy reviews/updates; (ii) the organization reviews/updates access control policy in accordance with organization-defined frequency; (iii) the organization defines the frequency of access control procedure reviews/updates; and (iv) the organization reviews/updates access control procedures in accordance with organization-defined frequency. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy and procedures; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with access control responsibilities].

AC-2 ACCOUNT MANAGEMENT

---

FAMILY: ACCESS CONTROL

CLASS: TECHNICAL

Security Control Baseline:

AC-2

Account Management

P1

LOW AC-2

MOD AC-2 (1) (2) (3) (4)

HIGH AC-2 (1) (2) (3) (4)

SECURITY CONTROL

ASSESSMENT PROCEDURE
AC-2	ACCOUNT MANAGEMENT
AC-2.1	ASSESSMENT OBJECTIVE: Determine if: (i) the organization manages information system accounts, including; identifying account types (i.e., individual, group, system, application, guest/anonymous, and temporary); establishing conditions for group membership; identifying authorized users of the information system and specifying access privileges; requiring appropriate approvals for requests to establish accounts; establishing, activating, modifying, disabling, and removing accounts; specifically authorizing and monitoring the use of guest/anonymous and temporary accounts; notifying account managers when temporary accounts are no longer required and when information system users are terminated, transferred, or information system usage or need-to-know/need-to-share changes; deactivating: i) temporary accounts that are no longer required; and ii) accounts of terminated or transferred users; and granting access to the system based on: a valid access authorization; intended system usage; and other attributes as required by the organization or associated missions/business functions; and (ii) the organization defines the frequency of information system account reviews; and (iii) the organization reviews information system accounts in accordance with organization-defined frequency. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing account management; security plan; list of active system accounts along with the name of the individual associated with each account; list of guest/anonymous and temporary accounts along with the name of the individual associated with each account and the date the account expires; lists of recently transferred, separated, or terminated employees; list of recently disabled information system accounts along with the name of the individual associated with each account; system-generated records with user IDs and last login date; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with account management responsibilities].

SECURITY CONTROL ENHANCEMENT

AC-2(1)

ACCOUNT MANAGEMENT

AC-2(1).1

ASSESSMENT OBJECTIVE: Determine if the organization employs automated mechanisms to support information system account management functions. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Procedures addressing account management; information system design documentation; information system configuration settings and associated documentation; other relevant documents or records]. Test: [SELECT FROM: Automated mechanisms implementing account management functions].

SECURITY CONTROL ENHANCEMENT

AC-2(2)

ACCOUNT MANAGEMENT

AC-2(2).1

ASSESSMENT OBJECTIVE: Determine if: (i) the organization defines a time period for each type of account after which the information system terminates temporary and emergency accounts; and (ii) the information system automatically terminates temporary and emergency accounts after organization-defined time period for each type of account. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Security plan; information system design documentation; information system configuration settings and associated documentation; information system-generated list of active accounts; information system audit records; other relevant documents or records]. Test: [SELECT FROM: Automated mechanisms implementing account management functions].

SECURITY CONTROL ENHANCEMENT

AC-2(3)

ACCOUNT MANAGEMENT

AC-2(3).1

ASSESSMENT OBJECTIVE: Determine if: (i) the organization defines in a time period after which the information system disables inactive accounts; and (ii) the information system automatically disables inactive accounts after organization-defined time period. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Procedures addressing account management; security plan; information system design documentation; information system configuration settings and associated documentation; information system-generated list of last login dates; information system-generated list of active accounts; information system audit records; other relevant documents or records]. Test: [SELECT FROM: Automated mechanisms implementing account management functions].

SECURITY CONTROL ENHANCEMENT

AC-2(4)

ACCOUNT MANAGEMENT

AC-2(4).1

ASSESSMENT OBJECTIVE: Determine if: (i) the information system automatically audits: account creation; modification; disabling; and termination actions; and (ii) the information system notifies, as required, appropriate individuals. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Procedures addressing account management; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records]. Test: [SELECT FROM: Automated mechanisms implementing account management functions].

AC-3 ACCESS ENFORCEMENT

---

FAMILY: ACCESS CONTROL

CLASS: TECHNICAL

Security Control Baseline:

AC-3

Access Enforcement

P1

LOW AC-3

MOD AC-3

HIGH AC-3

SECURITY CONTROL

ASSESSMENT PROCEDURE
AC-3	ACCESS ENFORCEMENT
AC-3.1	ASSESSMENT OBJECTIVE: Determine if the information system enforces approved authorizations for logical access to the system in accordance with applicable policy. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing access enforcement; information system configuration settings and associated documentation; list of approved authorizations (user privileges); information system audit records; other relevant documents or records]. Test: [SELECT FROM: Automated mechanisms implementing access enforcement policy].

AC-4 INFORMATION FLOW ENFORCEMENT

---

FAMILY: ACCESS CONTROL

CLASS: TECHNICAL

Security Control Baseline:

AC-4

Information Flow Enforcement

P1

LOW Not Selected

MOD AC-4

HIGH AC-4

SECURITY CONTROL

ASSESSMENT PROCEDURE
AC-4	INFORMATION FLOW ENFORCEMENT
AC-4.1	ASSESSMENT OBJECTIVE: Determine if: (i) the organization defines applicable policy for controlling the flow of information within the system and between interconnected systems; (ii) the organization defines approved authorizations for controlling the flow of information within the system and between interconnected systems in accordance with applicable policy; and (iii) the information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems in accordance with applicable policy. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing information flow enforcement; information system design documentation; information system configuration settings and associated documentation; information system baseline configuration; list of information flow authorizations; information system audit records; other relevant documents or records]. Test: [SELECT FROM: Automated mechanisms implementing information flow enforcement policy].

AC-5 SEPARATION OF DUTIES

---

FAMILY: ACCESS CONTROL

CLASS: TECHNICAL

Security Control Baseline:

AC-5

Separation of Duties

P1

LOW Not Selected

MOD AC-5

HIGH AC-5

SECURITY CONTROL

ASSESSMENT PROCEDURE
AC-5	SEPARATION OF DUTIES
AC-5.1	ASSESSMENT OBJECTIVE: Determine if: (i) the organization separates duties of individuals as necessary, to prevent malevolent activity without collusion; (ii) the organization documents separation of duties; and (iii) the organization implements separation of duties through assigned information system access authorizations. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing divisions of responsibility and separation of duties; information system configuration settings and associated documentation; list of divisions of responsibility and separation of duties; information system audit records; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with responsibilities for defining appropriate divisions of responsibility and separation of duties]. Test: [SELECT FROM: Automated mechanisms implementing separation of duties policy].

AC-6 LEAST PRIVILEGE

---

FAMILY: ACCESS CONTROL

CLASS: TECHNICAL

Security Control Baseline:

AC-6

Least Privilege

P1

LOW Not Selected

MOD AC-6 (1) (2)

HIGH AC-6 (1) (2)

SECURITY CONTROL

ASSESSMENT PROCEDURE
AC-6	LEAST PRIVILEGE
AC-6.1	ASSESSMENT OBJECTIVE: Determine if the organization employs the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing least privilege; list of assigned access authorizations (user privileges); information system configuration settings and associated documentation; information system audit records; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks].

SECURITY CONTROL ENHANCEMENT

AC-6(1)

LEAST PRIVILEGE

AC-6(1).1

ASSESSMENT OBJECTIVE: Determine if: (i) the organization defines the security functions (deployed in hardware, software, and firmware) and security-relevant information for which access must be explicitly authorized; and (ii) the organization explicitly authorizes access to the organization-defined security functions and security-relevant information. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing least privilege; list of security functions and security-relevant information for which access must be explicitly authorized; information system configuration settings and associated documentation; information system audit records; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks].

SECURITY CONTROL ENHANCEMENT

AC-6(2)

LEAST PRIVILEGE

AC-6(2).1

ASSESSMENT OBJECTIVE: Determine if: (i) the organization defines the security functions or security-relevant information to which users of information system accounts, or roles, have access; and (ii) the organization requires that users of information system accounts, or roles, with access to organization-defined security functions or security-relevant information, use non-privileged accounts, or roles, when accessing other system functions; and (iii) the organization, if deemed feasible, audits any use of privileged accounts, or roles, with access to organization-defined security functions or security-relevant information, when accessing other system functions. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing least privilege; list of system-generated security functions or security-relevant information assigned to information system accounts or roles; information system configuration settings and associated documentation; information system audit records; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks].

AC-7 UNSUCCESSFUL LOGIN ATTEMPTS

---

FAMILY: ACCESS CONTROL

CLASS: TECHNICAL

Security Control Baseline:

AC-7

Unsuccessful Login Attempts

P2

LOW AC-7

MOD AC-7

HIGH AC-7

SECURITY CONTROL

ASSESSMENT PROCEDURE
AC-7	UNSUCCESSFUL LOGIN ATTEMPTS
AC-7.1	ASSESSMENT OBJECTIVE: Determine if: (i) the organization defines the maximum number of consecutive invalid login attempts to the information system by a user and the time period in which the consecutive invalid attempts occur; (ii) the information system enforces the organization-defined limit of consecutive invalid login attempts by a user during the organization-defined time period; (iii) the organization defines action to be taken by the system when the maximum number of unsuccessful login attempts is exceeded as: lock out the account/node for a specified time period; lock out the account/note until released by an administrator; or delay the next login prompt according to organization-defined delay algorithm; (iv) the information system either automatically locks the account/node for the organization-defined time period, locks the account/node until released by an administrator, or delays next login prompt for the organization-defined delay period when the maximum number of unsuccessful login attempts is exceeded; and (v) the information system performs the organization-defined actions when the maximum number of unsuccessful login attempts is exceeded regardless of whether the login occurs via a local or network connection. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing unsuccessful login attempts; security plan; information system configuration settings and associated documentation; information system audit records; other relevant documents or records]. Test: [SELECT FROM: Automated mechanisms implementing the access control policy for unsuccessful login attempts].

AC-8 SYSTEM USE NOTIFICATION

---

FAMILY: ACCESS CONTROL

CLASS: TECHNICAL

Security Control Baseline:

AC-8

System Use Notification

P1

LOW AC-8

MOD AC-8

HIGH AC-8

SECURITY CONTROL

ASSESSMENT PROCEDURE
AC-8	SYSTEM USE NOTIFICATION
AC-8.1	ASSESSMENT OBJECTIVE: Determine if: (i) the organization approves the information system use notification message or banner to be displayed by the information system before granting access to the system; (ii) the information system displays the approved system use notification message or banner before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that: users are accessing a U.S. Government information system; system usage may be monitored, recorded, and subject to audit; unauthorized use of the system is prohibited and subject to criminal and civil penalties; and use of the system indicates consent to monitoring and recording; and (iii) the information system retains the notification message or banner on the screen until the user takes explicit actions to log on to or further access the information system. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; privacy and security policies; procedures addressing system use notification; documented approval of information system use notification messages or banners; information system notification messages; information system configuration settings and associated documentation; information system audit records for user acceptance of notification message or banner; other relevant documents or records]. Test: [SELECT FROM: Automated mechanisms implementing the access control policy for system use notification].
AC-8.2	ASSESSMENT OBJECTIVE: Determine if: (i) the information system (for publicly accessible systems) displays the system use information when appropriate, before granting further access; (ii) the information system (for publicly accessible systems) displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and (iii) the information system (for publicly accessible systems) includes in the notice given to public users of the information system, a description of the authorized uses of the information system. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; privacy and security policies; procedures addressing system use notification; documented approval of information system use notification messages or banners; information system notification messages; information system configuration settings and associated documentation; other relevant documents or records]. Test: [SELECT FROM: Automated mechanisms implementing the access control policy for system use notification].

AC-11 SESSION LOCK

---

FAMILY: ACCESS CONTROL

CLASS: TECHNICAL

Security Control Baseline:

AC-11

Session Lock

P3

LOW Not Selected

MOD AC-11

HIGH AC-11

SECURITY CONTROL

ASSESSMENT PROCEDURE
AC-11	SESSION LOCK
AC-11.1	ASSESSMENT OBJECTIVE: Determine if: (i) the organization defines the time period of user inactivity after which the information system initiates a session lock; (ii) the information system initiates a session lock after the organization-defined time period of inactivity or upon receiving a request from a user; (iii) the information system retains the session lock until the user reestablishes access using established identification and authentication procedures. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing session lock; information system design documentation; information system configuration settings and associated documentation; security plan; other relevant documents or records]. Test: [SELECT FROM: Automated mechanisms implementing the access control policy for session lock].

AC-14 PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION

---

FAMILY: ACCESS CONTROL

CLASS: TECHNICAL

Security Control Baseline:

AC-14

Permitted Actions without Identification or Authentication

P1

LOW AC-14

MOD AC-14 (1)

HIGH AC-14 (1)

SECURITY CONTROL

ASSESSMENT PROCEDURE
AC-14	PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION
AC-14.1	ASSESSMENT OBJECTIVE: Determine if: (i) the organization identifies specific user actions that can be performed on the information system without identification or authentication; and (ii) the organization documents and provides supporting rationale in the security plan for the information system, user actions not requiring identification and authentication. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing permitted actions without identification and authentication; information system configuration settings and associated documentation; security plan; list of information system actions that can be performed without identification and authentication; information system audit records; other relevant documents or records].

SECURITY CONTROL ENHANCEMENT

AC-14(1)

PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION

AC-14(1).1

ASSESSMENT OBJECTIVE: Determine if the organization permits actions to be performed without identification and authentication only to the extent necessary to accomplish mission/business objectives. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing permitted actions without identification and authentication; information system configuration settings and associated documentation; security plan; list of information system actions that can be performed without identification and authentication; information system audit records; other relevant documents or records].

AC-17 REMOTE ACCESS

---

FAMILY: ACCESS CONTROL

CLASS: TECHNICAL

Security Control Baseline:

AC-17

Remote Access

P1

LOW AC-17

MOD AC-17 (1) (2) (3) (4) (5) (7) (8)

HIGH AC-17 (1) (2) (3) (4) (5) (7) (8)

SECURITY CONTROL

ASSESSMENT PROCEDURE
AC-17	REMOTE ACCESS
AC-17.1	ASSESSMENT OBJECTIVE: Determine if: (i) the organization documents allowed methods of remote access to the information system; (ii) the organization establishes usage restrictions and implementation guidance for each allowed remote access method; (iii) the organization monitors for unauthorized remote access to the information system; (iv) the organization authorizes remote access to the information system prior to connection; and (v) the organization enforces requirements for remote connections to the information system. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing remote access to the information system; information system configuration settings and associated documentation; information system audit records; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with remote access authorization, monitoring, and control responsibilities]. Test: [SELECT FROM: Remote access methods for the information system].

SECURITY CONTROL ENHANCEMENT

AC-17(1)

REMOTE ACCESS

AC-17(1).1

ASSESSMENT OBJECTIVE: Determine if the organization employs automated mechanisms to facilitate the monitoring and control of remote access methods. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing remote access to the information system; information system configuration settings and associated documentation; other relevant documents or records]. Test: [SELECT FROM: Automated mechanisms implementing the access control policy for remote access].

SECURITY CONTROL ENHANCEMENT

AC-17(2)

REMOTE ACCESS

AC-17(2).1

ASSESSMENT OBJECTIVE: Determine if the organization uses cryptography to protect the confidentiality and integrity of remote access sessions. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing remote access to the information system; information system design documentation; information system configuration settings and associated documentation; other relevant documents or records]. Test: [SELECT FROM: Automated mechanisms implementing cryptographic protections for remote access].

SECURITY CONTROL ENHANCEMENT

AC-17(3)

REMOTE ACCESS

AC-17(3).1

ASSESSMENT OBJECTIVE: Determine if: (i) the organization defines a limited number of managed access control points for remote access to the information system; and (ii) the information system routes all remote accesses through managed access control points. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing remote access to the information system; information system design documentation; list of managed access control points; information system configuration settings and associated documentation; information system audit records; other relevant documents or records]. Test: [SELECT FROM: Automated mechanisms implementing the access control policy for remote access].

SECURITY CONTROL ENHANCEMENT

AC-17(4)

REMOTE ACCESS

AC-17(4).1

ASSESSMENT OBJECTIVE: Determine if: (i) the organization authorizes the execution of privileged commands and access to security-relevant information via remote access only for compelling operational needs; and (ii) the organization documents the rationale for such access in the security plan for the information system. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing remote access to the information system; information system configuration settings and associated documentation; security plan; information system audit records; other relevant documents or records].

SECURITY CONTROL ENHANCEMENT

AC-17(5)

REMOTE ACCESS

AC-17(5).1

ASSESSMENT OBJECTIVE: Determine if: (i) the organization defines the frequency of monitoring for unauthorized remote connections to the information system; (ii) the organization monitors for unauthorized remote connections to the information system in accordance with the organization-defined frequency; (iii) the organization defines the appropriate action(s) to be taken if an unauthorized connection is discovered; and (iv) the organization takes organization-defined appropriate action(s) if an unauthorized connection is discovered. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing remote access to the information system; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with responsibilities for monitoring remote connections to the information system].

SECURITY CONTROL ENHANCEMENT

AC-17(7)

REMOTE ACCESS

AC-17(7).1

ASSESSMENT OBJECTIVE: Determine if: (i) the organization defines the security functions and security-relevant information that can be accessed using remote sessions; (ii) the organization defines the additional security measures to be employed for remote sessions used to access organization-defined security functions and security-relevant information; (iii) the organization employs organization-defined additional security measures for remote sessions used to access organization-defined security functions and security-relevant information; and (iv) the organization audits remote sessions for accessing organization-defined security functions and security-relevant information. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing remote access to the information system; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records]. Test: [SELECT FROM: Automated mechanisms implementing the access control policy for remote access].

SECURITY CONTROL ENHANCEMENT

AC-17(8)

REMOTE ACCESS

AC-17(8).1

ASSESSMENT OBJECTIVE: Determine if: (i) the organization defines the networking protocols within the information system deemed to be nonsecure; and (ii) the organization disables the organization-defined networking protocols within the information system deemed to be nonsecure except for explicitly identified components in support of specific operational requirements. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing remote access to the information system; information system design documentation; information system configuration settings and associated documentation; security plan; list of networking protocols deemed to be non-secure; other relevant documents or records]. Test: [SELECT FROM: Automated mechanisms disabling networking protocols deemed to be non-secure].

AC-18 WIRELESS ACCESS

---

FAMILY: ACCESS CONTROL

CLASS: TECHNICAL

Security Control Baseline:

AC-18

Wireless Access

P1

LOW AC-18

MOD AC-18 (1)

HIGH AC-18 (1) (2) (4) (5)

SECURITY CONTROL

ASSESSMENT PROCEDURE
AC-18	WIRELESS ACCESS
AC-18.1	ASSESSMENT OBJECTIVE: Determine if: (i) the organization establishes usage restrictions and implementation guidance for wireless access; (ii) the organization monitors for unauthorized wireless access to the information system; (iii) the organization authorizes wireless access to the information system prior to connection; and (iv) the organization enforces requirements for wireless connections to the information system. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing wireless implementation and usage (including restrictions); activities related to wireless monitoring, authorization, and enforcement; information system audit records; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel responsible for authorizing, monitoring or controlling the use of wireless technologies in the information system]. Test: [SELECT FROM: Wireless access usage and restrictions].

SECURITY CONTROL ENHANCEMENT

AC-18(1)

WIRELESS ACCESS

AC-18(1).1

ASSESSMENT OBJECTIVE: Determine if the information system protects wireless access to the system using authentication and encryption. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing wireless implementation and usage (including restrictions); information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records]. Test: [SELECT FROM: Automated mechanisms implementing the access control policy for wireless access to the information system].

AC-19 ACCESS CONTROL FOR MOBILE DEVICES

---

FAMILY: ACCESS CONTROL

CLASS: TECHNICAL

Security Control Baseline:

AC-19

Access Control for Mobile Devices

P1

LOW AC-19

MOD AC-19 (1) (2) (3)

HIGH AC-19 (1) (2) (3)

SECURITY CONTROL

ASSESSMENT PROCEDURE
AC-19	ACCESS CONTROL FOR MOBILE DEVICES
AC-19.1	ASSESSMENT OBJECTIVE: Determine if: (i) the organization establishes usage restrictions and implementation guidance for organization-controlled portable and mobile devices; (ii) the organization authorizes connection of mobile devices meeting organizational usage restrictions and implementation guidance to organizational information systems; (iii) the organization monitors for unauthorized connections of mobile devices to organizational information systems; (iv) the organization enforces requirements for the connection of mobile devices to organizational information systems; (v) the organization disables information system functionality that provides the capability for automatic execution of code on mobile devices without user direction; (vi) the organization issues specially configured mobile devices to individuals traveling to locations that the organization deems to be of significant risk in accordance with organizational policies and procedures; (vii) the organization defines the inspection and preventative measures to be applied to mobile devices returning from locations that the organization deems to be of significant risk; and (viii) the organization applies organization-defined inspection and preventative measures to mobile devices returning from locations that the organization deems to be of significant risk in accordance with organizational policies and procedures. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing access control for portable and mobile devices; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel who use portable and mobile devices to access the information system]. Test: [SELECT FROM: Automated mechanisms implementing access control policy for portable and mobile devices].

SECURITY CONTROL ENHANCEMENT

AC-19(1)

ACCESS CONTROL FOR MOBILE DEVICES

AC-19(1).1

ASSESSMENT OBJECTIVE: Determine if the organization restricts the use of writable, removable media in organizational information systems. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing access control for portable and mobile devices; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel who use portable and mobile devices to access the information system]. Test: [SELECT FROM: Automated mechanisms implementing access control policy for portable and mobile devices].

SECURITY CONTROL ENHANCEMENT

AC-19(2)

ACCESS CONTROL FOR MOBILE DEVICES

AC-19(2).1

ASSESSMENT OBJECTIVE: Determine if the organization prohibits the use of personally owned, removable media in organizational information systems. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing access control for portable and mobile devices; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records]. Test: [SELECT FROM: Automated mechanisms implementing access control policy for portable and mobile devices].

SECURITY CONTROL ENHANCEMENT

AC-19(3)

ACCESS CONTROL FOR MOBILE DEVICES

AC-19(3).1

ASSESSMENT OBJECTIVE: Determine if the organization prohibits the use of removable media in organizational information systems when the media has no identifiable owner. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing access control for portable and mobile devices; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records]. Test: [SELECT FROM: Automated mechanisms implementing access control policy for portable and mobile devices].

AC-20 USE OF EXTERNAL INFORMATION SYSTEMS

---

FAMILY: ACCESS CONTROL

CLASS: TECHNICAL

Security Control Baseline:

AC-20

Use of External Information Systems

P1

LOW AC-20

MOD AC-20 (1) (2)

HIGH AC-20 (1) (2)

SECURITY CONTROL

ASSESSMENT PROCEDURE
AC-20	USE OF EXTERNAL INFORMATION SYSTEMS
AC-20.1	ASSESSMENT OBJECTIVE: Determine if: (i) the organization identifies individuals authorized to: access the information system from the external information systems; and process, store, and/or transmit organization-controlled information using the external information systems; and (ii) the organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to: access the information system from the external information systems; and process, store, and/or transmit organization-controlled information using the external information system. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing the use of external information systems; external information systems terms and conditions; list of types of applications accessible from external information systems; maximum security categorization for information processed, stored, or transmitted on external information systems; information system configuration settings and associated documentation; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with responsibilities for defining terms and conditions for use of external information systems to access organizational systems].

SECURITY CONTROL ENHANCEMENT

AC-20(1)

USE OF EXTERNAL INFORMATION SYSTEMS

AC-20(1).1

ASSESSMENT OBJECTIVE: Determine if the organization permits authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only when the organization: can verify the implementation of required security controls on the external system as specified in the organization's information security policy and security plan; or has approved information system connection or processing agreements with the organizational entity hosting the external information system. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing the use of external information systems; security plan; information system connection or processing agreements; account management documents; other relevant documents or records].

SECURITY CONTROL ENHANCEMENT

AC-20(2)

USE OF EXTERNAL INFORMATION SYSTEMS

AC-20(2).1

ASSESSMENT OBJECTIVE: Determine if the organization limits the use of organization-controlled portable storage media by authorized individuals on external information systems. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing the use of external information systems; security plan; information system configuration settings and associated documentation; information system connection or processing agreements; account management documents; other relevant documents or records].

AC-22 PUBLICLY ACCESSIBLE CONTENT

---

FAMILY: ACCESS CONTROL

CLASS: TECHNICAL

Security Control Baseline:

AC-22

Publicly Accessible Content

P2

LOW AC-22

MOD AC-22

HIGH AC-22

SECURITY CONTROL

ASSESSMENT PROCEDURE
AC-22	PUBLICLY ACCESSIBLE CONTENT
AC-22.1	ASSESSMENT OBJECTIVE: Determine if: (i) the organization designates individuals authorized to post information onto an organizational information system that is publicly accessible; (ii) the organization trains authorized individuals to ensure that publicly accessible information does not contain nonpublic information; (iii) the organization reviews the proposed content of publicly accessible information for nonpublic information prior to posting onto the organizational information system; (iv) the organization defines the frequency of reviews of the content on the publicly accessible organizational information system for nonpublic information; (v) the organization reviews the content on the publicly accessible organizational information system for nonpublic information in accordance with the organization-defined frequency; and (vi) the organization removes nonpublic information from the publicly accessible organizational information system, if discovered. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Access control policy; procedures addressing publicly accessible content; list of users authorized to post publicly accessible content on organizational information systems; training materials and/or records; records of publicly accessible information reviews; records of response to nonpublic information on public Web sites; system audit logs; security awareness training records; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel responsible for managing publicly accessible information posted on organizational information systems].

Source

• NIST SP 800-53A Rev. 1 Guide for Assessing the Security Controls in Federal Information Systems and Organizations, Building Effective Security Assessment Plans (PDF)