Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

ac-3(3)

access enforcement  | mandatory access control

assessment objective:

Determine if:

ac-3(3)[1]

the organization defines mandatory access control policies to be enforced over all subjects and objects;

ac-3(3)[2]

the organization defines subjects over which organization-defined mandatory access control policies are to be enforced;

ac-3(3)[3]

the organization defines objects over which organization-defined mandatory access control policies are to be enforced;

ac-3(3)[4]

the organization defines subjects that may explicitly be granted privileges such that they are not limited by the constraints specified elsewhere within this control;

ac-3(3)[5]

the organization defines privileges that may be granted to organization-defined subjects;

ac-3(3)[6]

the information system enforces organization-defined mandatory access control policies over all subjects and objects where the policy specifies that:

ac-3(3)[6](a)

the policy is uniformly enforced across all subjects and objects within the boundary of the information system;

ac-3(3)[6](b)

a subject that has been granted access to information is constrained from doing any of the following:

ac-3(3)[6](b)(1)

passing the information to unauthorized subjects or objects;

ac-3(3)[6](b)(2)

granting its privileges to other subjects;

ac-3(3)[6](b)(3)

changing one or more security attributes on:

ac-3(3)[6](b)(3)[a]

subjects;

ac-3(3)[6](b)(3)[b]

objects;

ac-3(3)[6](b)(3)[c]

the information system; or

ac-3(3)[6](b)(3)[d]

system components;

ac-3(3)[6](b)(4)

choosing the security attributes and attribute values to be associated with newly created or modified objects; or

ac-3(3)[6](b)(5)

changing the rules governing access control; and

ac-3(3)[6](c)

organization-defined subjects may explicitly be granted organization-defined privileges such that they are not limited by some or all of the above constraints.

potential assessment methods and objects:

Examine: [select from: Access control policy; mandatory access control policies; procedures addressing access enforcement; security plan; information system design documentation; information system configuration settings and associated documentation; list of subjects and objects (i.e., users and resources) requiring enforcement of mandatory access control policies; information system audit records; other relevant documents or records].

Interview: [select from: Organizational personnel with access enforcement responsibilities; system/network administrators; organizational personnel with information security responsibilities; system developers].

Test: [select from: Automated mechanisms implementing mandatory access control].