Rev. 3 access control requirements: account management, access and information flow enforcement, least privilege, logon and session controls, remote, wireless and mobile access, external systems and public content.
Managing the life cycle of system accounts: allowed account types, authorized users, roles and privileges, monitoring use, disabling expired, inactive or risky accounts, notifying account managers when people leave or move, and inactivity logout. It has the most ODPs of any access control requirement.
Technically enforcing approved authorizations for logical access to CUI and system resources under the organization's access control policy, in operating systems, applications and services, and how an assessor tests that enforcement.
Controlling where CUI may flow inside the system and between connected systems using approved authorizations, such as segmentation and boundary rules, as distinct from who may access CUI (03.01.02).
Identifying duties that must be split between different people and defining system access authorizations that support the split, so that misuse would need collusion.
Granting users and processes only the access their tasks need, authorizing access to defined security functions and security-relevant information, and reviewing role privileges at a defined frequency, then reassigning or removing them.
Restricting privileged accounts to defined personnel or roles and making administrators use separate non-privileged accounts for non-security work.
Preventing non-privileged users from executing privileged functions and logging every execution of privileged functions, so administrator activity is both restricted and traceable.
Limiting consecutive invalid logon attempts within a defined time window and automatically locking the account or node, delaying the next prompt, alerting an administrator or taking another action when the limit is exceeded.
Displaying a system use notification with privacy and security notices consistent with applicable CUI rules before granting access: logon banners, their content and where they appear.
Locking devices after inactivity or on user command, keeping the lock until the user re-authenticates, and hiding previously visible screen content behind a publicly viewable image.
Automatically terminating a user's logical session after defined conditions or trigger events, and how it differs from network disconnect (03.13.09) and device lock (03.01.10).
Governing each allowed type of remote access: usage, configuration and connection requirements, authorization before connecting, routing through managed access control points and authorizing remote privileged commands. Rev. 3 folded Rev. 2's 3.1.14 and 3.1.15 into it.
Controlling wireless access to the system: usage and connection requirements, authorization before connecting, disabling unneeded wireless capabilities before devices are issued, and authentication and encryption for wireless access.
Setting usage, configuration and connection requirements for mobile devices, authorizing their connection to the system and protecting CUI on them with full-device or container-based encryption.
When people may use external systems to reach the organizational system or handle CUI: prohibiting unauthorized use, setting and verifying security requirements, keeping connection or processing agreements, and restricting portable storage on external systems.
Keeping CUI off public websites and other publicly accessible systems: training the people authorized to post content, reviewing public content for CUI and removing any that is found.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.