NIST SP 800-53A

________________________________________________________________________________________________

AC-6(2) LEAST PRIVILEGE

AC-6(2).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the organization defines the security functions or security-relevant information to which users of information system accounts, or roles, have access; and

(ii)the organization requires that users of information system accounts, or roles, with access to organization-defined security functions or security-relevant information, use non-privileged accounts, or roles, when accessing other system functions; and

(iii)the organization, if deemed feasible, audits any use of privileged accounts, or roles, with access to organization-defined security functions or security-relevant information, when accessing other system functions.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing least privilege; list of systemgenerated security functions or security-relevant information assigned to information system accounts or roles; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks].

AC-6(3) LEAST PRIVILEGE

AC-6(3).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the organization defines the privileged commands to which network access is to be authorized only for compelling operational needs;

(ii)the organization authorizes network access to organization-defined privileged commands only for compelling operational needs; and

(iii)the organization documents the rationale for authorized network access to organization-defined privileged commands in the security plan for the information system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing least privilege; security plan; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks].

AC-6(4) LEAST PRIVILEGE

AC-6(4).1 ASSESSMENT OBJECTIVE:

Determine if the information system provides separate processing domains to enable finer-grained allocation of user privileges.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing least privilege; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks].

________________________________________________________________________________________________

AC-6(5) LEAST PRIVILEGE

AC-6(5).1 ASSESSMENT OBJECTIVE:

Determine if the organization limits authorization to super user accounts on the information system to designated system administration personnel.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing least privilege; list of systemgenerated super user accounts; list of system administration personnel; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks].

AC-6(6) LEAST PRIVILEGE

AC-6(6).1 ASSESSMENT OBJECTIVE:

Determine if the organization prohibits privileged access to the information system by non-organizational users.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing least privilege; list of systemgenerated privileged accounts; list of non-organizational users; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks].

________________________________________________________________________________________________

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing unsuccessful login attempts; security plan; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for unsuccessful login attempts].

AC-7(1) UNSUCCESSFUL LOGIN ATTEMPTS

AC-7(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system automatically locks the account/node until released by an administrator when the maximum number of unsuccessful login attempts is exceeded.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing unsuccessful login attempts; information system design documentation; information system configuration settings and associated documentation; list of information system accounts; information system audit records; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for unsuccessful login attempts].

________________________________________________________________________________________________

AC-7(2) UNSUCCESSFUL LOGIN ATTEMPTS

AC-7(2).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the organization defines the number of consecutive, unsuccessful login attempts allowed for accessing a mobile device before the information system purges information from the device; and

(ii)the information system provides protection for mobile devices accessed via login by purging information from such devices after the organization-defined number of consecutive, unsuccessful login attempts to the device is exceeded.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing unsuccessful login attempts on mobile devices; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for unsuccessful login attempts].

________________________________________________________________________________________________

(i)the information system (for publicly accessible systems) displays the system use information when appropriate, before granting further access;

(ii)the information system (for publicly accessible systems) displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and

(iii)the information system (for publicly accessible systems) includes in the notice given to public users of the information system, a description of the authorized uses of the information system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; privacy and security policies; procedures addressing system use notification; documented approval of information system use notification messages or banners; information system notification messages; information system configuration settings and associated documentation; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for system use notification].

________________________________________________________________________________________________

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing previous logon notification; information system configuration settings and associated documentation; information system notification messages; information system design documentation; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for previous logon notification].

AC-9(1) PREVIOUS LOGON (ACCESS) NOTIFICATION

AC-9(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system, upon successful user logon/access, displays to the user the number of unsuccessful logon/access attempts since the last successful logon/access.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing previous logon notification; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for previous logon notification].

AC-9(2) PREVIOUS LOGON (ACCESS) NOTIFICATION

AC-9(2).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the organization defines the time period during which the number of successful logins/accesses and/or unsuccessful user login/access attempts occurs; and

(ii)the information system notifies the user of the number of successful logins/accesses and/or unsuccessful login/access attempts that occur during the organizationdefined time period.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing previous logon notification; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for previous logon notification].

________________________________________________________________________________________________

AC-9(3) PREVIOUS LOGON (ACCESS) NOTIFICATION

AC-9(3).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the organization defines the time period for which security-related changes to the user’s account occur; and

(ii)the information system notifies the user of the organization-defined security-related changes to the user’s account that occur during the organization-defined time period.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing previous logon notification; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for previous logon notification].

________________________________________________________________________________________________

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing concurrent session control; information system design documentation; information system configuration settings and associated documentation; security plan; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for concurrent session control].

________________________________________________________________________________________________

Determine if:

(i)the organization defines the time period of user inactivity after which the information system initiates a session lock;

(ii)the information system initiates a session lock after the organization-defined time period of inactivity or upon receiving a request from a user;

(iii)the information system retains the session lock until the user reestablishes access using established identification and authentication procedures.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing session lock; information system design documentation; information system configuration settings and associated documentation; security plan; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for session lock].

AC-11(1) SESSION LOCK

AC-11(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system session lock mechanism, when activated on a device with a display screen, places a publicly viewable pattern onto the associated display, hiding what was previously visible on the screen.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing session lock; display screen with session lock activated; information system design documentation; information system configuration settings and associated documentation; other relevant documents or records].

Test: [SELECT FROM: Information system session lock mechanisms].

________________________________________________________________________________________________