5.8.3.1
Implement Access Control and Authorization
Account Provisioning
Implement Access Control and Authorization -Account Provisioning – The organization should implement a centralized authentication system such as a directory or identity service.
-
5.18 Access Rights: Provision, review, modify, and remove access rights to the information and other related assets according to organization’s access control policy and rules.
8.2 Privileged Access Rights: Privileged access rights allocation and usage should be restricted and controlled.
8.3 Information Access Restriction: Limit access to information and associated assets according to the established topic-specific access control policy.
-
3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
3.1.2 Limit system access to the types
of transactions and functions that
authorized users are permitted to
execute.3.1.3 Control the flow of CUI in accordance with approved authorizations.
3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts.
3.1.6 Use non-privileged accounts or roles when accessing nonsecurity functions.
3.1.7 Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
3.1.12 Monitor and control remote access sessions.
3.4.5 Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
3.4.6 Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
3.8.2 Limit access to CUI on system media to authorized users.
3.9.1 Screen individuals prior to authorizing access to organizational systems containing CUI.
-
3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
3.1.2 Limit system access to the types
of transactions and functions that
authorized users are permitted to
execute.3.1.3 Control the flow of CUI in accordance with approved authorizations.
3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts.
3.1.6 Use non-privileged accounts or roles when accessing nonsecurity functions.
3.1.7 Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
3.1.12 Monitor and control remote access sessions.
3.4.5 Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
3.4.6 Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
3.8.2 Limit access to CUI on system media to authorized users.
3.9.1 Screen individuals prior to authorizing access to organizational systems containing CUI.