Detections
Analytics
800-53|AC-6(1)
Title
AUTHORIZE ACCESS TO SECURITY FUNCTIONSDescription
The organization explicitly authorizes access to [Assignment: organization-defined security functions (deployed in hardware, software, and firmware) and security-relevant information].Supplemental
Security functions include, for example, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Security-relevant information includes, for example, filtering rules for routers/firewalls, cryptographic key management information, configuration parameters for security services, and access control lists. Explicitly authorized personnel include, for example, security administrators, system and network administrators, system security officers, system maintenance personnel, system programmers, and other privileged users.Reference Item Details
Reference: NIST 800-53 - Security and Privacy Controls for Federal Information Systems and Organizations
Related: AC-17,AC-18,AC-19
Category: ACCESS CONTROL
Parent Title: LEAST PRIVILEGE
Family: ACCESS CONTROL
Baseline Impact: MODERATE,HIGH
Audit Items
View all Reference Audit Items