NIST 800-171 3.1 Access Control
Access Control is the largest family: who and what can reach the system, what they may do once inside, and how remote, wireless and mobile access is held to the same rules. Its requirements cover accounts, privileges, sessions and connections to outside systems.
22 requirementsup to 54 SPRS points11 can go on a CMMC POA&M
The 22 Access Control requirements
- 3.1.1 Authorized AccessAC.L2-3.1.1Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
- 3.1.2 Transaction ControlAC.L2-3.1.2Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- 3.1.3 CUI Flow ControlAC.L2-3.1.3Control the flow of CUI in accordance with approved authorizations.
- 3.1.4 Separation of DutiesAC.L2-3.1.4Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
- 3.1.5 Least PrivilegeAC.L2-3.1.5Employ the principle of least privilege, including for specific security functions and privileged accounts.
- 3.1.6 Non-Privileged AccountsAC.L2-3.1.6Use non-privileged accounts or roles when accessing nonsecurity functions.
- 3.1.7 Privileged FunctionsAC.L2-3.1.7Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
- 3.1.8 Unsuccessful LogonsAC.L2-3.1.8Limit unsuccessful logon attempts.
- 3.1.9 System Use NoticesAC.L2-3.1.9Provide privacy and security notices consistent with applicable CUI rules.
- 3.1.10 Session LockAC.L2-3.1.10Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.
- 3.1.11 Session TerminationAC.L2-3.1.11Terminate (automatically) a user session after a defined condition.
- 3.1.12 Remote Access ControlAC.L2-3.1.12Monitor and control remote access sessions.
- 3.1.13 Remote Access EncryptionAC.L2-3.1.13Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
- 3.1.14 Remote Access RoutingAC.L2-3.1.14Route remote access via managed access control points.
- 3.1.15 Privileged Remote AccessAC.L2-3.1.15Authorize remote execution of privileged commands and remote access to security-relevant information.
- 3.1.16 Wireless AuthorizationAC.L2-3.1.16Authorize wireless access prior to allowing such connections.
- 3.1.17 Wireless ProtectionAC.L2-3.1.17Protect wireless access using authentication and encryption.
- 3.1.18 Mobile Device ConnectionAC.L2-3.1.18Control connection of mobile devices.
- 3.1.19 Encrypt CUI on MobileAC.L2-3.1.19Encrypt CUI on mobile devices and mobile computing platforms.
- 3.1.20 External ConnectionsAC.L2-3.1.20Verify and control/limit connections to and use of external systems.
- 3.1.21 Portable Storage UseAC.L2-3.1.21Limit use of portable storage devices on external systems.
- 3.1.22 Public InformationAC.L2-3.1.22Control CUI posted or processed on publicly accessible systems.
Access Control: points and the CMMC POA&M
- Q-01
How many SPRS points can the Access Control family cost?
Up to 54 of the 313 points a score can lose: 7 worth 5 points, 2 worth 3 and 13 worth 1.
- Q-02
Which Access Control requirements can go on a CMMC POA&M?
11 of the 22: 3.1.3, 3.1.4, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.1.10, 3.1.11, 3.1.14, 3.1.15 and 3.1.21, worth 1 point each. 3.1.20 and 3.1.22 are never allowed, whatever the value (32 CFR 170.21(a)(2)(iii)). The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88.
Know the family. Keep the evidence for every requirement in it.
- Published
- Last updated
- Unchanged since publication