NIST 800-171 3.1.2 (AC.L2-3.1.2): Transaction Control

What 3.1.2 means in practice

Being allowed in is not the same as being allowed to do everything. Define what each role may do in each system, such as read, approve, change configuration or export data, and enforce those limits in the systems themselves, usually through roles and groups rather than grants to individual users.

SPRS points and the CMMC POA&M

What an assessor checks for 3.1.2

NIST SP 800-171A gives 2 determination statements for 3.1.2, each found satisfied or other than satisfied. Determine if:

1. 3.1.2[a] the types of transactions and functions that authorized users are permitted to execute are defined.
2. 3.1.2[b] system access is limited to the defined types of transactions and functions for authorized users.

NIST SP 800-171A (June 2018), assessment objectives for 3.1.2

Evidence that shows 3.1.2 is met

• A role and permission matrix mapping job functions to what each role may do in each system.
• Role and group assignments exported from the identity provider and the key applications.
• Role definitions showing permissions are enforced through roles, such as Azure RBAC role definitions.
• A sample of users whose actual permissions match their documented role.

How PolicyCortex gathers the evidence

PolicyCortex reads this evidence with the collectors below, read only, and grades 3.1.2 from it. Each line says what the product checks.

• Azure: Role assignments. Checks that Azure role assignments restrict users to the transactions and functions their roles permit.