CCI-001409

The organization defines nondiscretionary access control policies to be enforced over the organization-defined set of users and resources, where the rule set for each policy specifies access control information employed by the policy rule set (e.g., position, nationality, age, project, time of day) and required relationships among the access control information to permit access.

Implementation Guidance

Validation Procedures

The controls below (if any) were marked by NIST as being related to CCI-001409.