Navigate

CCI-002228

CCI-002228 Definition

Defines the frequency on which it conducts reviews of the privileges assigned to organization-defined roles or classes of users.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

DoD has defined the frequency as at a minimum, annually.

Validation Procedures

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as at a minimum, annually.

Compelling Evidence

Automatically compliant

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-002228.

Control	Description
AC-6(7)	The organization: (a): Reviews [organization-defined frequency] the privileges assigned to [organization-defined roles or classes of users] to validate the need for such privileges; and (b): Reassigns or removes privileges, if necessary, to correctly reflect organizational mission/business needs.