Navigate

CCI-002271

CCI-002271 Definition

Determine organization-defined attribute values or ranges for each of the established attributes.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed establishes and documents the permitted values or ranges for each of the established security attributes as a subset of the values or ranges defined in AC-16, CCI 2270.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented permitted values or ranges to ensure the organization being inspected/assessed has established the permitted values or ranges for each of the established security attributes as a subset of the values or ranges defined in AC-16, CCI 2270.

Compelling Evidence

1.) Signed and dated documentation that defines the permitted values or ranges for each of the established security attributes as a subset of the values or ranges defined in AC-16, CCI 2270.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-002271.

Control	Description
AC-16	The organization: a: Provides the means to associate [organization-defined types of security attributes] having [organization-defined security attribute values] with information in storage, in process, and/or in transmission; b: Ensures that the security attribute associations are made and retained with the information; c: Establishes the permitted [organization-defined security attributes] for [organization-defined information systems]; and d: Determines the permitted [organization-defined values or ranges] for each of the established security attributes.

Control

Description

AC-16

The organization:

a: Provides the means to associate [organization-defined types of security attributes] having [organization-defined security attribute values] with information in storage, in process, and/or in transmission;

b: Ensures that the security attribute associations are made and retained with the information;

c: Establishes the permitted [organization-defined security attributes] for [organization-defined information systems]; and

d: Determines the permitted [organization-defined values or ranges] for each of the established security attributes.