CCI-002356

Implementation Guidance

The organization being inspected/assessed defines and documents the access control policies to be implemented by the information system's reference monitor. DoD has determined the access control policies are not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented access control policies to ensure the organization being inspected/assessed defines the access control policies to be implemented by the information system's reference monitor. DoD has determined the access control policies are not appropriate to define at the Enterprise level.

Compelling Evidence

1.) Signed and dated access control policy that defines the access control policies to be implemented by the information system's reference monitor.