Navigate

CCI-003647

CCI-003647 Definition

Defines the organization-defined system applications and functions as required of the applications as part of the installation process.

Status
Type	CheckType.technical

Master Assessment Datasheet

Implementation Guidance

Determine if as part of the installation process, applications are required to assert the access needed to the following system applications and functions: [AC-03(12)_ODP; system applications and functions requiring access assertion are defined].

Validation Procedures

Examine: [SELECT FROM: Access control policy; procedures addressing access enforcement; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with access enforcement responsibilities; system/network administrators; organizational personnel with information security responsibilities]. Test: [SELECT FROM: Mechanisms implementing access enforcement functions].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-003647.

Control	Description
AC-3(12)	(a): Require applications to assert, as part of the installation process, the access needed to the following system applications and functions: [system applications and functions requiring access assertion are defined;]; (b): Provide an enforcement mechanism to prevent unauthorized access; and (c): Approve access changes after initial installation of the application.