Navigate

CCI-003649

CCI-003649 Definition

Approve access changed after initial installations of the application.

Status
Type	CheckType.technical

Master Assessment Datasheet

Implementation Guidance

Determine if access changes after initial installation of the application are approved.

Validation Procedures

Examine: [SELECT FROM: Access control policy; procedures addressing access enforcement; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with access enforcement responsibilities; system/network administrators; organizational personnel with information security responsibilities]. Test: [SELECT FROM: Mechanisms implementing access enforcement functions].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-003649.

Control	Description
AC-3(12)	(a): Require applications to assert, as part of the installation process, the access needed to the following system applications and functions: [system applications and functions requiring access assertion are defined;]; (b): Provide an enforcement mechanism to prevent unauthorized access; and (c): Approve access changes after initial installation of the application.