CCI-003716

Provides authorized individuals (or processes acting on behalf of individuals) the capability to define the value of associated privacy attributes.

Implementation Guidance

Determine if: - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to define or change the value of associated security attributes. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to define or change the value of associated privacy attributes.

Validation Procedures

Examine: [SELECT FROM: Access control policy; procedures addressing the change of security and privacy attribute values; system design documentation; system configuration settings and associated documentation; list of individuals authorized to change security and privacy attributes; system audit records; system security plan; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with responsibilities for changing values of security and privacy attributes; organizational personnel with information security and privacy responsibilities; system developers]. Test: [SELECT FROM: Mechanisms permitting changes to values of security and privacy attributes].

The controls below (if any) were marked by NIST as being related to CCI-003716.