Navigate

CCI-000041

CCI-000041 Definition

Authorize network access to organization-defined privileged commands only for organization-defined compelling operational needs.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if: - network access to [AC-06(03)_ODP[01]; privileged commands to which network access is to be authorized only for compelling operational needs are defined] is authorized only for [AC-06(03)_ODP[02]; compelling operational needs necessitating network access to privileged commands are defined]. - the rationale for authorizing network access to privileged commands is documented in the security plan for the system.

Validation Procedures

Examine: [SELECT FROM: Access control policy; procedures addressing least privilege; system configuration settings and associated documentation; system audit records; list of operational needs for authorizing network access to privileged commands; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks; organizational personnel with information security responsibilities]. Test: [SELECT FROM: Mechanisms implementing least privilege functions].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000041.

Control	Description
AC-6(3)	Authorize network access to [privileged commands to which network access is to be authorized only for compelling operational needs are defined;] only for [compelling operational needs necessitating network access to privileged commands are defined;] and document the rationale for such access in the security plan for the system.