Navigate

AC-16 (1)

AC-16 (1): Dynamic Attribute Association

The information system dynamically associates security attributes with [Assignment: organization-defined subjects and objects] in accordance with [Assignment: organization-defined security policies] as information is created and combined.

Supplemental

Dynamic association of security attributes is appropriate whenever the security characteristics of information changes over time. Security attributes may change, for example, due to information aggregation issues (i.e., the security characteristics of individual information elements are different from the combined elements), changes in individual access authorizations (i.e., privileges), and changes in the security category of information.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
Cross Domain (Access), Cross Domain (Multilevel), Cross Domain (Transfer)

Related Controls

The controls below (if any) were marked by NIST as being related to AC-16 (1).

Control	Description
AC-4	The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on [Assignment: organization-defined information flow control policies].

Enhancements

The controls below (if any) add on to the requirements of AC-16 (1).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AC-16 (1).

CCI	Definition
CCI-001424	The information system dynamically associates security attributes with organization-defined subjects in accordance with organization-defined security policies as information is created and combined.
CCI-002272	The information system dynamically associates security attributes with organization-defined objects in accordance with organization-defined security policies as information is created and combined.
CCI-002273	The organization defines the security policies the information system is to adhere to when dynamically associating security attributes with organization-defined subjects and objects.
CCI-002274	The organization defines the subjects with which the information system is to dynamically associate security attributes as information is created and combined.
CCI-002275	The organization defines the objects with which the information system is to dynamically associate security attributes as information is created and combined.