AC-17 (6)

AC-17 (6): Protection Of Information

The organization ensures that users protect information about remote access mechanisms from unauthorized use and disclosure.

None

Overlays
None

The controls below (if any) were marked by NIST as being related to AC-17 (6).

Control	Description
AT-2	The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors): AT-2a.: As part of initial training for new users; AT-2b.: When required by information system changes; and AT-2c.: [Assignment: organization-defined frequency] thereafter.
AT-3	The organization provides role-based security training to personnel with assigned security roles and responsibilities: AT-3a.: Before authorizing access to the information system or performing assigned duties; AT-3b.: When required by information system changes; and AT-3c.: [Assignment: organization-defined frequency] thereafter.
PS-6	The organization: PS-6a.: Develops and documents access agreements for organizational information systems; PS-6b.: Reviews and updates the access agreements [Assignment: organization-defined frequency]; and PS-6c.: Ensures that individuals requiring access to organizational information and information systems: PS-6c.1.: Sign appropriate access agreements prior to being granted access; and PS-6c.2.: Re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or [Assignment: organization-defined frequency].

The controls below (if any) add on to the requirements of AC-17 (6).

Control	Description
No controls

The CCIs below are tied to AC-17 (6).

CCI	Definition
CCI-000072	The organization ensures that users protect information about remote access mechanisms from unauthorized use and disclosure.