Navigate

AC-19

AC-19: Access Control for Mobile Devices

The organization:

a: Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and

b: Authorizes the connection of mobile devices to organizational information systems.

Supplemental

A mobile device is a computing device that: (i) has a small form factor such that it can easily be carried by a single individual; (ii) is designed to operate without a physical connection (e.g., wirelessly transmit or receive information); (iii) possesses local, non-removable or removable data storage; and (iv) includes a self-contained power source. Mobile devices may also include voice communication capabilities, on-board sensors that allow the device to capture information, and/or built-in features for synchronizing local data with remote locations. Examples include smart phones, E-readers, and tablets. Mobile devices are typically associated with a single individual and the device is usually in close proximity to the individual; however, the degree of proximity can vary depending upon on the form factor and size of the device. The processing, storage, and transmission capability of the mobile device may be comparable to or merely a subset of desktop systems, depending upon the nature and intended purpose of the device. Due to the large variety of mobile devices with different technical characteristics and capabilities, organizational restrictions may vary for the different classes/types of such devices. Usage restrictions and specific implementation guidance for mobile devices include, for example, configuration management, device identification and authentication, implementation of mandatory protective software (e.g., malicious code detection, firewall), scanning devices for malicious code, updating virus protection software, scanning for critical software updates and patches, conducting primary operating system (and possibly other resident software) integrity checks, and disabling unnecessary hardware (e.g., wireless, infrared). Organizations are cautioned that the need to provide adequate security for mobile devices goes beyond the requirements in this control. Many safeguards and countermeasures for mobile devices are reflected in other security controls in the catalog allocated in the initial control baselines as starting points for the development of security plans and overlays using the tailoring process. There may also be some degree of overlap in the requirements articulated by the security controls within the different families of controls. AC-20 addresses mobile devices that are not organization-controlled.

CIA Levels
Confidentiality	high
Integrity	high
Availability	unknown

Overlays
Classified, Int-A, Int-B, Int-C, Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

CSF Categories
PR.AC-3, PR.AC-6

Related Controls

The controls below (if any) were marked by NIST as being related to AC-19.

Control	Description
AC-3	The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
AC-7	The information system: a: Enforces a limit of [organization-defined number] consecutive invalid logon attempts by a user during a [organization-defined time period]; and b: Automatically [] when the maximum number of unsuccessful attempts is exceeded.
AC-18	The organization: a: Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and b: Authorizes wireless access to the information system prior to allowing such connections.
AC-20	The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to: a: Access the information system from external information systems; and b: Process, store, or transmit organization-controlled information using external information systems.
CA-9	The organization: a: Authorizes internal connections of [organization-defined information system components or classes of components] to the information system; and b: Documents, for each internal connection, the interface characteristics, security requirements, and the nature of the information communicated.
CM-2	The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.
IA-2	The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).
IA-3	The information system uniquely identifies and authenticates [organization-defined specific and/or types of devices] before establishing a [one or more of local/remote/network] connection.
MP-2	The organization restricts access to [organization-defined types of digital and/or non-digital media] to [organization-defined personnel or roles].
MP-4	The organization: a: Physically controls and securely stores [organization-defined types of digital and/or non-digital media] within [organization-defined controlled areas]; and b: Protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
MP-5	The organization: a: Protects and controls [organization-defined types of information system media] during transport outside of controlled areas using [organization-defined security safeguards]; b: Maintains accountability for information system media during transport outside of controlled areas; c: Documents activities associated with the transport of information system media; and d: Restricts the activities associated with the transport of information system media to authorized personnel.
PL-4	The organization: a: Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage; b: Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system; c: Reviews and updates the rules of behavior [organization-defined frequency]; and d: Requires individuals who have signed a previous version of the rules of behavior to read and re-sign when the rules of behavior are revised/updated.
SC-7	The information system: a: Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; b: Implements subnetworks for publicly accessible system components that are [] separated from internal organizational networks; and c: Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.
SC-43	The organization: a: Establishes usage restrictions and implementation guidance for [organization-defined information system components] based on the potential to cause damage to the information system if used maliciously; and b: Authorizes, monitors, and controls the use of such components within the information system.
SI-3	The organization: a: Employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code; b: Updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures; c: Configures malicious code protection mechanisms to: 1: Perform periodic scans of the information system [organization-defined frequency] and real-time scans of files from external sources at [one or more of endpoint/network entry/exit points] as the files are downloaded, opened, or executed in accordance with organizational security policy; and 2: [one or more of block malicious code/quarantine malicious code/send alert to administrator/ {{ insert: param, si-3_prm_4 }} ] in response to malicious code detection; and d: Addresses the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the information system.
SI-4	The organization: a: Monitors the information system to detect: 1: Attacks and indicators of potential attacks in accordance with [organization-defined monitoring objectives]; and 2: Unauthorized local, network, and remote connections; b: Identifies unauthorized use of the information system through [organization-defined techniques and methods]; c: Deploys monitoring devices: 1: Strategically within the information system to collect organization-determined essential information; and 2: At ad hoc locations within the system to track specific types of transactions of interest to the organization; d: Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion; e: Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information; f: Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and g: Provides [organization-defined information system monitoring information] to [organization-defined personnel or roles] [one or more of as needed/ {{ insert: param, si-4_prm_6 }} ].

Enhancements

The controls below (if any) add on to the requirements of AC-19.

Control	Description
AC-19(1)
AC-19(2)
AC-19(3)
AC-19(4)	The organization: (a): Prohibits the use of unclassified mobile devices in facilities containing information systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official; and (b): Enforces the following restrictions on individuals permitted by the authorizing official to use unclassified mobile devices in facilities containing information systems processing, storing, or transmitting classified information: (1): Connection of unclassified mobile devices to classified information systems is prohibited; (2): Connection of unclassified mobile devices to unclassified information systems requires approval from the authorizing official; (3): Use of internal or external modems or wireless interfaces within the unclassified mobile devices is prohibited; and (4): Unclassified mobile devices and the information stored on those devices are subject to random reviews and inspections by [organization-defined security officials], and if classified information is found, the incident handling policy is followed. (c): Restricts the connection of classified mobile devices to classified information systems in accordance with [organization-defined security policies].
AC-19(5)	The organization employs [] to protect the confidentiality and integrity of information on [organization-defined mobile devices].

Related CCIs

The CCIs below are tied to AC-19.

CCI	Definition
CCI-000082	The organization establishes usage restrictions for organization-controlled mobile devices.
CCI-000083	Establish implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas.
CCI-000084	Authorize connection of mobile devices to organizational systems.
CCI-002325	Establish configuration requirements for organization-controlled mobile devices, to include when such devices are outside of controlled areas.
CCI-002326	Establish connection requirements for organization-controlled mobile devices, to include when such devices are outside of controlled areas.