AC-3(10)

AC-3(10): Audited Override of Access Control Mechanisms

The organization employs an audited override of automated access control mechanisms under [organization-defined conditions].

Overlays
None

CSF Categories
None

The controls below (if any) were marked by NIST as being related to AC-3(10).

Control	Description
AU-2	The organization: a: Determines that the information system is capable of auditing the following events: [organization-defined auditable events]; b: Coordinates the security audit function with other organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events; c: Provides a rationale for why the auditable events are deemed to be adequate to support after-the-fact investigations of security incidents; and d: Determines that the following events are to be audited within the information system: [organization-defined audited events (the subset of the auditable events defined in AU-2 a.) along with the frequency of (or situation requiring) auditing for each identified event].
AU-6	The organization: a: Reviews and analyzes information system audit records [organization-defined frequency] for indications of [organization-defined inappropriate or unusual activity]; and b: Reports findings to [organization-defined personnel or roles].

Control

Description

a: Determines that the information system is capable of auditing the following events: [organization-defined auditable events];

b: Coordinates the security audit function with other organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events;

c: Provides a rationale for why the auditable events are deemed to be adequate to support after-the-fact investigations of security incidents; and

d: Determines that the following events are to be audited within the information system: [organization-defined audited events (the subset of the auditable events defined in AU-2 a.) along with the frequency of (or situation requiring) auditing for each identified event].

a: Reviews and analyzes information system audit records [organization-defined frequency] for indications of [organization-defined inappropriate or unusual activity]; and

The controls below (if any) add on to the requirements of AC-3(10).

Control	Description
No controls

The CCIs below are tied to AC-3(10).

CCI	Definition
CCI-002185	Defines the conditions on which it will employ an audited override of automated access control mechanisms.
CCI-002186	Employ an audited override of automated access control mechanisms under organization-defined conditions by organization-defined roles.