Navigate

AC-3(3)

AC-3(3): Mandatory Access Control

The information system enforces [organization-defined mandatory access control policy] over all subjects and objects where the policy:

(a): Is uniformly enforced across all subjects and objects within the boundary of the information system;

(b): Specifies that a subject that has been granted access to information is constrained from doing any of the following;
- (1): Passing the information to unauthorized subjects or objects;
- (2): Granting its privileges to other subjects;
- (3): Changing one or more security attributes on subjects, objects, the information system, or information system components;
- (4): Choosing the security attributes and attribute values to be associated with newly created or modified objects; or
- (5): Changing the rules governing access control; and

(c): Specifies that [organization-defined subjects] may explicitly be granted [organization-defined privileges (i.e., they are trusted subjects)] such that they are not limited by some or all of the above constraints.

Supplemental

Mandatory access control as defined in this control enhancement is synonymous with nondiscretionary access control, and is not constrained only to certain historical uses (e.g., implementations using the Bell-LaPadula Model). The above class of mandatory access control policies constrains what actions subjects can take with information obtained from data objects for which they have already been granted access, thus preventing the subjects from passing the information to unauthorized subjects and objects. This class of mandatory access control policies also constrains what actions subjects can take with respect to the propagation of access control privileges; that is, a subject with a privilege cannot pass that privilege to other subjects. The policy is uniformly enforced over all subjects and objects to which the information system has control. Otherwise, the access control policy can be circumvented. This enforcement typically is provided via an implementation that meets the reference monitor concept (see AC-25). The policy is bounded by the information system boundary (i.e., once the information is passed outside of the control of the system, additional means may be required to ensure that the constraints on the information remain in effect). The trusted subjects described above are granted privileges consistent with the concept of least privilege (see AC-6). Trusted subjects are only given the minimum privileges relative to the above policy necessary for satisfying organizational mission/business needs. The control is most applicable when there is some policy mandate (e.g., law, Executive Order, directive, or regulation) that establishes a policy regarding access to sensitive/classified information and some users of the information system are not authorized access to all sensitive/classified information resident in the information system. This control can operate in conjunction with AC-3 (4). A subject that is constrained in its operation by policies governed by this control is still able to operate under the less rigorous constraints of AC-3 (4), but policies governed by this control take precedence over the less rigorous constraints of AC-3 (4). For example, while a mandatory access control policy imposes a constraint preventing a subject from passing information to another subject operating at a different sensitivity label, AC-3 (4) permits the subject to pass the information to any subject with the same sensitivity label as the subject.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to AC-3(3).

Control	Description
AC-25	The information system implements a reference monitor for [organization-defined access control policies] that is tamperproof, always invoked, and small enough to be subject to analysis and testing, the completeness of which can be assured.
SC-11	The information system establishes a trusted communications path between the user and the following security functions of the system: [organization-defined security functions to include at a minimum, information system authentication and re-authentication].

Enhancements

The controls below (if any) add on to the requirements of AC-3(3).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AC-3(3).

CCI	Definition
CCI-002153	Defines the mandatory access control policies that are to be enforced over all subjects and objects.
CCI-002154	Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy is uniformly enforced across the covered subjects and objects within the system.
CCI-002155	Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from passing the information to unauthorized subjects or objects.
CCI-002156	Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from granting its privileges to other subjects.
CCI-002157	Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from changing one or more security attributes on subjects, objects, the system, or system components.
CCI-002158	Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from choosing the security attributes to be associated with newly created or modified objects.
CCI-002159	Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from choosing the attribute values to be associated with newly created or modified objects.
CCI-002160	Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from changing the rules governing access control.
CCI-002161	Defines subjects which may explicitly be granted organization-defined privileges such that they are not limited by any of the mandatory access control constraints.
CCI-002162	Defines the privileges that may explicitly be granted to organization-defined subjects such that they are not limited by any of the mandatory access control constraints.
CCI-003014	Enforce organization-defined mandatory access control policies over all subjects and objects.
CCI-003015	Specifies that organization-defined subjects may explicitly be granted organization-defined privileges such that they are not limited by any defined subset (or all) of the above constraints.