Navigate

AC-6(7)

AC-6(7): Review of User Privileges

(a): Review [the frequency at which to review the privileges assigned to roles or classes of users is defined;] the privileges assigned to [roles or classes of users to which privileges are assigned are defined;] to validate the need for such privileges; and

(b): Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.

Supplemental

The need for certain assigned user privileges may change over time to reflect changes in organizational mission and business functions, environments of operation, technologies, or threats. A periodic review of assigned user privileges is necessary to determine if the rationale for assigning such privileges remains valid. If the need cannot be revalidated, organizations take appropriate corrective actions.

CIA Levels
Confidentiality	low
Integrity	low
Availability	unknown

Overlays
CMMC, Classified, DAF Baseline, Int-A, Int-B, Int-C, Privacy (accountability), Privacy (high), Privacy (low), Privacy (moderate)

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to AC-6(7).

Control	Description
CA-7	Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes: a: Establishing the following system-level metrics to be monitored: [system-level metrics to be monitored are defined;]; b: Establishing [frequencies at which to monitor control effectiveness are defined;] for monitoring and [frequencies at which to assess control effectiveness are defined;] for assessment of control effectiveness; c: Ongoing control assessments in accordance with the continuous monitoring strategy; d: Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy; e: Correlation and analysis of information generated by control assessments and monitoring; f: Response actions to address results of the analysis of control assessment and monitoring information; and g: Reporting the security and privacy status of the system to [one of ] [one of ].

Control

Description

CA-7

Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes:

a: Establishing the following system-level metrics to be monitored: [system-level metrics to be monitored are defined;];

b: Establishing [frequencies at which to monitor control effectiveness are defined;] for monitoring and [frequencies at which to assess control effectiveness are defined;] for assessment of control effectiveness;

c: Ongoing control assessments in accordance with the continuous monitoring strategy;

d: Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;

e: Correlation and analysis of information generated by control assessments and monitoring;

f: Response actions to address results of the analysis of control assessment and monitoring information; and

g: Reporting the security and privacy status of the system to [one of ] [one of ].

Enhancements

The controls below (if any) add on to the requirements of AC-6(7).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AC-6(7).

CCI	Definition
CCI-002228	Defines the frequency on which it conducts reviews of the privileges assigned to organization-defined roles or classes of users.
CCI-002229	Defines the roles or classes of users that are to have their privileges reviewed on an organization-defined frequency.
CCI-002230	Review, on an organization-defined frequency, the privileges assigned to organization-defined roles or classes of users to validate the need for such privileges.
CCI-002231	Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.