3.1.2

Requirement

Limit system access to the types of transactions and functions that authorized users are permitted to execute.

Discussion

Organizations may choose to define access privileges or other attributes by account, by type of account, or a combination of both. System account types include individual, shared, group, system, anonymous, guest, emergency, developer, manufacturer, vendor, and temporary. Other attributes required for authorizing access include restrictions on time-of-day, day-of-week, and point-of-origin. In defining other account attributes, organizations consider system-related requirements (e.g., system upgrades scheduled maintenance,) and mission or business requirements, (e.g., time zone differences, customer requirements, remote access to support travel requirements).

NIST 800-171A Assessment Guidance

Examine

[SELECT FROM: Access control policy; procedures addressing access enforcement; security plan; system design documentation; list of approved authorizations (user privileges) including remote access authorizations; system configuration settings and associated documentation; system audit logs and records; other relevant documents or records].
Interview

[SELECT FROM: Personnel with access enforcement responsibilities; system or network administrators; personnel with information security responsibilities; system developers].
Test

[SELECT FROM: Mechanisms implementing access control policy].

ID	Assessment Objectives
3.1.2[a]	The types of transactions and functions that authorized users are permitted to execute are defined
3.1.2[b]	System access is limited to the defined types of transactions and functions for authorized users.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!