AC-21(1)

Requirement

Employ [Assignment: organization-defined automated mechanisms] to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.

Discussion

Automated mechanisms are used to enforce information sharing decisions.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Access control policy; procedures addressing user-based collaboration and information sharing (including restrictions); system design documentation; system configuration settings and associated documentation; system-generated list of users authorized to make information-sharing/collaboration decisions; system-generated list of sharing partners and access authorizations; system-generated list of access restrictions regarding information to be shared; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; system developers].

Test

[SELECT FROM: Automated mechanisms implementing access authorizations supporting information-sharing/user collaboration decisions].

ID	Assessment Objectives
AC-21(01)	<AC-21(01)_ODP automated mechanisms> are employed to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!