AC-21(2)

Requirement

Implement information search and retrieval services that enforce [Assignment: organization-defined information sharing restrictions].

Discussion

Information search and retrieval services identify information system resources relevant to an information need.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Access control policy; procedures addressing user-based collaboration and information sharing (including restrictions); system design documentation; system configuration settings and associated documentation; system-generated list of access restrictions regarding information to be shared; information search and retrieval records; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with access enforcement responsibilities for system search and retrieval services; system/network administrators; organizational personnel with information security responsibilities; system developers].

Test

[SELECT FROM: System search and retrieval services enforcing information-sharing restrictions].

ID	Assessment Objectives
AC-21(02)	information search and retrieval services that enforce <AC-21(02)_ODP information-sharing restrictions> are implemented.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!