AC-24

Requirement

[Selection: Establish procedures; Implement mechanisms] to ensure [Assignment: organization-defined access control decisions] are applied to each access request prior to access enforcement.

Discussion

Access control decisions (also known as authorization decisions) occur when authorization information is applied to specific accesses. In contrast, access enforcement occurs when systems enforce access control decisions. While it is common to have access control decisions and access enforcement implemented by the same entity, it is not required, and it is not always an optimal implementation choice. For some architectures and distributed systems, different entities may make access control decisions and enforce access.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Access control policy; procedures addressing access control decisions; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with responsibilities for establishing procedures regarding access control decisions to the system; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Mechanisms applying established access control decisions and procedures].

ID	Assessment Objectives
AC-24	<AC-24_ODP[01] SELECTED PARAMETER VALUES> are taken to ensure that <AC-24_ODP[02] access control decisions> are applied to each access request prior to access enforcement.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!