AC-3(11)

Requirement

Restrict access to data repositories containing [Assignment: organization-defined information types].

Discussion

Restricting access to specific information is intended to provide flexibility regarding access control of specific information types within a system. For example, role-based access could be employed to allow access to only a specific type of personally identifiable information within a database rather than allowing access to the database in its entirety. Other examples include restricting access to cryptographic keys, authentication information, and selected system information.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Access control policy; procedures addressing access enforcement; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with access enforcement responsibilities; organizational personnel with responsibilities for data repositories; system/network administrators; organizational personnel with information security responsibilities].

ID	Assessment Objectives
AC-03(11)	access to data repositories containing <AC-03(11)_ODP information types> is restricted.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!