AC-3(15)

Requirement
1. Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy; and
2. Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy.

Discussion

Simultaneously implementing a mandatory access control policy and a discretionary access control policy can provide additional protection against the unauthorized execution of code by users or processes acting on behalf of users. This helps prevent a single compromised user or process from compromising the entire system.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Access control policy; procedures addressing access enforcement; system design documentation; system configuration settings and associated documentation; list of subjects and objects (i.e., users and resources) requiring enforcement of mandatory access control policies; list of subjects and objects (i.e., users and resources) requiring enforcement of discretionary access control policies; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with access enforcement responsibilities; system/network administrators; organizational personnel with information security responsibilities; system developers].

Test

[SELECT FROM: Mechanisms implementing mandatory and discretionary access control policy].

ID	Assessment Objectives
AC-03(15)(b)[01]	<AC-03(15)_ODP[03] discretionary access control policy> is enforced over the set of covered subjects specified in the policy;
AC-03(15)(b)[02]	<AC-03(15)_ODP[04] discretionary access control policy> is enforced over the set of covered objects specified in the policy.
AC-03(15)(a)[01]	<AC-03(15)_ODP[01] mandatory access control policy> is enforced over the set of covered subjects specified in the policy;
AC-03(15)(a)[02]	<AC-03(15)_ODP[02] mandatory access control policy> is enforced over the set of covered objects specified in the policy;

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!