AC-4(23)

Requirement

When transferring information between different security domains, modify non-releasable information by implementing [Assignment: organization-defined modification action].

Discussion

Modifying non-releasable information can help prevent a data spill or attack when information is transferred across security domains. Modification actions include masking, permutation, alteration, removal, or redaction.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Information flow enforcement policy; procedures addressing information flow enforcement; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with information flow enforcement responsibilities; system/network administrators; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Mechanisms implementing information flow enforcement functions].

ID	Assessment Objectives
AC-04(23)	when transferring information between security domains, non-releasable information is modified by implementing <AC-04(23)_ODP modification action>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!