AC-4(4)

Requirement

Prevent encrypted information from bypassing [Assignment: organization-defined information flow control mechanisms] by [Selection (one or more): decrypting the information; blocking the flow of the encrypted information; terminating communications sessions attempting to pass encrypted information; [Assignment: organization-defined procedure or method]].

Discussion

Flow control mechanisms include content checking, security policy filters, and data type identifiers. The term encryption is extended to cover encoded data not recognized by filtering mechanisms.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Access control policy; information flow control policies; procedures addressing information flow enforcement; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; system developers].

Test

[SELECT FROM: Mechanisms implementing information flow enforcement policy].

ID	Assessment Objectives
AC-04(04)	encrypted information is prevented from bypassing <AC-04(04)_ODP[01] information flow control mechanisms> by <AC-04(04)_ODP[02] SELECTED PARAMETER VALUES>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!