AC-4(5)

Requirement

Enforce [Assignment: organization-defined limitations] on embedding data types within other data types.

Discussion

Embedding data types within other data types may result in reduced flow control effectiveness. Data type embedding includes inserting files as objects within other files and using compressed or archived data types that may include multiple embedded data types. Limitations on data type embedding consider the levels of embedding and prohibit levels of data type embedding that are beyond the capability of the inspection tools.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Access control policy; procedures addressing information flow enforcement; system design documentation; system configuration settings and associated documentation; list of limitations to be enforced on embedding data types within other data types; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; system developers].

Test

[SELECT FROM: Mechanisms implementing information flow enforcement policy].

ID	Assessment Objectives
AC-04(05)	<AC-04(05)_ODP limitations> are enforced on embedding data types within other data types.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!