AC-6(3)

Requirement

Authorize network access to [Assignment: organization-defined privileged commands] only for [Assignment: organization-defined compelling operational needs] and document the rationale for such access in the security plan for the system.

Discussion

Network access is any access across a network connection in lieu of local access (i.e., user being physically present at the device).

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Access control policy; procedures addressing least privilege; system configuration settings and associated documentation; system audit records; list of operational needs for authorizing network access to privileged commands; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks; organizational personnel with information security responsibilities].

ID	Assessment Objectives
AC-06(03)[01]	network access to <AC-06(03)_ODP[01] privileged commands> is authorized only for <AC-06(03)_ODP[02] compelling operational needs>;
AC-06(03)[02]	the rationale for authorizing network access to privileged commands is documented in the security plan for the system.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!