CyberStrikeus/CyberStrike - Page 118

ac-4-23-modify-non-releasable-information

When transferring information between different security domains, modify non-releasable information by implementing [organization-defined].

ac-4-24-internal-normalized-format

When transferring information between different security domains, parse incoming data into an internal normalized format and regenerate the data to be

ac-4-25-data-sanitization

When transferring information between different security domains, sanitize data to minimize [organization-defined] in accordance with [organization-de

ac-4-26-audit-filtering-actions

When transferring information between different security domains, record and audit content filtering actions and results for the information being fil

ac-4-27-redundantindependent-filtering-mechanisms

When transferring information between different security domains, implement content filtering solutions that provide redundant and independent filteri

ac-4-28-linear-filter-pipelines

When transferring information between different security domains, implement a linear content filter pipeline that is enforced with discretionary and m

ac-4-29-filter-orchestration-engines

When transferring information between different security domains, employ content filter orchestration engines to ensure that: Content filtering mechan

ac-4-3-dynamic-information-flow-control

Enforce [organization-defined].

ac-4-30-filter-mechanisms-using-multiple-processes

When transferring information between different security domains, implement content filtering mechanisms using multiple processes.

ac-4-31-failed-content-transfer-prevention

When transferring information between different security domains, prevent the transfer of failed content to the receiving domain.

ac-4-32-process-requirements-for-information-transfer

When transferring information between different security domains, the process that transfers information between filter pipelines: Does not filter mes

ac-4-4-flow-control-of-encrypted-information

Prevent encrypted information from bypassing [organization-defined] by [organization-defined].

ac-4-5-embedded-data-types

Enforce [organization-defined] on embedding data types within other data types.

ac-4-6-metadata

Enforce information flow control based on [organization-defined].

ac-4-7-one-way-flow-mechanisms

Enforce one-way information flows through hardware-based flow control mechanisms.

ac-4-8-security-and-privacy-policy-filters

Enforce information flow control using [organization-defined] as a basis for flow control decisions for [organization-defined] ;

ac-4-9-human-reviews

Enforce the use of human reviews for [organization-defined] under the following conditions: [organization-defined].

ac-4-information-flow-enforcement

Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [organization-defined

ac-5-separation-of-duties

Identify and document [organization-defined] ;

ac-6-1-authorize-access-to-security-functions

Authorize access for [organization-defined] to: [organization-defined] ; and [organization-defined].

ac-6-2-non-privileged-access-for-nonsecurity-functions

Require that users of system accounts (or roles) with access to [organization-defined] use non-privileged accounts or roles, when accessing nonsecurit

ac-6-3-network-access-to-privileged-commands

Authorize network access to [organization-defined] only for [organization-defined] and document the rationale for such access in the security plan for

ac-6-4-separate-processing-domains

Provide separate processing domains to enable finer-grained allocation of user privileges.

ac-6-5-privileged-accounts

Restrict privileged accounts on the system to [organization-defined].

ac-6-6-privileged-access-by-non-organizational-users

Prohibit privileged access to the system by non-organizational users.

ac-6-7-review-of-user-privileges

Review [organization-defined] the privileges assigned to [organization-defined] to validate the need for such privileges;

ac-6-8-privilege-levels-for-code-execution

Prevent the following software from executing at higher privilege levels than users executing the software: [organization-defined].

ac-6-9-log-use-of-privileged-functions

Log the execution of privileged functions.

ac-6-least-privilege

Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to ac

ac-7-1-automatic-account-lock

Automatic Account Lock

ac-7-2-purge-or-wipe-mobile-device

Purge or wipe information from [organization-defined] based on [organization-defined] after [organization-defined] consecutive, unsuccessful device lo

ac-7-3-biometric-attempt-limiting

Limit the number of unsuccessful biometric logon attempts to [organization-defined].

ac-7-4-use-of-alternate-authentication-factor

Allow the use of [organization-defined] that are different from the primary authentication factors after the number of organization-defined consecu...

ac-7-unsuccessful-logon-attempts

Enforce a limit of [organization-defined] consecutive invalid logon attempts by a user during a [organization-defined] ;

ac-8-system-use-notification

Display [organization-defined] to users before granting access to the system that provides privacy and security notices consistent with applicable law

ac-9-1-unsuccessful-logons

Notify the user, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.

ac-9-2-successful-and-unsuccessful-logons

Notify the user, upon successful logon, of the number of [organization-defined] during [organization-defined].

ac-9-3-notification-of-account-changes

Notify the user, upon successful logon, of changes to [organization-defined] during [organization-defined].

ac-9-4-additional-logon-information

Notify the user, upon successful logon, of the following additional information: [organization-defined].

ac-9-previous-logon-notification

Notify the user, upon successful logon to the system, of the date and time of the last logon.