---

id: "AC-03(13)" title: "Attribute-based Access Control" family: "AC" family_name: "Access Control" sort_id: "ac-03.13" priority: "P1" implementation_level: "system" parent: "AC-03" enhancement: True

---

Statement

Enforce attribute-based access control policy over defined subjects and objects and control access based upon {{ insert: param, ac-03.13_odp }}.

Guidance

Attribute-based access control is an access control policy that restricts system access to authorized users based on specified organizational attributes (e.g., job function, identity), action attributes (e.g., read, write, delete), environmental attributes (e.g., time of day, location), and resource attributes (e.g., classification of a document). Organizations can create rules based on attributes and the authorizations (i.e., privileges) to perform needed operations on the systems associated with organization-defined attributes and rules. When users are assigned to attributes defined in attribute-based access control policies or rules, they can be provisioned to a system with the appropriate privileges or dynamically granted access to a protected resource. Attribute-based access control can be implemented as either a mandatory or discretionary form of access control. When implemented with mandatory access controls, the requirements in AC-3(3) define the scope of the subjects and objects covered by the policy.

Assessment Objective: the attribute-based access control policy is enforced over defined subjects;

Assessment Objective: the attribute-based access control policy is enforced over defined objects;

Assessment Objective: access is controlled based on {{ insert: param, ac-03.13_odp }}.

Access control policy

procedures addressing access enforcement

system design documentation

system configuration settings and associated documentation

list of subjects and objects (i.e., users and resources) requiring enforcement of attribute-based access control policies

system audit records

system security plan

other relevant documents or records

Organizational personnel with access enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

Mechanisms implementing access enforcement functions