id: "AC-03(15)" title: "Discretionary and Mandatory Access Control" family: "AC" family_name: "Access Control" sort_id: "ac-03.15" priority: "P1" implementation_level: "system" parent: "AC-03" enhancement: True
Enforce {{ insert: param, ac-3.15_prm_1 }} over the set of covered subjects and objects specified in the policy; and
Enforce {{ insert: param, ac-3.15_prm_2 }} over the set of covered subjects and objects specified in the policy.
Guidance
Simultaneously implementing a mandatory access control policy and a discretionary access control policy can provide additional protection against the unauthorized execution of code by users or processes acting on behalf of users. This helps prevent a single compromised user or process from compromising the entire system.
Assessment Objective: {{ insert: param, ac-03.15_odp.01 }} is enforced over the set of covered subjects specified in the policy;
Assessment Objective: {{ insert: param, ac-03.15_odp.02 }} is enforced over the set of covered objects specified in the policy;
Assessment Objective: {{ insert: param, ac-03.15_odp.03 }} is enforced over the set of covered subjects specified in the policy;
Assessment Objective: {{ insert: param, ac-03.15_odp.04 }} is enforced over the set of covered objects specified in the policy.
Access control policy
procedures addressing access enforcement
system design documentation
system configuration settings and associated documentation
list of subjects and objects (i.e., users and resources) requiring enforcement of mandatory access control policies
list of subjects and objects (i.e., users and resources) requiring enforcement of discretionary access control policies
system audit records
system security plan
other relevant documents or records
Organizational personnel with access enforcement responsibilities
system/network administrators
organizational personnel with information security responsibilities
system developers
Mechanisms implementing mandatory and discretionary access control policy