id: "AC-04(09)" title: "Human Reviews" family: "AC" family_name: "Access Control" sort_id: "ac-04.09" priority: "P1" implementation_level: "system" parent: "AC-04" enhancement: True
Statement
Enforce the use of human reviews for {{ insert: param, ac-04.09_odp.01 }} under the following conditions: {{ insert: param, ac-04.09_odp.02 }}.
Guidance
Organizations define security or privacy policy filters for all situations where automated flow control decisions are possible. When a fully automated flow control decision is not possible, then a human review may be employed in lieu of or as a complement to automated security or privacy policy filtering. Human reviews may also be employed as deemed necessary by organizations.
Assessment Objective
human reviews are used for {{ insert: param, ac-04.09_odp.01 }} under {{ insert: param, ac-04.09_odp.02 }}.
Access control policy
information flow control policies
procedures addressing information flow enforcement
system design documentation
system configuration settings and associated documentation
records of human reviews regarding information flows
list of information flows requiring the use of human reviews
list of conditions requiring human reviews for information flows
system audit records
system security plan
privacy plan
other relevant documents or records
System/network administrators
organizational personnel with information security and privacy responsibilities
organizational personnel with information flow enforcement responsibilities
system developers
Mechanisms enforcing the use of human reviews