id: "AC-16(05)" title: "Attribute Displays on Objects to Be Output" family: "AC" family_name: "Access Control" sort_id: "ac-16.05" priority: "P1" implementation_level: "system" parent: "AC-16" enhancement: True
Statement
Display security and privacy attributes in human-readable form on each object that the system transmits to output devices to identify {{ insert: param, ac-16.05_odp.01 }} using {{ insert: param, ac-16.05_odp.02 }}.
Guidance
System outputs include printed pages, screens, or equivalent items. System output devices include printers, notebook computers, video displays, smart phones, and tablets. To mitigate the risk of unauthorized exposure of information (e.g., shoulder surfing), the outputs display full attribute values when unmasked by the subscriber.
Assessment Objective: security attributes are displayed in human-readable form on each object that the system transmits to output devices to identify {{ insert: param, ac-16.05_odp.01 }} using {{ insert: param, ac-16.05_odp.02 }};
Assessment Objective: privacy attributes are displayed in human-readable form on each object that the system transmits to output devices to identify {{ insert: param, ac-16.05_odp.01 }} using {{ insert: param, ac-16.05_odp.02 }}.
Access control policy
procedures addressing display of security and privacy attributes in human-readable form
special dissemination, handling, or distribution instructions
types of human-readable, standard naming conventions
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
privacy plan
other relevant documents or records
Organizational personnel with information security and privacy responsibilities
system developers
System output devices displaying security and privacy attributes in human-readable form on each object