id: "AC-16(08)" title: "Association Techniques and Technologies" family: "AC" family_name: "Access Control" sort_id: "ac-16.08" priority: "P1" implementation_level: "system" parent: "AC-16" enhancement: True


Statement

Implement {{ insert: param, ac-16.8_prm_1 }} in associating security and privacy attributes to information.

Guidance

The association of security and privacy attributes to information within systems is important for conducting automated access enforcement and flow enforcement actions. The association of such attributes to information (i.e., binding) can be accomplished with technologies and techniques that provide different levels of assurance. For example, systems can cryptographically bind attributes to information using digital signatures that support cryptographic keys protected by hardware devices (sometimes known as hardware roots of trust).

Assessment Objective: {{ insert: param, ac-16.08_odp.01 }} are implemented in associating security attributes to information;

Assessment Objective: {{ insert: param, ac-16.08_odp.02 }} are implemented in associating privacy attributes to information.

Access control policy

procedures addressing association of security and privacy attributes to information

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

privacy plan

other relevant documents or records

Organizational personnel with responsibilities for associating security and privacy attributes to information

organizational personnel with information security and privacy responsibilities

system developers

Mechanisms implementing techniques or technologies associating security and privacy attributes to information