id: "AC-24" title: "Access Control Decisions" family: "AC" family_name: "Access Control" sort_id: "ac-24" priority: "P1" implementation_level: "organization" enhancements: - ac-24.1 - ac-24.2
Statement
{{ insert: param, ac-24_odp.01 }} to ensure {{ insert: param, ac-24_odp.02 }} are applied to each access request prior to access enforcement.
Guidance
Access control decisions (also known as authorization decisions) occur when authorization information is applied to specific accesses. In contrast, access enforcement occurs when systems enforce access control decisions. While it is common to have access control decisions and access enforcement implemented by the same entity, it is not required, and it is not always an optimal implementation choice. For some architectures and distributed systems, different entities may make access control decisions and enforce access.
Assessment Objective
{{ insert: param, ac-24_odp.01 }} are taken to ensure that {{ insert: param, ac-24_odp.02 }} are applied to each access request prior to access enforcement.
Access control policy
procedures addressing access control decisions
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Organizational personnel with responsibilities for establishing procedures regarding access control decisions to the system
organizational personnel with information security responsibilities
Mechanisms applying established access control decisions and procedures