800-53|AC-1

Title

ACCESS CONTROL POLICY AND PROCEDURES

Description

The organization:

Supplemental

This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AC family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures.

Reference Item Details

Related: PM-9

Category: ACCESS CONTROL

Family: ACCESS CONTROL

Priority: P1

Baseline Impact: LOW,MODERATE,HIGH

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.1 Ensure a customer created Customer Master Key (CMK) is created for the Web-tieramazon_awsCIS Amazon Web Services Three-tier Web Architecture L2 1.0.0
1.1.2 Ensure only trusted users are allowed to control Docker daemonUnixCIS Docker v1.6.0 L1 Docker Linux
1.2 Ensure a customer created Customer Master Key (CMK) is created for the App-tieramazon_awsCIS Amazon Web Services Three-tier Web Architecture L2 1.0.0
1.2.17.4 Dial-Up Options: Level I Enabled: Warn before switching an existing dial-up connection.WindowsCIS MS Office 2007 v1.1.0 L1
1.3 Ensure a customer created Customer Master Key (CMK) is created for the Database-Tieramazon_awsCIS Amazon Web Services Three-tier Web Architecture L2 1.0.0
1.4 Ensure Guest Users Are Reviewed on a Regular Basismicrosoft_azureCIS Microsoft Azure Foundations v2.1.0 L1
1.7 Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to '0'microsoft_azureCIS Microsoft Azure Foundations v2.1.0 L1
1.10 Ensure 'User consent for applications' is set to 'Do not allow user consent'microsoft_azureCIS Microsoft Azure Foundations v2.1.0 L1
1.11 Ensure 'User consent for applications' Is Set To 'Allow for Verified Publishers'microsoft_azureCIS Microsoft Azure Foundations v2.1.0 L2
1.15 Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users'microsoft_azureCIS Microsoft Azure Foundations v2.1.0 L2
1.24 Ensure That 'Subscription leaving Microsoft Entra ID directory' and 'Subscription entering Microsoft Entra ID directory' Is Set To 'Permit No One'microsoft_azureCIS Microsoft Azure Foundations v2.1.0 L2
2.1.1 Client certificate authentication should not be used for usersGCPCIS Google Kubernetes Engine (GKE) v1.5.0 L1
2.2.10 Ensure 'SEC_MAX_FAILED_LOGIN_ATTEMPTS' Is '3' or LessOracleDBCIS Oracle Server 19c DB Traditional Auditing v1.2.0
2.2.10 Ensure 'SEC_MAX_FAILED_LOGIN_ATTEMPTS' Is '3' or LessOracleDBCIS Oracle Server 19c DB Unified Auditing v1.2.0
2.7 Ensure that a unique Certificate Authority is used for etcdUnixCIS Kubernetes Benchmark v1.9.0 L2 Master
2.7 Ensure that a unique Certificate Authority is used for etcdUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L2 Master
2.7 Ensure that a unique Certificate Authority is used for etcdUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L2 Master
2.7 Ensure that a unique Certificate Authority is used for etcdUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L2 Master
2.12.1 Ensure Guest Account Is DisabledUnixCIS Apple macOS 13.0 Ventura v2.0.0 L1
2.12.1 Ensure Guest Account Is DisabledUnixCIS Apple macOS 14.0 Sonoma v1.0.0 L1
2.14 Ensure containers are restricted from acquiring new privilegesUnixCIS Docker v1.6.0 L1 Docker Linux
3.1 Ensure 'FAILED_LOGIN_ATTEMPTS' Is Less than or Equal to '5'OracleDBCIS Oracle Server 19c DB Traditional Auditing v1.2.0
3.1 Ensure 'FAILED_LOGIN_ATTEMPTS' Is Less than or Equal to '5'OracleDBCIS Oracle Server 19c DB Unified Auditing v1.2.0
3.1.1 Client certificate authentication should not be used for usersUnixCIS Kubernetes Benchmark v1.9.0 L1 Master
3.1.1 Client certificate authentication should not be used for usersUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
3.1.1 Client certificate authentication should not be used for usersUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
3.1.1 Client certificate authentication should not be used for usersUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
3.1.2 Service account token authentication should not be used for usersUnixCIS Kubernetes Benchmark v1.9.0 L1 Master
3.1.3 Bootstrap token authentication should not be used for usersUnixCIS Kubernetes Benchmark v1.9.0 L1 Master
3.2 Ensure 'PASSWORD_LOCK_TIME' Is Greater than or Equal to '1'OracleDBCIS Oracle Server 19c DB Traditional Auditing v1.2.0
3.2 Ensure 'PASSWORD_LOCK_TIME' Is Greater than or Equal to '1'OracleDBCIS Oracle Server 19c DB Unified Auditing v1.2.0
3.3 Ensure 'PASSWORD_LIFE_TIME' Is Less than or Equal to '90'OracleDBCIS Oracle Server 19c DB Traditional Auditing v1.2.0
3.3 Ensure 'PASSWORD_LIFE_TIME' Is Less than or Equal to '90'OracleDBCIS Oracle Server 19c DB Unified Auditing v1.2.0
3.3 Ensure 'PASSWORD_LIFE_TIME' Is Less than or Equal to '90'OracleDBCIS Oracle Server 12c DB Traditional Auditing v3.0.0
3.3 Ensure 'PASSWORD_LIFE_TIME' Is Less than or Equal to '90'OracleDBCIS Oracle Server 12c DB Unified Auditing v3.0.0
3.4 Ensure that Storage Account Access Keys are Periodically Regeneratedmicrosoft_azureCIS Microsoft Azure Foundations v2.1.0 L1
3.6 Ensure that Shared Access Signature Tokens Expire Within an Hourmicrosoft_azureCIS Microsoft Azure Foundations v2.1.0 L1
3.8 Ensure 'SESSIONS_PER_USER' Is Less than or Equal to '10'OracleDBCIS Oracle Server 19c DB Traditional Auditing v1.2.0
3.8 Ensure 'SESSIONS_PER_USER' Is Less than or Equal to '10'OracleDBCIS Oracle Server 19c DB Unified Auditing v1.2.0
3.12 (L1) Host must lock an account after a specified number of failed login attemptsVMwareCIS VMware ESXi 8.0 v1.1.0 L1
4.3 (L1) Ensure the maximum failed login attempts is set to 5VMwareCIS VMware ESXi 7.0 v1.4.0 L1
4.3 Ensure the maximum failed login attempts is set to 5VMwareCIS VMware ESXi 6.7 v1.3.0 Level 1
4.4.2.1.2 Ensure password failed attempts lockout is configuredUnixCIS Oracle Linux 7 v4.0.0 L1 Workstation
4.4.2.1.2 Ensure password failed attempts lockout is configuredUnixCIS CentOS Linux 7 v4.0.0 L1 Workstation
4.4.2.1.2 Ensure password failed attempts lockout is configuredUnixCIS Amazon Linux 2 v3.0.0 L1
4.4.2.1.2 Ensure password failed attempts lockout is configuredUnixCIS CentOS Linux 7 v4.0.0 L1 Server
4.4.2.1.2 Ensure password failed attempts lockout is configuredUnixCIS Red Hat Enterprise Linux 7 v4.0.0 L1 Server
4.4.2.1.2 Ensure password failed attempts lockout is configuredUnixCIS Oracle Linux 7 v4.0.0 L1 Server
4.4.2.1.2 Ensure password failed attempts lockout is configuredUnixCIS Red Hat Enterprise Linux 7 v4.0.0 L1 Workstation
4.4.2.1.3 Ensure password unlock time is configuredUnixCIS Oracle Linux 7 v4.0.0 L1 Workstation