Back to Control Families

Access Control

22 controls in this family. Select a control for detailed guidance, implementation examples, and assessment questions.

3.1.1

Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).

3.1.2

Limit system access to the types of transactions and functions that authorized users are permitted to execute.

3.1.3

Control the flow of CUI in accordance with approved authorizations.

3.1.4

Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

3.1.5

Employ the principle of least privilege, including for specific security functions and privileged accounts.

3.1.6

Use non-privileged accounts or roles when accessing nonsecurity functions

3.1.7

Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

3.1.8

Limit unsuccessful logon attempts.

3.1.9

Provide privacy and security notices consistent with applicable CUI rules.

3.1.10

Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity

3.1.11

Terminate (automatically) a user session after a defined condition.

3.1.12

Monitor and control remote access sessions.

3.1.13

Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

3.1.14

Route remote access via managed access control points.

3.1.15

Authorize remote execution of privileged commands and remote access to security-relevant information.

3.1.16

Authorize wireless access prior to allowing such connections

3.1.17

Protect wireless access using authentication and encryption

3.1.18

Control connection of mobile devices.

3.1.19

Encrypt CUI on mobile devices and mobile computing platforms.[23]

3.1.20

Verify and control/limit connections to and use of external systems.

3.1.21

Limit use of portable storage devices on external systems.

3.1.22

Control CUI posted or processed on publicly accessible systems.

Need Complete CMMC Guidance?

Get full access to all controls, detailed implementation guidance, and expert support.

Request Full Access