CMMC Practice AC.L1-3.1.2

Transaction & Function Control: Limit system access to the types of transactions and functions that authorized users are permitted to execute.

Monarch ISC Guidance

Role Based Access Control is best achieved by utilizing security groups. While the use of user level permissions may achieve compliance with this practice, we suggest always using security groups. Regardless of how you do it, you will need to limit access to applications and files to only those users with the business requirement to access those resources. Place users in appropriate groups for their department, location, or application need, and then use those groups to permit (or deny!) access to file shares, applications, and other network resources such as printers. Create a policy stating the organizational requirement is to limit user access to the resources required to perform their duties and document the various roles used.

Security Catapult

Be prepared for CMMC

Our Q&A assessment tool is designed by security advisors for MSPs and DoD contractors of all sizes.

Try now for free

Security Catapult

Understand your gaps

See compliance gaps, compliance scores and proactive security tasks in a single interface.

Try now for free

Security Catapult

Validate NIST SP 800-171

Based on your CMMC answers, we let you know where you stand on NIST.

Try now for free

Security Catapult

Build a plan of action

Track your burn down and stay on top of security needs.

Try now for free

Security Catapult

Build your policy

Say goodbye to maintaining a security policy. We do it for you.

Try now for free

Discussion From Source

NIST SP 800-171 R2 Organizations may choose to define access privileges or other attributes by account, by type of account, or a combination of both. System account types include individual, shared, group, system, anonymous, guest, emergency, developer, manufacturer, vendor, and temporary. Other attributes required for authorizing access include restrictions on time-of-day, day-of-week, and point-of-origin. In defining other account attributes, organizations consider system-related requirements (e.g., system upgrades scheduled maintenance,) and mission or business requirements, (e.g., time zone differences, customer requirements, remote access to support travel requirements).