1. Home
  2. FedRAMP
  3. AC-1

BRACKETOLOGY | FEDRAMP

AC-1: ACCESS CONTROL POLICY AND PROCEDURES

  • FedRAMP Baseline Membership AC-1:
  • LOW
  • MODERATE
  • HIGH

FedRAMP Bracketology

Use the FedRAMP Control Membership information above to determine if a control or control enhancement is required for each Impact Baseline — LOW, MODERATE, or HIGH

Click on the panel below each control or control enhancement to review the FedRAMP Impact Baseline-specific control configuration requirements for each of the [BRACKETS] in each control and/or control enhancement.

Review and use Additional Requirements and Guidance to build FedRAMP-compliant controls for your risk-based cybersecurity program.

To change the baseline view in the panel, click on LOW, MODERATE, or HIGH when the panel is open

Panels only appear where there are [BRACKETS] in the control or enhancement or where there is FedRAMP-specific requirements or guidance available.

The organization:

    • a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:
      1. An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Procedures to facilitate the implementation of the access control policy and associated access controls; and
    • b. Reviews and updates the current:
      1. Access control policy [Assignment: organization-defined frequency]; and
      2. Access control procedures [Assignment: organization-defined frequency].

FedRAMP control configuration guidance, and FedRAMP specific Additional Guidance and Requirements appear in BOLD.

AC-1 a — Organizations are responsible for developing their own Access Control Policies and Procedures. FedRAMP enables the organization to determine who receives a copy of the policy and procedures. Best practice it so provide copies of the Access Control policy and procedures for all users in your organization.

AC-1 b. 1. — FedRAMP requires that your Access Control Policy is reviewed and updated at least every three years. Best practice is to update your policy whenever a change in your risk posture warrants realiging your policies with your risk.

AC-1 b. 2. — FedRAMP requires that you review and update your Access Control Procedures are reviewed and updated at least every three years.. Best practices are to update your procedures whenever a change in your risk or threat posture warrant changes in your procedures.

AC-1 a — Organizations are responsible for developing their own Access Control Policies and Procedures. FedRAMP enables the organization to determine who receives a copy of the policy and procedures. Best practice it so provide copies of the Access Control policy and procedures for all users in your organization.

AC-1 b. 1. — FedRAMP requires that your Access Control Policy is reviewed and updated at least every three years. Best practice is to update your policy at least annually or whenever a change in your risk posture warrants reevaluation.

AC-1 b. 2. — FedRAMP requires that you review and update your Access Control Procedures are reviewed and updated at least annually.. Best practices are to update your procedures whenever a change in your risk or threat posture warrant changes in your procedures.

AC-1 a — Organizations are responsible for developing their own Access Control Policies and Procedures. FedRAMP enables the organization to determine who receives a copy of the policy and procedures. Best practice it so provide copies of the Access Control policy and procedures for all users in your organization.

AC-1 b. 1. — FedRAMP requires that High Impact Baseline systems review their Access Control Policy is reviewed and updated at least annually. Best practice is to update your policy at least annually or whenever a change in your risk posture warrants reevaluation.

AC-1 b. 2. — FedRAMP requires that you review and update your Access Control Procedures are reviewed and updated at least annually or whenever a significant change occurs .

SUPPLEMENTAL GUIDANCE

This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AC family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures.

CONTROL ENHANCEMENTS

NO CONTROL ENHANCEMENTS

REFERENCES:

  • NIST Special Publication 800-100
  • NIST Special Publication 800-12