AC-3(12) Assert and Enforce Application Access
Control enhancement of AC-3 Access Enforcement
Control
Require applications to assert, as part of the installation process, the access needed to the following system applications and functions: [Assignment: system applications and functions];
Provide an enforcement mechanism to prevent unauthorized access; and
Approve access changes after initial installation of the application.
Discussion
Asserting and enforcing application access is intended to address applications that need to access existing system applications and functions, including user contacts, global positioning systems, cameras, keyboards, microphones, networks, phones, or other files.
Related controls
Need AC-3(12) implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.