AC-3(5) Security-relevant Information
Control enhancement of AC-3 Access Enforcement
Control
Prevent access to [Assignment: security-relevant information] except during secure, non-operable system states.
Discussion
Security-relevant information is information within systems that can potentially impact the operation of security functions or the provision of security services in a manner that could result in failure to enforce system security and privacy policies or maintain the separation of code and data. Security-relevant information includes access control lists, filtering rules for routers or firewalls, configuration parameters for security services, and cryptographic key management information. Secure, non-operable system states include the times in which systems are not performing mission or business-related processing, such as when the system is offline for maintenance, boot-up, troubleshooting, or shut down.
Related controls
Need AC-3(5) implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.