AC-16(1)—Dynamic Attribute Association
>Control Description
Dynamically associate security and privacy attributes with ⚙organization-defined subjects and objects in accordance with the following security and privacy policies as information is created and combined: ⚙organization-defined security and privacy policies.
>Cross-Framework Mappings
>Supplemental Guidance
Dynamic association of attributes is appropriate whenever the security or privacy characteristics of information change over time. Attributes may change due to information aggregation issues (i.e., characteristics of individual data elements are different from the combined elements), changes in individual access authorizations (i.e., privileges), changes in the security category of information, or changes in security or privacy policies. Attributes may also change situationally.
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What formal policies and procedures govern the implementation of AC-16(1) (Dynamic Attribute Association)?
- •Who are the designated roles responsible for implementing, maintaining, and monitoring AC-16(1)?
- •How frequently is the AC-16(1) policy reviewed and updated, and what triggers policy changes?
- •What training or awareness programs ensure personnel understand their responsibilities related to AC-16(1)?
Technical Implementation:
- •Describe the specific technical mechanisms or controls used to enforce AC-16(1) requirements.
- •What automated tools, systems, or technologies are deployed to implement AC-16(1)?
- •How is AC-16(1) integrated into your system architecture and overall security posture?
- •What configuration settings, parameters, or technical specifications enforce AC-16(1) requirements?
Evidence & Documentation:
- •What documentation demonstrates the complete implementation of AC-16(1)?
- •What audit logs, records, reports, or monitoring data validate AC-16(1) compliance?
- •Can you provide evidence of periodic reviews, assessments, or testing of AC-16(1) effectiveness?
- •What artifacts would you present during a FedRAMP assessment to demonstrate AC-16(1) compliance?
Ask AI
Configure your API key to use AI features.