AC-16(3)—Maintenance Of Attribute Associations By System
>Control Description
Maintain the association and integrity of ⚙organization-defined security and privacy attributes to ⚙organization-defined subjects and objects.
>Cross-Framework Mappings
>Supplemental Guidance
Maintaining the association and integrity of security and privacy attributes to subjects and objects with sufficient assurance helps to ensure that the attribute associations can be used as the basis of automated policy actions. The integrity of specific items, such as security configuration files, may be maintained through the use of an integrity monitoring mechanism that detects anomalies and changes that deviate from known good baselines. Automated policy actions include retention date expirations, access control decisions, information flow control decisions, and information disclosure decisions.
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What formal policies and procedures govern the implementation of AC-16(3) (Maintenance Of Attribute Associations By System)?
- •Who are the designated roles responsible for implementing, maintaining, and monitoring AC-16(3)?
- •How frequently is the AC-16(3) policy reviewed and updated, and what triggers policy changes?
- •What training or awareness programs ensure personnel understand their responsibilities related to AC-16(3)?
Technical Implementation:
- •Describe the specific technical mechanisms or controls used to enforce AC-16(3) requirements.
- •What automated tools, systems, or technologies are deployed to implement AC-16(3)?
- •How is AC-16(3) integrated into your system architecture and overall security posture?
- •What configuration settings, parameters, or technical specifications enforce AC-16(3) requirements?
Evidence & Documentation:
- •What documentation demonstrates the complete implementation of AC-16(3)?
- •What audit logs, records, reports, or monitoring data validate AC-16(3) compliance?
- •Can you provide evidence of periodic reviews, assessments, or testing of AC-16(3) effectiveness?
- •What artifacts would you present during a FedRAMP assessment to demonstrate AC-16(3) compliance?
Ask AI
Configure your API key to use AI features.