AC-3(5): Security-Relevant Information

Control Family:

Access Control

CSF v1.1 References:

Baselines:

(Not part of any baseline)

Next Version:

Control Statement

The information system prevents access to [Assignment: organization-defined security-relevant information] except during secure, non-operable system states.

Supplemental Guidance

Security-relevant information is any information within information systems that can potentially impact the operation of security functions or the provision of security services in a manner that could result in failure to enforce system security policies or maintain the isolation of code and data. Security-relevant information includes, for example, filtering rules for routers/firewalls, cryptographic key management information, configuration parameters for security services, and access control lists. Secure, non-operable system states include the times in which information systems are not performing mission/business-related processing (e.g., the system is off-line for maintenance, troubleshooting, boot-up, shut down).