AC-4(18): Security Attribute Binding

Control Family:

Access Control

Parent Control:

AC-4: Information Flow Enforcement

Priority:

P1: Implement P1 security controls first.

CSF v1.1 References:

ID.AM-3
PR.AC-5
PR.DS-5
PR.PT-4
DE.AE-1

Threats Addressed:

Information Disclosure

Baselines:

(Not part of any baseline)

Control is withdrawn in the next version of this control set and incorporated into: AC-16: Security and Privacy Attributes.

Control Statement

The information system binds security attributes to information using [Assignment: organization-defined binding techniques] to facilitate information flow policy enforcement.

Supplemental Guidance

Binding techniques implemented by information systems affect the strength of security attribute binding to information. Binding strength and the assurance associated with binding techniques play an important part in the trust organizations have in the information flow enforcement process. The binding techniques affect the number and degree of additional reviews required by organizations.