AC-16(5): Attribute Displays on Objects to Be Output

Control Family:

Access Control

Parent Control:

AC-16: Security and Privacy Attributes

CSF v1.1 References:

PR.AC-4
PR.AC-6

CSF v2.0 References:

PR.AA-05

PF v1.0 References:

CT.DM-P7
CT.DP-P5
CM.AW-P6
PR.AC-P4
PR.AC-P6

Threats Addressed:

Information Disclosure

Baselines:

(Not part of any baseline)

Previous Version:

NIST Special Publication 800-53 Revision 4:
AC-16(5): Attribute Displays For Output Devices

Control Statement

Display security and privacy attributes in human-readable form on each object that the system transmits to output devices to identify [Assignment: organization-defined instructions] using [Assignment: organization-defined naming conventions].

Supplemental Guidance

System outputs include printed pages, screens, or equivalent items. System output devices include printers, notebook computers, video displays, smart phones, and tablets. To mitigate the risk of unauthorized exposure of information (e.g., shoulder surfing), the outputs display full attribute values when unmasked by the subscriber.