No User or Process Identity
LOW MODERATE HIGHRequirements NIST SOURCE
Enforce access control decisions based on [organization-defined security or privacy attributes] that do not include the identity of the user or process acting on behalf of the user.
Discussion (NIST Supplemental Guidance)
In certain situations, it is important that access control decisions can be made without information regarding the identity of the users issuing the requests. These are generally instances where preserving individual privacy is of paramount importance. In other situations, user identification information is simply not needed for access control decisions, and especially in the case of distributed systems, transmitting such information with the needed degree of assurance may be very expensive or difficult to accomplish. MAC, RBAC, ABAC, and label-based control policies, for example, might not include user identity as an attribute.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for AC-24(2) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- security attributes that do not include the identity of the user or process acting on behalf of the user are defined (if selected);
- privacy attributes that do not include the identity of the user or process acting on behalf of the user are defined (if selected);
- access control decisions are enforced based on <AC-24(02)_ODP[01] security attributes> that do not include the identity of the user or process acting on behalf of the user (if selected);
- access control decisions are enforced based on <AC-24(02)_ODP[02] privacy attributes> that do not include the identity of the user or process acting on behalf of the user (if selected).
Examine
[SELECT FROM: Access control policy; procedures addressing access enforcement; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; privacy plan; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with access enforcement responsibilities; system/network administrators; organizational personnel with information security and privacy responsibilities; system developers].
Test
[SELECT FROM: Mechanisms implementing access enforcement functions].
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for AC-24(2). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- Access control policy
- system security plan
- privacy plan
Configuration
- system design documentation
- system configuration settings and associated documentation
Testing
- Mechanisms implementing access enforcement functions
Other Records
- procedures addressing access enforcement
- system audit records
- other relevant documents or records