IBM Cloud Docs
AC-6 (1) - Authorize Access to Security Functions

AC-6 (1) - Authorize Access to Security Functions

Control requirements

AC-6 (1) (a)

Authorize access for [Assignment: organization-defined individuals or roles] to: [Assignment: organization-defined security functions (deployed in hardware, software, and firmware)].

AC-6 (1) (b)

Authorize access for [Assignment: organization-defined individuals or roles] to: [Assignment: organization-defined security-relevant information].

NIST supplemental guidance

Security functions include establishing system accounts, configuring access authorizations (i.e., permissions, privileges), configuring settings for events to be audited, and establishing intrusion detection parameters. Security-relevant information includes filtering rules for routers or firewalls, configuration parameters for security services, cryptographic key management information, and access control lists. Authorized personnel include security administrators, system administrators, system security officers, system programmers, and other privileged users.