The operating system must enforce attribute-based access control policy over defined subjects and objects based upon organization-defined attributes to assume access permissions.

Attribute-based access control is an access control policy that restricts system access to authorized users based on specified organizational attributes (e.g., job function, identity), action attributes (e.g., read, write, delete), environmental attributes (e.g., time of day, location), and resource attributes (e.g., classification of a document). Organizations can create rules based on attributes and the authorizations (i.e., privileges) to perform needed operations on the systems associated with organization-defined attributes and rules. When users are assigned to attributes defined in attribute-based access control policies or rules, they can be provisioned to a system with the appropriate privileges or dynamically granted access to a protected resource.

This requirement also applies to Zero Trust initiatives.

Verify the operating system is configured to enforce attribute-based access control policy over defined subjects and objects based upon organization-defined attributes to assume access permissions.

If the operating system is not configured to enforce attribute-based access control policy over defined subjects and objects based upon organization-defined attributes to assume access permissions, this is a finding.

Configure the operating system to enforce attribute-based access control policy over defined subjects and objects based upon organization-defined attributes to assume access permissions.