AC-24(2)—No User Or Process Identity
>Control Description
Enforce access control decisions based on ⚙organization-defined security or privacy attributes that do not include the identity of the user or process acting on behalf of the user.
>Supplemental Guidance
In certain situations, it is important that access control decisions can be made without information regarding the identity of the users issuing the requests. These are generally instances where preserving individual privacy is of paramount importance. In other situations, user identification information is simply not needed for access control decisions, and especially in the case of distributed systems, transmitting such information with the needed degree of assurance may be very expensive or difficult to accomplish.
MAC, RBAC, ABAC, and label-based control policies, for example, might not include user identity as an attribute.
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What formal policies and procedures govern the implementation of AC-24(2) (No User Or Process Identity)?
- •Who are the designated roles responsible for implementing, maintaining, and monitoring AC-24(2)?
- •How frequently is the AC-24(2) policy reviewed and updated, and what triggers policy changes?
- •What training or awareness programs ensure personnel understand their responsibilities related to AC-24(2)?
Technical Implementation:
- •Describe the specific technical mechanisms or controls used to enforce AC-24(2) requirements.
- •What automated tools, systems, or technologies are deployed to implement AC-24(2)?
- •How is AC-24(2) integrated into your system architecture and overall security posture?
- •What configuration settings, parameters, or technical specifications enforce AC-24(2) requirements?
Evidence & Documentation:
- •What documentation demonstrates the complete implementation of AC-24(2)?
- •What audit logs, records, reports, or monitoring data validate AC-24(2) compliance?
- •Can you provide evidence of periodic reviews, assessments, or testing of AC-24(2) effectiveness?
- •What artifacts would you present during a FedRAMP assessment to demonstrate AC-24(2) compliance?
Ask AI
Configure your API key to use AI features.