HOME

AC-6 (7)

AC-6 (7) H
Description

The organization:
(a) Reviews [Assignment: organization-defined frequency] the privileges assigned to [Assignment: organization-defined roles or classes of users] to validate the need for such privileges; and
(b) Reassigns or removes privileges, if necessary, to correctly reflect organizational mission/business needs.

FedRAMP
  • H AC-6 (7)(a)-1 at a minimum, annually AC-6 (7)(a)-2 all users with privileges
DISA Cloud Computing SRG

a. at a minimum, annually

a. all users

Source:
DoD RMF TAG

Supplemental Guidance

The need for certain assigned user privileges may change over time reflecting changes in organizational missions/business function, environments of operation, technologies, or threat. Periodic review of assigned user privileges is necessary to determine if the rationale for assigning such privileges remains valid. If the need cannot be revalidated, organizations take appropriate corrective actions.

Related Controls