Information Assurance - System Access Control Records (DD Form 2875 or equivalent)
An XCCDF Rule
Description
<VulnDiscussion>If accurate records of authorized users are not maintained, then unauthorized personnel could have access to the system. Failure to have user sign an agreement may preclude disciplinary actions if user does not comply with security procedures. REFERENCES: CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl C, para 26.a. DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Encl 2, para 13.j., 13.y.(1); Encl 3, para 10.c., 18.b., 19.c. NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AC-3(3), AC-3(4), AC-3(5), AC-3(7), AC-2(7). DOD 8570.01-M, Information Assurance Workforce Improvement Program DODD 8140.01 Cyberspace Workforce Management DODI 8140.02 Identifying-Tracking and Reporting of Cyberspace Workforce Requirements DODM 8140.03 Cyberspace Workforce Qualification and Management System</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-245775r1008541_rule
- Severity
- Medium
- Updated
Remediation - Manual Procedure
1. Written procedures for personnel who request access to a computer system must be developed.
2. A System Authorization Access Request (SAAR) form (DD Form 2875 or equivalent) must be used to define and control individual access for systems. If applicable, the most current version of the DD Form 2875 SAAR must be used for ALL NEW account requests. Note: This is not a mandate to update previously processed account request forms to the most current version. Locally developed or service-level forms may also be used if the same information found on the DD Form 2875 is used.
3. Local or service-level SAAR forms must minimally contain appropriate information for checking compliance with security requirements for privileged, routine user, Classified, and Unclassified systems access as on the DD Form 2875. Information required includes identification of the individual requesting access, signature dates, supervisory approval, ISSM and SM approval, investigation level and security clearance required, investigation and security clearance possessed. Ensure all appropriate Information Assurance (IA) training was completed for the systems personnel are requesting access to.