Rule ID
SV-288262r1252957_rule
Version
V1R0.1
RBAC is an access control policy that restricts information system access to authorized users. Without these security policies, access control and enforcement mechanisms will not prevent unauthorized access. Organizations can create specific roles based on job functions and the authorizations (i.e., privileges) to perform needed operations on organizational information systems associated with the organization-defined roles. When users are assigned to the organizational roles, they inherit the authorizations or privileges defined for those roles. RBAC simplifies privilege administration for organizations because privileges are not assigned directly to every user (which can be a significant number of individuals for mid- to large-size organizations) but are instead acquired through role assignments. RBAC can be implemented either as a mandatory or discretionary form of access control. This requirement pertains to Zero Trust.
Navigate to the user/role configuration function within the application. The role-based hierarchical structure must be defined by the authorizing official (AO) (or otherwise appointed personnel). 1. Verify at least two roles exist in the structure. 2.Verify at least one user is assigned to each role. Otherwise, this is a finding.
Navigate to the user/role configuration function within the application. The role-based hierarchical structure must be defined by the AO (or otherwise appointed personnel). 1. Create at least two roles in the structure. 2. Assign at least one user to each role.