manage.get.gov/docs/compliance/dist/system-security-plans/ato/ac-6.7.md

implementation-status	control-origination
c-not-implemented	c-inherited-cloud-gov c-inherited-cisa c-common-control c-system-specific-control

ac-6.7 - [catalog] Review of User Privileges

Control Statement

• [a] Review frequency the privileges assigned to roles and classes to validate the need for such privileges; and

• [b] Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.

Control guidance

The need for certain assigned user privileges may change over time to reflect changes in organizational mission and business functions, environments of operation, technologies, or threats. A periodic review of assigned user privileges is necessary to determine if the rationale for assigning such privileges remains valid. If the need cannot be revalidated, organizations take appropriate corrective actions.

Control assessment-objective

privileges assigned to roles and classes are reviewed frequency to validate the need for such privileges; privileges are reassigned or removed, if necessary, to correctly reflect organizational mission and business needs.

---

What is the solution and how is it implemented?

---

Implementation (a)

Add control implementation description here for item ac-6.7_smt.a

---

Implementation (b)

Add control implementation description here for item ac-6.7_smt.b

---