Field notebook · source record
AC-3(5)
Access ControlSecurity-relevant Information
The statement below is source material, not a generated control summary.
Source statement
Prevent access to {{ insert: param, ac-03.05_odp }} except during secure, non-operable system states.
Guidance
Security-relevant information is information within systems that can potentially impact the operation of security functions or the provision of security services in a manner that could result in failure to enforce system security and privacy policies or maintain the separation of code and data. Security-relevant information includes access control lists, filtering rules for routers or firewalls, configuration parameters for security services, and cryptographic key management information. Secure, non-operable system states include the times in which systems are not performing mission or business-related processing, such as when the system is offline for maintenance, boot-up, troubleshooting, or shut down.
Organization-defined parameters
Organization-defined · unresolvedCatalog reference only. No project value has been assigned or evaluated here.
- ac-03.05_odp
security-relevant information
Source guidance- security-relevant information to which access is prevented except during secure, non-operable system states is defined;
Assessment reference context
Retained, not activated.1 source assessment records and 1 objective nodes are available as reference context. This surface runs none of them.
ac-3.5_objAC-03(05)1 objective nodes
- access to {{ insert: param, ac-03.05_odp }} is prevented except during secure, non-operable system states.
Reference method and authority
- InputExact release, source digest, control ID, and cited source fields
- Agent taskPrepare a bounded evidence request or test-plan draft
- Fail closedAbstain when source, scope, or assessment identity is missing
- Human acceptanceA named reviewer decides whether evidence supports the conclusion