Mapped Requirement and Assessment Objective
Mapped to NIST 800-171 requirement 3.1.1 and CMMC Level 2 assessment objective AC.L2-3.1.1[a].
What This Objective Means
This objective requires restricting system access so only authorized users can access systems that store, process, or transmit sensitive organizational information, including CUI when applicable.
Authorization must be intentional and controlled through defined access approval, provisioning, and deprovisioning processes.
Why Restricting Access Matters
Restricting access reduces the likelihood of unauthorized disclosure, misuse, or modification of information by ensuring access is limited to users with an approved business need.
Clear authorization boundaries also support accountability and make access reviews and incident investigations more reliable.
How to Implement AC 3.1.1a
Define who is authorized to access each system and establish an access approval process tied to roles, job functions, and data sensitivity. Provision accounts using centralized identity management where possible and disable or remove access promptly when users no longer require it.
Document access control rules and implementation details in policies, procedures, and the SSP to support NIST 800-171 control requirements and ensure consistency across systems.
Implementation Summary Table
| Control Activity | What to Do |
|---|---|
| Define Authorized Users | Identify which users (or roles/groups) are approved to access each system based on job function and business need. |
| Access Approval | Require documented approval before granting access, including who approved and what level of access was granted. |
| Provisioning Controls | Create accounts through controlled processes, using centralized identity and group-based assignments where practical. |
| Deprovisioning Controls | Disable accounts and remove access promptly when employment ends or responsibilities change. |
| Periodic Access Review | Review access regularly to confirm only authorized users retain access and remove unnecessary access. |
Evidence Assessors Commonly Expect
Assessors commonly expect access control policies, system access lists or group membership records, and evidence of approvals for account creation and privilege assignments.
They may also expect deprovisioning records, periodic access review outputs, and system configurations demonstrating that access is restricted in alignment with CMMC Level 2 compliance expectations.
Common Gaps to Avoid
Common gaps include granting access without documented approval, failing to remove access after role changes or terminations, and lacking periodic access reviews to validate ongoing authorization.
FAQ
What does AC.L2-3.1.1[a] require?
It requires restricting system access so only authorized users can access the system.
How is an authorized user determined?
An authorized user is approved through a defined process based on job function, business need, and the sensitivity of the system or data.
What evidence supports compliance with this objective?
Evidence can include access approval records, account provisioning and deprovisioning logs, access lists or group membership exports, and access review results.