AC.L2-3.1.1Authorized Access Control [CUI Data]
Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
[a]
authorized users are identified;[b]
processes acting on behalf of authorized users are identified;[c]
devices (and other systems) authorized to connect to the system are identified;[d]
system access is limited to authorized users;[e]
system access is limited to processes acting on behalf of authorized users; and[f]
system access is limited to authorized devices (including other systems).
Enclave allow-list: users, service principals, and compliant devices only
Implementation
AO coverage. Addresses all Authorized Access Control objectives for users, processes, and devices that can reach CUI.
Authorized users. Enclave membership is three Entra security groups (engineer, contracts, IT-ops). Direct ACL grants on the file server and SaaS roles are blocked; group membership is the only path. HR termination triggers same-day removal from all three groups via ServiceNow.
Processes acting on behalf of users. Service principals that read enclave storage are inventory-listed, use certificate credentials (no long-lived secrets in code), and are scoped to least privilege. Interactive user accounts are never used as batch identities.
Devices. Conditional Access requires Intune-compliant, encrypted endpoints for enclave apps. Unmanaged browsers fail closed. The on-prem file server accepts only domain-joined, compliant clients via the managed VPN.
Maintenance. Quarterly access review: group export vs job roster, plus service-principal inventory. New enclave apps cannot go live without a Conditional Access grant dependency documented in the change ticket.
Accepted gap. One plotter queue host cannot enforce Entra groups. It sits on an isolated VLAN reachable only from the enclave print VLAN; accounts are local and rotated quarterly.
What the evidence looks like
- Entra group definitions and membership export for the three enclave roles
- Conditional Access policy showing device compliance required for enclave cloud apps
- Service principal inventory with scopes and credential type
- Closed offboarding ticket showing same-day group removal
- Network diagram / ACL for the plotter exception
Environment
Tools
3 ratings on this revision
Across the finish line
Conditional Access + Intune compliance for devices is clear, and the plotter exception is named rather than hidden.
Gaps
Would want the quarterly review to list person + group + ticket id so the authorized-user story is not entirely implicit in the group.
1 found this helpfulAcross the finish line
If direct assignment is blocked, group membership is functionally the authorized-user list. Quarterly export vs job roster plus same-day offboarding is evidence it stays accurate.
1 found this helpfulAcross the finish line
Devices and service principals are handled with testable controls. Blocking direct ACL grants is the right spine for an enclave allow-list.
Gaps
Objective [a] asks that authorized users be identified. This identifies authorized groups. Without a person-level roster in the review artifact, an assessor is inferring authorization from membership alone.
Was this example useful?
Quick reaction — no account needed. For reasoning that moves the community meter, cast a full verdict below.
Discussion(0)
No discussion on this example yet
Verdicts capture a conclusion. Use a thread when the interesting part is the argument.
Sign in to start a thread.