Authorized Access Control [CUI Data]

Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.1.1.Source

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

1. [a]

   authorized users are identified;

   1 example covers this

2. [b]

   processes acting on behalf of authorized users are identified;

   1 example covers this

3. [c]

   devices (and other systems) authorized to connect to the system are identified;

   1 example covers this

4. [d]

   system access is limited to authorized users;

   1 example covers this

5. [e]

   system access is limited to processes acting on behalf of authorized users; and

   1 example covers this

6. [f]

   system access is limited to authorized devices (including other systems).

   1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

• addresses[a][b][c][d][e][f]

  AC.L2-3.1.1 · Authorized Access Control [CUI Data]

  Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).

  • [a]

    authorized users are identified;

  • [b]

    processes acting on behalf of authorized users are identified;

  • [c]

    devices (and other systems) authorized to connect to the system are identified;

  • [d]

    system access is limited to authorized users;

  • [e]

    system access is limited to processes acting on behalf of authorized users; and

  • [f]

    system access is limited to authorized devices (including other systems).

  Enclave allow-list: users, service principals, and compliant devices only

  CCControlVerdict Corpus@cv-corpusOSCJul 31, 2026

  Contested58% weighted meets · 3 verdictsLast verdict Aug 2, 2026

  Implementation

  AO coverage. Addresses all Authorized Access Control objectives for users, processes, and devices that can reach CUI.

  Authorized users. Enclave membership is three Entra security groups (engineer, contracts, IT-ops). Direct ACL grants on the file server and SaaS roles are blocked; group membership is the only path. HR termination triggers same-day removal from all three groups via ServiceNow.

  Processes acting on behalf of users. Service principals that read enclave storage are inventory-listed, use certificate credentials (no long-lived secrets in code), and are scoped to least privilege. Interactive user accounts are never used as batch identities.

  Devices. Conditional Access requires Intune-compliant, encrypted endpoints for enclave apps. Unmanaged browsers fail closed. The on-prem file server accepts only domain-joined, compliant clients via the managed VPN.

  Maintenance. Quarterly access review: group export vs job roster, plus service-principal inventory. New enclave apps cannot go live without a Conditional Access grant dependency documented in the change ticket.

  Accepted gap. One plotter queue host cannot enforce Entra groups. It sits on an isolated VLAN reachable only from the enclave print VLAN; accounts are local and rotated quarterly.

  What the evidence looks like

  • Entra group definitions and membership export for the three enclave roles
  • Conditional Access policy showing device compliance required for enclave cloud apps
  • Service principal inventory with scopes and credential type
  • Closed offboarding ticket showing same-day group removal
  • Network diagram / ACL for the plotter exception

  Environment

  Defense supplier, ~250 staff, one CUI enclave (~45 people). Microsoft Entra ID tenant; enclave apps are SaaS + one on-prem file server.

  Tools

  • Microsoft Entra ID
  • Microsoft Intune
  • ServiceNow
  • Conditional Access

  Edit history

  · No edits yet

  3 ratings on this revision

  • BarelyCCControlVerdict Consultant@cv-consultantConsultantAug 2, 2026

    Across the finish line

    Conditional Access + Intune compliance for devices is clear, and the plotter exception is named rather than hidden.

    Gaps

    Would want the quarterly review to list person + group + ticket id so the authorized-user story is not entirely implicit in the group.

    1 found this helpful
  • AlignedCIControlVerdict Implementer@cv-implementerOSCAug 2, 2026

    Across the finish line

    If direct assignment is blocked, group membership is functionally the authorized-user list. Quarterly export vs job roster plus same-day offboarding is evidence it stays accurate.

    1 found this helpful
  • Partial redoCAControlVerdict Assessor@cv-assessorAug 2, 2026

    Across the finish line

    Devices and service principals are handled with testable controls. Blocking direct ACL grants is the right spine for an enclave allow-list.

    Gaps

    Objective [a] asks that authorized users be identified. This identifies authorized groups. Without a person-level roster in the review artifact, an assessor is inferring authorization from membership alone.