Agencies must use a defined process to develop access control lists, for example the staged table in this control: stage 1, group every system resource by shared security objectives; stage 2, name the information owner of each resource group; stage 3, get agreement from the system owners; stage 4, group every system user by shared function or security objective; stage 5, name the owner or manager of each user group; stage 6, set how much access each user group gets to each resource, applying least-privilege access; stage 7, settle the access level for security administration in line with internal security policy; stage 8, note any classification, protective marking or releasability indicator that applies (NZEO or compartmented information, for example).
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.