BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

AC-04(01) Object Security and Privacy Attributes

NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version
first version loaded AC part of AC-4

Title

Object Security and Privacy Attributes

Control

Use [Assignment: organization-defined security and privacy attributes] associated with [Assignment: organization-defined information, source, and destination objects] to enforce [Assignment: information flow control policies] as a basis for flow control decisions.

Discussion

Information flow enforcement mechanisms compare security and privacy attributes associated with information (i.e., data content and structure) and source and destination objects and respond appropriately when the enforcement mechanisms encounter information flows not explicitly allowed by information flow policies. For example, an information object labeled Secret would be allowed to flow to a destination object labeled Secret, but an information object labeled Top Secret would not be allowed to flow to a destination object labeled Secret. A dataset of personally identifiable information may be tagged with restrictions against combining with other types of datasets and, thus, would not be allowed to flow to the restricted dataset. Security and privacy attributes can also include source and destination addresses employed in traffic filter firewalls. Flow enforcement using explicit security or privacy attributes can be used, for example, to control the release of certain types of information.

Parameters

ac-4.1_prm_1: organization-defined security and privacy attributes
ac-4.1_prm_2: organization-defined information, source, and destination objects
ac-04.01_odp.01: security attributes
ac-04.01_odp.02: privacy attributes
ac-04.01_odp.03: information objects
ac-04.01_odp.04: information objects
ac-04.01_odp.05: source objects
ac-04.01_odp.06: source objects
ac-04.01_odp.07: destination objects
ac-04.01_odp.08: destination objects
ac-04.01_odp.09: information flow control policies

STIG rules that implement this control 0

No followed STIG rule cites a CCI indexed to this control (CCI list 2026-07-14).