03.01.02 - Access Enforcement

Access Enforcement requires that a system restricts access to Controlled Unclassified Information to only those users, processes, or devices with explicit authorization, employing technical mechanisms such as role-based or attribute-based controls, access control lists, and mandatory access policies to verify and enforce permissions on every access attempt.