I question this. Constantly. While I understand certain requirements of AC-1 is inhertiable how can the procedures requirements be inheritable?
The procedures explain how my system follows the policy. Unless each and every system goes through the same process and the same requirements to get an account how is the entirety of AC-1 in heritable?
This applies to a DoD system where one system is classified and one is not. Steps to aquire an account on a classified system while closely the same are not the same as an unclassified system. This inlcudes but is not limited to certain training, certain approvers, need to know letters, etc.
So how/why is the DoD blanketing the -1 controls as inherited? Is there something Im missing or is the DoD (maybe just mine) is taking short cuts?
[link] [comments]