Access Control · AC.L1-b.1.ii(b)
System access is limited to the defined types of transactions and functions for authorized users
An assessment objective under requirement AC.L1-b.1.ii, Transaction & Function Control, in the Access Control domain.
Objective Statement
System access is limited to the defined types of transactions and functions for authorized users
Objective identity
- Framework
- Cybersecurity Maturity Model Certification · Level 1
- Domain
- Access Control (AC)
- Objective ID
- AC.L1-b.1.ii(b)
- Parent Requirement
- AC.L1-b.1.ii · Limit access to permitted transactions and functions
Assessment Procedures
The official government assessment method for this objective, exactly as printed in the DoD CMMC Assessment Guide, Level 1, which reprints it from NIST SP 800-171A (June 2018). An assessor examines artifacts, interviews people, and tests mechanisms to determine the result.
Examine
- Access control policy
- Procedures addressing access enforcement
- System security plan
- System design documentation
- List of approved authorizations including remote access authorizations
- System audit logs and records
- System configuration settings and associated documentation
- Other relevant documents or records
Interview
- Personnel with access enforcement responsibilities
- System or network administrators
- Personnel with information security responsibilities
- System developers
Test
- Mechanisms implementing access control policy
Related Objectives
Source Authority
- Primary Authority
- NIST SP 800-171A (June 2018)
- Official Text
- Requirement Authority
- FAR 52.204-21(b)(1)
- Program Authority
- 32 CFR 170.15(c)(1)(ii) Table 2
- Framework Version
- CMMC Assessment Guide, Level 1 v2.13 (September 2024)
- Effective Date
- 2024-12-16
- Last Verified
- 2026-10-02
Cite This Page
“CMMC AC.L1-b.1.ii(b): System access is limited to the defined types of transactions and functions for authorized users.” AssessrLog, a product of ProfytAI Pte. Ltd.. Last verified 2026-10-02. https://assessrlog.com/cmmc/objectives/system-access-is-limited-to-the-defined-types-of-transactions-and/
Build the Record Behind This
AssessrLog logs the determination for this objective with its evidence and source record, so your Level 1 self-assessment stays traceable and ready to affirm. The MET, NOT MET, or N/A call is always yours to make.