documentation_complete: true

title: 'Access Control Policy and Procedures'

description: |-
    JBoss administrators must have access to guidance
    regarding account creation, permissions assignments, role assignments,
    etc.

rationale: |-
    A consistent, cohesive access control policy is impossible to attain
    without a well-documented access control policy and related procedures.
    Failure to do so typically results in over-assignment of access
    permissions for users and applications, stale access for users and
    applications, and other access control misconfigurations that reduce
    the effectiveness of the security policy.

severity: medium

identifiers:
    cce: ""

references:
    cis: ""
    disa: ""
    nist: AC-1

ocil_clause: 'there are no access control policy and procedures'
