AC.L1-b.1.ii
Transaction & Function Control [FCI Data]
Source and approval
CMMC Assessment Guide — Level 1 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L1-b.1.ii in the reference catalog with its NIST cross-references
Official requirement
Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
Assessment objectives
a. the types of transactions and functions that authorized users are permitted to execute are defined; and
b. system access is limited to the defined types of transactions and functions for authorized users.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Give each approved user only the transactions and functions their work requires.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You supervise the team that manages DoD contracts for your company . Members of your team need to access the contract information to perform their work properly. Because some of that data contains FCI, you work with IT to set up your group’s systems so that users can be assigned access based on their specific roles [a]. Each role limits whether an employee has read-access or create/read/delete/update -access [b]. Implementing this access control restricts access to FCI information unless specifically authorized.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing access enforcement; system security plan; system design documentation; list of approved authorizations including remote access authorizations; system audit logs and records; system configuration settings and associated documentation; other relevant documents or records
Common mistakes
Treating a successful login as permission to use every application function.