Documentation - V-274507

Title

The API must be configured to use approved authorizations for access control.

Description

<VulnDiscussion>To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems (e.g., networks, web servers, and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls mus...

Fix Text (Documentation Requirement)

Build or configure the API to enforce access control using DOD-approved authorization mechanisms. Ensure that authorization decisions are dynamic and based on contextual factors (e.g., user role, device compliance, request attributes). Update system documentation to reflect the authorization strategy and verify integration with access management and logging systems to meet Zero Trust Capability requirements.